Theoretical results and asymptotic bounds in this area are plentiful (see [Dow81], e.g.), but we are not aware of anyone applying heuristics, as we do, to make chains useable in practice. Definitions and notationAn addition chain for a given number is a list of numbers having the following properties: l the frost number is one; . every number is the sum of two earlier numbers; l the given number occurs in the chain (at the end, that is). In the case of an addition sequence, the last condition becomes: l the given numbers occur in the sequence. We view such a list as a series of exponents used to do an exponentiation.The length of an addition chain or sequence is the number of elements in the chain, apart from the initial one. G. Brassard (Ed.): Advances in

No abstract

Very strong de6mtions of security for signature schemes have bcen p m posed in the litcrarure. Construdicms for such schemes have btcn proposed, but so far they have only becn of theoruical interest and have becn considered far too inefficicnt for praaical use. Here we present a new scheme that satisfies these-g a t ddiniticmr and uses e s~e k t i d y the same amount of computation and memory as the widely applied RSA scheme. The scheme is based on the well known RSA assumption. Our signatures can be thought of as products resulting from a two-dimensional Lampon scheme, where me dimension sonsuts of a list of public constarus, and the olher is the sequence of odd prim- .