<figure><img src="image_1.png" /></figure>

HAL
open science

# Online/Offline Digital Signatures: A Systematic Literature Review

Juliet Samandari, Clémentine Gritti

► To cite this version:

Juliet Samandari, Clémentine Gritti. Online/Offline Digital Signatures: A Systematic Literature Review. IEEE Access, 2025, 13, pp.90991-91011. 10.1109/ACCESS.2025.3570689. hal-05420540

HAL Id: hal-05420540

https://hal.science/hal-05420540v1

Submitted on 17 Dec 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Open licence - etalab
Received 7 April 2025, accepted 7 May 2025, date of publication 16 May 2025, date of current version 30 May 2025.

Digital Object Identifier 10.1109/ACCESS.2025.3570689

SURVEY

# Online/Offline Digital Signatures: A Systematic Literature Review

JULIET SAMANDARI<sup>1</sup> AND CLÉMENTINE GRITTI<sup>2</sup>

Corresponding author: Juliet Samandari (juliet.samandari@pg.canterbury.ac.nz)

**ABSTRACT** In the rapidly evolving digital landscape, efficient cryptographic systems are increasingly critical. Digital Signature (DS) schemes are essential for ensuring data integrity and authenticity, particularly in resource-constrained environments like the Internet of Things (IoT). The Offline/Online (O/O) extension has gained attention for its effective signing process, as it allows for the precomputation of operations beforehand. Informally, in this kind of scheme, signing a message involves two stages. The first is an offline stage that requires moderate computation but can be done in advance, before the message is known. The second is an online stage that starts once the message is available, using the precomputed data to complete the signature more quickly. This survey provides the first comprehensive overview of the adaptation of O/O constructions for various resource-constrained use cases, such as IoT, low-power and mobile contexts, and other contexts, such as blockchains, where latency is a crucial metric. We reviewed 36 O/O DS schemes, focusing on trends, challenges, and applications. We examined the benefits, drawbacks, and potential areas for improvement of the reviewed O/O schemes, as well as identifying the features inherent to the O/O design. Our analysis indicates that the latter effectively mitigates issues related to expensive computations, delays, and high energy consumption, provided that the increased storage demands for offline signatures are manageable. This survey lays the groundwork for future research and development of O/O schemes, driven by the increasing prevalence of constrained environments where these schemes are particularly useful.

**INDEX TERMS** Authentication, blockchain, integrity, Internet of Things, mobile ad-hoc network, online/offline signature, wireless sensor network.

## I. INTRODUCTION

Digital Signature (DS) schemes are cryptographic mechanisms designed to ensure integrity, meaning that data has not been altered during transmission, and authentication, meaning that communicating devices are who they claim to be. These schemes provide the foundation for secure Internet communications [1].

As the number of interconnected devices continues to grow, particularly in contexts like Internet of Things (IoT) applications [2] and Wireless Sensor Networks (WSNs) [3], the efficiency of DS schemes has become a key concern. Devices in IoT and WSN contexts are often resource-constrained in terms of computational power, memory, or battery life, resulting in significant performance

bottlenecks. In response, various optimization techniques have been proposed to improve the efficiency of DS schemes. One such approach is the Online/Offline (O/O) construction, first introduced by Even et al. [4], which allows for the precomputation of substantial operations to reduce the computational load during the final signing process.

In an O/O scheme, signing a message occurs in two stages. The first, offline stage involves most of the computation and can be performed ahead of time, even before the message is known. The second, online stage takes place once the message is available and uses the precomputed data to expedite the signing process. Over the last decade, this construction has gained popularity due to its potential to enhance the performance of DS schemes, particularly in resource-constrained environments [5], [6], [7], [8], [9].

Despite its long history and growing popularity, a comprehensive survey of the existing O/O DS schemes is still

The associate editor coordinating the review of this manuscript and approving it for publication was Stefano Scanzio<sup>1</sup>.

<footnote n="1">¹Department of Computer Science and Software Engineering, University of Canterbury, Christchurch 8041, New Zealand</footnote>

<footnote n="2">²INRIA, INSA Lyon, 69628 Villeurbanne, France</footnote>
lacking. In particular, no systematic effort has been made to collate these works, analyze trends in their development, and assess their applicability in various contexts. This survey addresses the gap by reviewing 36 O/O DS schemes and analyzing their common trends, challenges, and applications. We categorize these schemes based on their intended use cases, most of which involve devices with limited resources, such as computational power, energy, and memory (e.g., IoT, WSN, low-power, and mobile environments). Another popular use case is blockchain technologies, where latency represents a primary concern.

Our review reveals that the O/O construction can effec-
tively address concerns related to expensive computations,
long delays, and high energy consumption in DS schemes,
provided that increased storage requirements can be man-
aged. While signing efficiency is largely improved, the
practicality of deploying the O/O construction is heavily
dependent on the storage availability for the generated offline
signatures.

A. CONTRIBUTIONS

In this literature survey, our contributions are as follows:

* We provide a formal definition of O/O signature schemes and their security models, along with all the necessary preliminaries to understand the reviewed schemes.

* We identify the main use cases for O/O schemes and categorize the reviewed schemes accordingly.

* We analyze the reviewed schemes with respect to their motivations (e.g. reducing online computation) and summarize their technical contributions (e.g. cryptographic primitives, security assumptions) and limitations (e.g. increased parameter size).

* We identify the main takeaways regarding the use of O/O digital signature schemes in specific contexts (e.g. constrained environments) and provide insights to help design and develop future O/O signature schemes.

This survey presents the first comprehensive overview
of the state-of-the-art in the O/O design for authentication
and integrity in resource-constrained and latency-sensitive
environments.

B. RESEARCH METHODOLOGY

To select the papers to be reviewed in our survey, we used
Google Scholar and Scopus. The search terms consisted of
one keyword from the following set {‘online/offline’, ‘on-
line/off-line’, ‘online offline’, ‘online-friendly’}, and one
keyword from this set {‘digital signature’, ‘authentication’,
‘integrity’}. Our motivation was to include all relevant papers
that present DS schemes based on an O/O construction.
We did not include papers that propose DS schemes with
similar goals such as reducing online computation, for
instance, signcryption [10] and server-assisted signing [11].

We have also used the citations and references of the first
selected papers to identify other DS schemes that incorporate

the O/O construction. We have referenced all schemes that
have been compared to the reviewed O/O schemes; however,
we have not reviewed them independently if they are not O/O
schemes.

Using these strategies, we identified 36 papers of interest to our survey, and reviewed them according to their use cases. We also included 12 additional papers in our history section, which provide important insights into the origin and evolution of the O/O signature concept since it was first proposed in 1989 [4]. To summarize, our focus has been on papers that propose an O/O DS scheme for a specific use case, with a particular emphasis on the most recent publication years.

We have observed a gradual growth in the publication of O/O schemes over the last 10 years. The oldest paper we reviewed dates back to 2005. The number of published papers has increased from 2 in 2005 to 4 in 2010, 8 in 2013, 10 in 2016, and ultimately peaked at 15 in 2022. More papers were published in journals (20 papers) than in conferences (13 papers), and 3 of the reviewed papers are eprints.

For the 36 reviewed papers, the most common topics and publication venues are as follows: computing/computer science (8 papers), cryptography/cryptology (7 papers), information security/science (6 papers), networks and communication (6 papers), theoretical computer science (3 papers), and security and privacy (2 papers). Additionally, only a few papers were published in application-specific venues, with one paper each in areas such as IoT, sensors, distributed systems, and healthcare engineering.

C. ROAD MAP

We begin our survey by discussing the scope and history
of O/O schemes in Section II. This is followed by a
formalization of defining O/O DS schemes and the pre-
liminaries (mathematical objects, security assumptions, and
cryptographic primitives) relevant to the reviewed schemes in
Section III. We then categorize the surveyed papers based on
their intended use cases in Section IV. The main takeaways,
including identified trends, improvements, and drawbacks,
are discussed in Section V. Finally, we provide a brief
overview of related studies in Section VI and conclude with
our final remarks in Section VII.

II. SCOPE AND HISTORY

A. SCOPE

There have been various options for improving the efficiency
and performance of DS schemes, motivated by the aim of
deploying them in resource-constrained environments [2].
We will briefly discuss those options, and then motivate our
choice to focus on O/O signature schemes:

*   **Hybridization** involves combining several types of schemes to leverage the benefits each one offers. However, this typically introduces overhead in management, as multiple mechanisms are now in use [12].

*   **Lightweight schemes** are specifically designed for resource-constrained devices. However, this approach
typically involves tailoring the implementation for a
specific processor to reduce a particular constraint, such
as memory usage or energy consumption [13], [14].
This, in turn, limits the usability and interoperability of
these schemes.

*   **Adaptive security** allows for adapting the security level according to the capabilities of participating devices. In particular, a lower level of security, and thus a lighter computational overhead, could be investigated for a resource-limited device [15]. However, such a design choice could be exploited by attackers.

*   **Outsourcing computation** entails having parts of the signature generation made by another device. This either requires a noticeable level of trust in the entity performing the generation task, or incurs additional verification steps [16].

*   **O/O constructions** enable parts of the signature gen-
    eration to be conducted offline, before the to-be-signed
    message is known. This approach can be implemented
    on resource-constrained devices, at the cost of storing
    extra information, and does not rely on additional trust
    assumptions [4].

Unlike hybridization, an O/O extension only relies on one original DS scheme. Unlike lightweight schemes, O/O schemes can be deployed on various types of devices, and thus processors. Furthermore, unlike adaptive security and outsourcing computation, practical improvements are achieved without sacrificing the level of security or needing a trusted external entity, respectively. Consequently, we chose to review O/O schemes.

O/O signatures have been proposed mainly for their
performance improvements [17], [18], [19], [20]. Indeed,
by enabling precomputations of costly operations before-
hand, the generation of signatures is made easier. This
makes authentication and integrity processes accessible to
resource-constrained environments such as IoT. There are
three main ways to achieve an O/O construction:

1) **One-time keys and signatures:** A one-time signature scheme is combined with a DS scheme.

2) **Hash-sign-switch paradigm:** The hash-sign-switch steps, which involve a trapdoor hash scheme, are embedded in a DS scheme.

3) **Original O/O schemes:** An O/O signature scheme can be designed from scratch, such that the final signature is the result of two distinct parts.

In this survey paper, we will discuss O/O schemes that have
used all three methods.

B. HISTORY

O/O signature schemes were first proposed by Even et al. [4], and extended in [21], as an option for a more efficient signature generation when implementing resource-intensive signature schemes (e.g. when increasing security levels). The authors proposed splitting the signing process into two parts as follows: (i) The first part is done offline and independent

of the message to be signed; (ii) The second part is carried out
after the message is received and is conducted online. They
also provided a general framework to convert any DS scheme
into an O/O signature scheme.

At the beginning of the 2000s, an improved O/O signature
scheme was proposed [22]. In this paper, it was first shown
that the originally proposed O/O signature scheme [4] causes
a quadratic increase in the signature length. Moreover, a more
efficient scheme that only doubles the length of the signature
was presented, by using trapdoor hash functions. During the
offline stage, the hash of an arbitrary message and nonce
is signed. During the online stage, a random value must be
found such that it results in a hash collision between the
offline computed hash and the hash of the message and this
random value. Such a scheme is called *hash-sign-switch*. One
can observe that the online computation is independent of the
signature scheme being used. Moreover, this O/O scheme is
as secure as the original signature scheme.

In the following years, multiple O/O DS schemes were
proposed [23], [24], [25], [26], [27]. In [28], the offline
signature was made public and therefore could be transmitted
in the offline stage. This concept was further discussed and
presented as an important consideration for future work
in [29].

In the late 2000s, O/O DS schemes were presented for specific use cases, such as ad-hoc networks [30] and constrained-resource environments [31]. Subsequent O/O DS schemes were also introduced for explicit contexts, marking the beginning of a trend. During this time, the first O/O DS scheme using identity-based cryptography was developed [30]. This cryptographic primitive has been widely used as a basis for the O/O design thereafter. Standardization of an O/O scheme happened in 2008 [31], [75].

In 2018, the first O/O DS scheme secure against quantum computers was described in [5] This paper specifically considered the challenges around implementing quantum-resistant DS schemes, which are known to be energy-intensive, on devices with reduced computational capacities. More recently, with the increasing popularity of blockchain technologies, O/O signatures have been used in such a context [39], [40].

III. OFFLINE/ONLINE DIGITAL SIGNATURES

Here, we formally define O/O DS schemes and their security
properties, along with presenting the cryptographic building
blocks used for their design and security. A diagram showing
a representation of an O/O interaction using the definition of
the O/O construction as originally proposed in [4] can be seen
in Figure 1.

A. FORMAL DEFINITIONS

In this section, we give two formal definitions of an O/O
signature scheme based on [4] and [22] respectively.

To formally present O/O signatures, we recall the general
definition of a DS scheme. A DS signature scheme $S =$
<figure><img src="image_3.png" /><figcaption>FIGURE 1. An O/O Interaction Using the Originally Proposed Scheme in [4].</figcaption></figure>

(S.KeyGen, S.Sign, S.Verif) can be formally defined as follows:

* **Setup: (PK, SK) ← S.KeyGen(k)**

On input of a security parameter $k$, the algorithm `S.KeyGen` outputs the public key `PK` and the secret key `SK`.

* **Signaling: $\sigma \leftarrow S.Sign SK, m$**

On inputs the secret key `SK` and the message `m`, the algorithm `S.Sign` outputs a signature `\sigma` on the message `m`.

* **Verification: $0/1 \leftarrow S.Verif(PK, m, \sigma)$**

On inputs the public key `pk`, the message `m`, and the signature `\sigma`, the algorithm `S.Verif` outputs either 0 meaning that the signature `\sigma` is valid for the message `m` or 1 otherwise.

## 1) CORRECTNESS

If $(PK, SK) \leftarrow S.KeyGen(k)$ and $\sigma \leftarrow S.Sign SK, m)$ for a given message $m$, then $S.Verif(PK, m, \sigma) \to 0$.

## 2) UNFORGEABILITY

A DS scheme is considered unforgeable when it is not possible to forge a valid message-signature pair $(m, \sigma)$, meaning that $S.Verif(PK, m, \sigma) \to 1$ as long as the secret key `SK` is not known.

In [4], the O/O signature scheme is split into four parts: setup, offline stage, online stage, and verification. Let $h$ be a hash function. Let $S = (S.KeyGen, S.Sign, S.Verif)$ be a DS scheme and $OTS = (OTS.KeyGen, OTS.Sign, OTS.Verif)$ be a one-time DS scheme.

The O/O signature scheme can be formally defined as follows:

* **Setup: (PK, SK) ← S.KeyGen(1^k)**

On input of a security parameter $k$, the algorithm `S.KeyGen` outputs the public key `PK` and the secret key `SK`.

* **Offline Stage: $(pk, sk) \leftarrow OTS.KeyGen(1^\lambda)$ and $\sigma_{off} \leftarrow S.Sign SK, pk$**

On input of a security parameter $\lambda$, the algorithm `OTS.KeyGen` outputs the public key `pk` and the secret key `sk`. On inputs the secret key `SK` and the public key `pk`, the algorithm `S.Sign` outputs an offline signature $\sigma_{off}$ on the 'message' `pk`.

* **Online Stage: $\sigma_{on} \leftarrow OTS.Sign(sk, h(m))$ and $\sigma = (pk, \sigma_{off}, \sigma_{on})$**

On inputs the secret key `sk` and the hash `h(m)` of the message `m`, the algorithm `OTS.Sign` outputs an online signature $\sigma_{on}$ on the message `m`. Let $\sigma$ be the tuple $(pk, \sigma_{off}, \sigma_{on})$.

* **Verification: $0/1 \leftarrow S.Verif(PK, pk, \sigma_{off})$ and $0/1 \leftarrow OTS.Verif(pk, h(m), \sigma_{on})$**

On inputs the public key `PK`, the 'message' `pk`, and the signature $\sigma_{off}$, the algorithm `S.Verif` outputs either 0 meaning that the signature $\sigma_{off}$ is valid for the 'message' `pk` or 1 otherwise. On inputs the public key `pk`, the hash `h(m)` of the message `m`, and the signature $\sigma_{on}$, the algorithm `OTS.Verif` outputs either 0 meaning that the signature $\sigma_{on}$ is valid for the message `m` or 1 otherwise.

## 3) CORRECTNESS

If $(PK, SK) \leftarrow S.KeyGen(1^k), (pk, sk) \leftarrow OTS.KeyGen(1^\lambda)$, $\sigma_{off} \leftarrow S.Sign SK, pk)$, $\sigma_{on} \leftarrow OTS.Sign(sk, h(m))$, and $\sigma = (pk, \sigma_{off}, \sigma_{on})$ for a given message $m$, then $S.Verif(PK, pk, \sigma_{off}) \to 0$ and $OTS.Verif(pk, h(m), \sigma_{on}) \to 0$.
### 4) UNFORGEABILITY

If both the DS scheme $S = (\text{S.KeyGen}, \text{S.Sign}, \text{S.Verif})$ and the one-time DS scheme $\text{OTS} = (\text{OTS.KeyGen}, \text{OTS.Sign}, \text{OTS.Verif})$ are existentially unforgeable against chosen message attacks, and the hash function is collision-resistant, then the overall scheme can also be proven existentially unforgeable against adaptive chosen message attacks [4].

In [22], the design of the O/O scheme differs from the original scheme in using a keyed hash function. Such a scheme is called *hash-sign-switch*. Note that this design is commonly chosen in recent O/O signature schemes since any underlying signature scheme can be used and its efficiency is twice better than the original scheme [7], [20].

The same four parts are kept. However, instead of using a one-time signature scheme, a trapdoor hash function is involved. The difference with a basic hash function is that two keys, hash key $HK$ and trapdoor key $TK$, are generated. The hash key $HK$ is required to compute the hash of a given value. The trapdoor key $TK$ is needed to find a collision more efficiently. Let $S = (\text{S.KeyGen}, \text{S.Sign}, \text{S.Verif})$ be a DS scheme and $H = (\text{H.KeyGen}, \text{H.Hash})$ be the scheme to call the trapdoor hash function $H$.

* **Setup: (PK, SK) ← S.KeyGen(1^k) and (HK, TK) ← H.KeyGen(1^λ)**

On input of a security parameter $k$, the algorithm $\text{S.KeyGen}$ outputs the public key $PK$ and the secret key $SK$. On input of a security parameter $\lambda$, the algorithm $\text{H.KeyGen}$ outputs the hash key $HK$ and the trapdoor key $TK$.

* **Offline Stage: $h' ← H.Hash(HK, m', r')$ and $\sigma ← S.Sign SK, h'$**

Let $m'$ be randomly chosen from the message domain $M$ and $r'$ be randomly chosen from the witness domain $R$. On inputs the hash key $HK$, the offline message $m'$, and its witness $r'$, the algorithm $\text{H.Hash}$ outputs the hash $h'$. On inputs the secret key $SK$ and hash $h'$, the algorithm $\text{S.Sign}$ outputs the offline signature $\sigma$.

* **Online Stage:**

Let $m$ be a message from the domain $M$. The aim is to find a value $r$ from the domain $R$ such that $\text{H.Hash}(HK, m, r) = \text{H.Hash}(HK, m', r')$ (i.e. a collision). This can be achieved efficiently using the trapdoor key $TK$. Let $(r, \sigma)$ be an online signature for the message $m$.

* **Verification: $h ← H.Hash(HK, m, r)$ and $0/1 ← S.Verif(PK, h, \sigma)$**

On inputs the hash key $HK$, the message $m$, and its witness $r$, the algorithm $\text{H.Hash}$ outputs the hash $h$. On inputs the public key $pk$, the hash $h$ of the message $m$ and witness $r$ and the signature $\sigma$, the algorithm $\text{S.Verif}$ outputs either 0 meaning that the signature $\sigma$ is valid for the message $m$ or 1 otherwise.

### 5) CORRECTNESS

If $(PK, SK) \leftarrow \text{S.KeyGen}(1^k)$, $(HK, TK) \leftarrow \text{H.KeyGen}(1^\lambda)$, $h' \leftarrow \text{H.Hash}(HK, m', r')$, $\sigma \leftarrow \text{S.Sign}(SK, h')$, and $\text{H.Hash}(HK, m, r) = \text{H.Hash}(HK, m', r')$ for a given message $m$ and a witness $r$, then $h \leftarrow \text{H.Hash}(HK, m, r)$ and $\text{S.Verif}(PK, h, \sigma) \to 0$.

### 6) UNFORGEABILITY

The trapdoor hash function must have an *inversion property* to ensure security. Given the key pair $(HK, TK)$, a message $m$, and an element $c$ in the hash domain, it is easy to find the witness $r$ such that $\text{H.Hash}(HK, m, r) = c$. If the DS scheme $S = (\text{S.KeyGen}, \text{S.Sign}, \text{S.Verif})$ is existentially unforgeable against chosen message attacks, and the trapdoor hash function is collision-resistant and easily invertible using the trapdoor key, then the overall scheme can also be proven existentially unforgeable against adaptive chosen message attacks [22].

## B. SECURITY MODELS

### 1) UNFORGEABILITY

A DS scheme needs to uphold unforgeability to provide assurance of authenticity and integrity. *Unforgeability* means that a valid signature-message pair cannot be generated without knowing the secret key. There are two main types of forgery, namely selective and existential, that we define below.

A *selective* forgery happens when an adversary creates a valid signature for a *selected* message. An *existential* forgery occurs when an adversary creates at least one valid signature for any message. Hence, schemes that have existential unforgeability are more secure than those with selective unforgeability.

### 2) EXISTENTIAL UNFORGEABILITY

Existential Unforgeability (EUF) is seen as the minimal security level for O/O DS schemes. Two variants have been proposed:

#### a: EUF-CMA

One of the most common security forms is EUF under a Chosen-Message Attack (EUF-CMA) [33]. Even if an adversary can gain access to signatures for the messages that it has chosen, it cannot create a new valid signature-message pair. This is sometimes referred to as EUF under adaptive chosen message attack [34], but the security achieved is the same.

#### b: EUF-CIA

Another model is EUF under Concurrent Interactive Attack (EUF-CIA) [35]. Interactive attacks are used against zero-knowledge signature schemes that require an interactive process when verifying the signatures. Let an adversary gain access to a set of signatures. It then interacts with the signer, pretending to be a verifier, such that it provides the message to be signed.
### 3) STANDARD AND RANDOM ORACLE MODELS

The *standard model* assumes access to an oracle that gives a valid signature for any message provided to it by an adversary. The adversary can then use these received message-signature pairs to generate a forged signature on a new message.

The *random oracle model* (ROM), first proposed in 1993 [36], gives an ideal model to schemes based on hash functions. In the ROM, hash functions are seen as random. Given a new input to the random oracle, the hash digest is created randomly and kept for future requests. Therefore, nothing is known about the digest until the corresponding input is submitted. The ROM thus enables the attack effort to be expressed in terms of a number of invocations to the oracle.

However, a real random oracle is difficult to achieve. Even if hash functions are good candidates, their security properties (e.g., collision resistance) do not imply that such a function is a random oracle. Stronger security levels are thus reached in the standard model compared to the ROM.

## C. BUILDING BLOCKS

We define the cryptographic building blocks that are utilized in the papers we reviewed. Those building blocks are both related to the design and the security of the O/O signature schemes considered in this paper.

### 1) MATHEMATICAL OBJECTS

#### a: ELLIPTIC CURVES

Elliptic curves are curves defined over a finite field, say $F$, represented with the equation $y^2 = x^3 + ax + b$ for some coefficients $a$ and $b$ in $F$. Elliptic curves have been used to construct several O/O signature schemes [37], [38], [39], [40]. A generalization of elliptic curves is referred to as hyperelliptic curves and has been used for the O/O signatures proposed in [6] and [41].

#### b: LATTICES

A lattice is a set of points periodically structured in an $n$-dimensional space. Specifically, a lattice $\Lambda$ in $\mathbb{R}^n$ has the form $\Lambda = \{\sum_{i=1}^{n} a_i v_i | a_i \in \mathbb{Z}\}$, where $\{v_1, \dots, v_n\}$ is a basis for $\mathbb{R}^n$. Lattices have been used to build PQ cryptosystems, systems that are secure against attacks from quantum computers [42], [43]. Several O/O schemes have been built from lattices [5], [8], [44], [45].

#### c: GROUP RINGS

A group ring is built by combining a group and a commutative ring. Given a finite group $G = \{g_1, \dots, g_n\}$ and a commutative ring $\mathbb{R}$, the elements in a group ring $\mathbb{R}[G]$ are formal sums $\sum_{i=1}^{n} r_i g_i$ for $r_i \in \mathbb{R}$. Group rings were used for the O/O scheme proposed in [46].

#### d: HASH FUNCTIONS

Hash functions have been widely used in DS schemes. Their security property, namely collision resistance, enables the

underlying signature scheme to achieve unforgeability and improve its performance. A hash function deterministically maps a message of arbitrary size to a digest of fixed size [47]. Hash functions were used for O/O schemes in [7] and [9].

An extended notion is trapdoor hash functions, also referred to as Chameleon hash functions [48]. A pair of hashing and trapdoor keys exists for each function such that the hashing key is needed to generate the hash value, while the secret trapdoor key allows one to easily find collisions in the domain of the function. The hash function is collision-resistant as long as the adversary cannot access the trapdoor key. They have been used as a building block for the O/O scheme in [22].

#### e: CHAOTIC MAPS

A chaotic map is a cryptosystem used to generate non-linear and random sequences to encrypt some message. Random sequences are generated from initial seed values. The mapping is considered chaotic if minor changes to the initial seed result in large changes in the outputted sequence. The O/O schemes based on chaotic maps use the specific ones from Chebyshev [46], [49].

#### f: BILINEAR PAIRINGS

Given the groups $G$ and $G_T$, a (symmetric) bilinear pairing is the map $e: G \times G \to G_T$ such that [50]: (i) Given $g \in G$ and $a, b \in \mathbb{Z}_p$, $e(g^a, g^b) = e(g, g)^{ab}$ (bilinearity); (ii) There exists $g \in G$ such that $e(g, g) \neq 1_{G_T}$ (non-degeneracy); (iii) There exists an efficient algorithm to compute $e(g, h)$ for all $g, h \in G$ (computability).

### 2) SECURITY ASSUMPTIONS

#### a: INTEGER FACTORIZATION

Integer factorization is the decomposition of a positive integer into a product of integers. When the integers are sufficiently large, no efficient (non-quantum) algorithm is known (but it might exist). Many cryptosystems are based on the difficulty of factoring large composite integers, such as RSA.

#### b: DISCRETE LOGARITHM AND VARIANTS

The Discrete Logarithm Problem (DLP) is based on the fact that finding the discrete logarithm of an element is too hard. Given a group $G$ and two elements $x, y \in G$, the discrete logarithm is an integer $a$ such that $y^a = x$. There exist groups for which computing the discrete logarithm $a$ from $x$ is difficult. The *partial* DLP problem builds on the DLP problem. Given a modulus $N = pq$ as a product of two primes $p$ and $q$, computing $a \mod n$ such that $y^a = x$ is difficult.

The Computational Diffie-Hellman (CDH) assumption extends the hardness problem of computing the discrete logarithm in cyclic groups. In particular, given a cyclic group $G$ of prime order $p$, and a generator $g$, it is hard to compute $g^{ab}$ from the tuple $(g, g^a, g^b)$ where $a$ and $b$ are in $\mathbb{Z}_p$. The Inverse
CDH assumption extends the CDH assumption as follows: given a cyclic group $\mathbb{G}$ of prime order $p$, and a generator $g$, it is hard to compute $g^{x-1}$ from the tuple $(g, g^x)$ where $x$ is in $\mathbb{Z}_p$. Another extension is the $q$-Strong Diffie-Hellman ($q$-SDH) assumption. Given two cyclic groups $\mathbb{G}_1$ and $\mathbb{G}_2$ of prime order $p$, and random generators $g_1 \in \mathbb{G}_1$ and $g_2 \in \mathbb{G}_2$, it is hard to compute a pair $(g_1^{1/(x+c)}, c)$ from the tuple $(g_1, g_2^x, g_2^{x^2}, \dots, g_2^{x^{q}})$ where $x$ is in $\mathbb{Z}_p$.

The Bilinear Diffie-Hellman (BDH) assumption extends the CDH assumption in pairing-based cryptography. Given a cyclic group $\mathbb{G}$ of prime order $p$ and a bilinear map $e: \mathbb{G} \times \mathbb{G} \to \mathbb{G}_T$, it is too difficult to compute $e(g, g)^{abc}$ from the tuple $(g, g^a, g^b, g^c)$ where $g$ is a generator of $\mathbb{G}$ and $a, b$ and $c$ are in $\mathbb{Z}_p$.

Another assumption that relies on discrete logarithms is the Lysyanskaya-Rivest-Sahai-Wolf (LRSW) assumption [51]. This assumption states that there exists a protocol that serves as a zero-knowledge proof of the equality of discrete logarithms. This enables an entity to prove knowledge of the discrete logarithm of a certain value. More formally, let $\mathbb{G}$ be a cyclic group of prime order $p$, with a generator $g$. For $(g, g^x, g^y)$ with $x$ and $y$ in $\mathbb{Z}_p$, let us define the oracle $O(m)$ on input $m \in \mathbb{Z}_p$ that chooses a random $h \in \mathbb{G}^*$ and outputs the tuple $(h, h^y, h^{x+mxy})$. Given $(g, g^x, g^y)$ and unlimited access to this oracle $O$, no adversary can efficiently generate such a tuple for a new scalar $m'$, not asked to $O$. The validity of a new tuple $(h, g^u, g^v)$ can be proven interactively in any group, or non-interactively checked with a bilinear map of the form $e: \mathbb{G} \times \mathbb{G} \to \mathbb{G}_T$ with $e(g^y, h) = e(g, g^u)$ and $e(g^x, h \cdot (g^u)^m) = e(g, g^v)$ [52].

### c: COLLISION RESISTANCE

Collision resistance means that it should be too difficult to find two different messages resulting in the same digest. More formally, $H$ is said to be collision resistant if finding two messages $m \neq m'$ such that $H(m) = H(m')$ is difficult.

### d: LATTICE-BASED PROBLEMS

The Shortest Vector Problem (SVP) is one of the most common lattice-based problems. Given the basis of a lattice, the goal is to compute the shortest non-zero vector in this basis. More formally, given the basis $\mathcal{B}$ of a lattice $\Delta$, finding a non-zero vector $\vec{v} \in \Delta(\mathcal{B})$ such that $||\vec{v}|| = \lambda(\Delta(\mathcal{B}))$ is hard, where $||\cdot||$ denotes the Euclidean norm and $\lambda(\Delta(\mathcal{B}))$ is the length of the shortest non-zero vector in the lattice basis $\Delta(\mathcal{B})$ [53].

Another lattice problem is the Small (or Short) Integer Solution (SIS). The goal is to find a short non-zero vector in a random $q$-ary lattice. Cryptographic functions based on $q$-ary lattices involve arithmetic modulo $q$.

Another common lattice problem is the Learning with Errors (LWE) problem. The goal is to find the multiplicative value for a lattice point after an error value has been added.

### 3) CRYPTOGRAPHIC PRIMITIVES AND SCHEMES

#### a: CRYPTOGRAPHIC PRIMITIVES

Identity-based (ID-based) cryptography uses an arbitrary identifying string as the public key, such as the domain name or physical IP address of the owner of the public key. Hence, signatures can be verified without the generation of a specific public key, resulting in certificates no longer being necessary for authentication. However, the major concern is the key escrow problem since a Key Generation Center (KGC) is responsible for generating the secret key associated with an ID-based public key. Therefore, strong assumptions must be made on the KGC. Many of the proposed O/O schemes have used the ID-based construction [7], [17], [30], [32], [34], [46], [49], [54], [55], [56], [57].

A variant of ID-based cryptography is based on attributes. Instead of having one unique identifier as in ID-based cryptography, several attributes are defined and attached to a key or signature. More specifically, a Key-Policy Attribute-Based (KP-AB) signature scheme [58] enables attaching access policies to signing keys and attribute sets to signatures, such that the latter are deemed valid if attributes used for signing satisfy the access policies. An O/O variant has been presented in [59].

Certificateless signature schemes are similar to ID-based schemes in that they both rely on a third-party KGC [60]. However, unlike ID-based schemes, certificateless schemes do not have the key escrow problem, as only a partial secret key is generated by the semi-trusted KGC. Consequently, a public key must be generated and shared, but without requiring a certificate to link it to the device's identity.

A threshold signature scheme allows a certain number of signers, greater than a threshold, to generate a valid signature together [61]. This type of signature scheme has become more popular with the blockchain trend since it increases the security of the whole distributed system by allocating multiple signing secret keys to participants instead of a unique one [62]. We have had a few O/O threshold signature schemes proposed in [39] and [40].

A multi-signature, like a threshold signature, is a single signature generated by multiple signers [63]. However, unlike threshold signature schemes, a multi-signature scheme identifies all signers and there is no threshold on the number of signers to compute the signature. The latter is verified by specifying the group of signers and the message that has been signed by all. This approach has been used for the O/O scheme in [30]. It has been found in the literature with other terminology to roughly define the same type of scheme, namely *multi-signer scheme with batch verification* [64]. Specifically, in such a scheme, simultaneous verification of multiple messages from different sources is enabled. An O/O multi-signer scheme with batch verification has been presented in [20].

A *multiple-time signature scheme* fixes the number of messages that can be signed. This type of scheme has been used as a baseline for the O/O scheme in [9] and [65].
b: CRYPTOGRAPHIC SCHEMES

RSA is a public key cryptosystem that uses modular multiplication. The modulus is computed as the product of two secret prime numbers. Its security relies on the Integer Factorization Problem (IFP). The RSA cryptosystem has been extended to a signature scheme, such that every message is first hashed before being signed. The O/O scheme in [18] is based on RSA.

The *Digital Signature Algorithm* (DSA) is a public-key cryptosystem for a DS scheme, originally based on modular exponentiations and the DLP. DSA is a variant of the ElGamal signature scheme. An extension is the Elliptic-Curve DSA (ECDSA) based on elliptic-curve cryptography [1]. *SM9* is an ID-based DS scheme, based on elliptic curves, that has been standardized for use in China and has been used for the O/O construction in [37].

NTRU, also known as NTRUEncrypt, is a lattice-based public key cryptosystem whose security relies on the SVP. The lattice-based signature scheme *Falcon* relies on a hash-and-sign technique over NTRU lattices. In particular, Falcon has shown a better performance than NTRUSign, the DS variant of NTRUEncrypt. An O/O variant of Falcon called *MITAKA*, has been proposed in [8]. Contrary to Falcon, MITAKA does not have any floating-point calculations, making it acceptable in resource-constrained networks such as IoT. Another yet more efficient O/O NTRU-based solution, called *Robin*, has been specifically proposed for resource-constrained devices [44]. Another lattice-based DS is *Dilithium*. This scheme has been standardized by NIST to provide PQ security [66].

The *Fiat-Shamir* heuristic is a technique that can be used to create a DS from a zero-knowledge interactive proof. This heuristic has been used to deploy O/O signature schemes [31], [35], [45].

IV. REVIEW BASED ON USE CASES

The original aim of the use of O/O signatures is to improve signature generation efficiency. Consequently, this type of signature scheme has mainly been suggested for contexts involving resource-constrained devices [18], [35], [45] and ad-hoc networks [17], [30]. A more recent use case is blockchain technologies [39], [40]. Signatures have been used to authenticate transactions, and their O/O variants allow for improvements in the latency of blockchain systems.

We review publications proposing O/O solutions applied to the aforementioned use cases. An overview of the selected papers can be found in Table 3. A glossary of the symbols used in Table 3 can be found in Table 2, and a glossary of the acronyms used throughout in Table 1.

We classify a device as constrained when the available amount of a resource (e.g., power, memory, or energy) limits its overall function. In this section, we will explore O/O signature schemes tailored for constrained devices, categorized by device type. Although there are subtle differences among the types presented below, the main goal

<table><caption>TABLE 1. Glossary of acronyms used throughout the survey.</caption><thead><tr><td>Acronym</td><td>Meaning</td></tr></thead><tbody><tr><td>BDH</td><td>Bilinear Diffie-Hellman</td></tr><tr><td>CDH</td><td>Computational Diffie-Hellman</td></tr><tr><td>q-SDH</td><td>q-Strong Diffie-Hellman</td></tr><tr><td>CMA</td><td>(Adaptive) Chosen Message Attack</td></tr><tr><td>DLP</td><td>Discrete Log Problem</td></tr><tr><td>ECDSA</td><td>Elliptic Curve Digital Signature Algorithm</td></tr><tr><td>EUF</td><td>Existentially UnForgeable</td></tr><tr><td>ROM</td><td>Random Oracle Model</td></tr><tr><td>SIS</td><td>Small Integer Solution</td></tr><tr><td>LWE</td><td>Learning With Errors</td></tr><tr><td>KP-AB</td><td>Key Policy-Attribute Based</td></tr><tr><td>KGC</td><td>Key Generation Center</td></tr><tr><td>IFP</td><td>Integer Factorization Problem</td></tr></tbody></table>

<table><caption>TABLE 2. Glossary of symbols used in Table 3.</caption><thead><tr><td>Symbol</td><td>Meaning</td></tr></thead><tbody><tr><td>○</td><td>EUF in the ROM</td></tr><tr><td>●</td><td>EUF</td></tr><tr><td>○</td><td>EUF-CMA in the ROM</td></tr><tr><td>●</td><td>EUF variant</td></tr><tr><td>●</td><td>EUF-CMA</td></tr><tr><td>Cell with <span style="border: 1px solid black; padding: 1px 3px; display: inline-block; background-color: #D8D8D8;">□</span></td><td>Post-Quantum Security</td></tr><tr><td>Cell with <span style="border: 1px solid black; padding: 1px 3px; display: inline-block; background-color: #D8D8D8;">□</span><br>1</td><td>Hash-Sign-Switch Technique<br>Broken Scheme</td></tr></tbody></table>

is to minimize the usage of constrained resources, and so to improve the practicality of running DS schemes on such devices. Types include IoT devices, wireless sensor networks (WSNs), mobile devices, and low-power devices.

A. CONSTRAINED DEVICES

1) GENERIC CONTEXTS

In [31], the authors outlined a signature scheme that can be used on resource-constrained devices. They provide the option to either use RSA or the discrete log over prime integer problem. They outline an O/O scheme that provides fast signing and implement it on a smart card. The scheme has been proven based on the DLP problem in the random oracle model. This scheme was standardized by ISO in 2008 [75] and improved in [32], such that the new scheme is slightly faster than the original one. Moreover, the security fits within the standard model.

A family of three O/O signature schemes suitable for devices with limited computing capabilities is proposed in [18]. Each scheme focuses on a specific improvement, either reducing the signature size, reducing the computational size, or eliminating the need to generate random primes for each signature. The authors use the RSA assumption to provide assurance of the security of each scheme. Additionally, they compare their schemes to an O/O scheme constructed using the method proposed in [22]. Notably, their schemes eliminate the need for a trapdoor hash, resulting in slightly smaller signatures and simpler key management.
<table><caption>TABLE 3. Reviewed papers grouped according to their use-case.</caption><thead><tr><th>Use Case</th><th>Paper</th><th>Cryptographic Baseline</th><th>Math Object</th><th>Security Assumption</th><th>Security Model</th></tr></thead><tbody><tr><td rowspan="10">Constrained Devices</td><td>[31]</td><td>Fiat-Shamir</td><td>Prime Numbers</td><td>DLP</td><td>●</td></tr><tr><td>[31]</td><td>Fiat-Shamir + RSA</td><td>Prime Numbers</td><td>Integer Factorization</td><td>●</td></tr><tr><td>[32]</td><td>RSA</td><td>Prime Numbers</td><td>Integer Factorization</td><td>●</td></tr><tr><td>[18]</td><td>RSA</td><td>Prime Numbers</td><td>Integer Factorization</td><td>●</td></tr><tr><td>[20]</td><td>Multi-signature</td><td>Bilinear Pairings</td><td>LRSW</td><td>●</td></tr><tr><td>[5]</td><td></td><td>Lattice</td><td>Inhomogenous SIS</td><td>●</td></tr><tr><td>[8]</td><td>Falcon</td><td>Lattice</td><td>SIS</td><td>●</td></tr><tr><td>[44]</td><td>NTRU</td><td>Lattice</td><td>SIS</td><td>●</td></tr><tr><td>[9]</td><td>[67]</td><td>Hash function</td><td>Collision Resistance</td><td>●</td></tr><tr><td></td><td></td><td>Exponentiation</td><td>CDH</td><td>●</td></tr><tr><td></td><td>[37]</td><td>Bilinear Pairings</td><td>q-SDH</td><td>●</td></tr><tr><td></td><td>[68]</td><td>Bilinear Pairings</td><td>q-SDH + Inverse CDH</td><td>●</td></tr><tr><td></td><td>[6]</td><td>Hyperl elliptic Curve</td><td>DLP</td><td>●</td></tr><tr><td></td><td>[19]<sup>1</sup></td><td>Exponentiation</td><td>DLP</td><td>●</td></tr><tr><td></td><td>[56]</td><td>Bilinear Pairings</td><td>BDH</td><td>●</td></tr><tr><td></td><td>[54]<sup>1</sup></td><td>Bilinear Pairings</td><td>BDH</td><td>●</td></tr><tr><td></td><td>[69]</td><td>Bilinear Pairings</td><td>CDH</td><td>●</td></tr><tr><td></td><td>[55]</td><td>Exponentiation</td><td>DLP</td><td>●</td></tr><tr><td></td><td>[57]</td><td>Primes</td><td>Partial DLP</td><td>●</td></tr><tr><td></td><td>[49]</td><td>Extended Chaotic Maps</td><td>DLP</td><td>●</td></tr><tr><td></td><td>[41]</td><td>Hyperl elliptic Curve</td><td>DLP</td><td>●</td></tr><tr><td></td><td>[70]</td><td>Bilinear Pairings</td><td>BDH</td><td>●</td></tr><tr><td></td><td></td><td>Hash Function</td><td>Collision Resistance</td><td>●</td></tr><tr><td></td><td>[7]</td><td>Hash Function</td><td>DLP + Collision Resistance</td><td>●</td></tr><tr><td></td><td>[59]</td><td>Lattice</td><td>LWE + SIS</td><td>●</td></tr><tr><td></td><td>[45]</td><td>Fiat-Shamir</td><td>DLP</td><td>●</td></tr><tr><td></td><td>[35]</td><td>Fiat-Shamir</td><td>Exponentiation</td><td>●</td></tr><tr><td rowspan="10">Ad-hoc Networks</td><td>[17]<sup>1</sup></td><td>ID-Based</td><td>Bilinear Pairings</td><td>CDH</td><td>●</td></tr><tr><td>[30]<sup>1</sup></td><td>ID-Based</td><td>Bilinear Pairings</td><td>CDH</td><td>●</td></tr><tr><td>[34]</td><td>ID-Based</td><td>Bilinear Pairings</td><td>CDH</td><td>●</td></tr><tr><td>[71]</td><td>ID-Based</td><td>Bilinear Pairings</td><td>CDH</td><td>●</td></tr><tr><td>[46]</td><td>ID-Based</td><td>Chaotic Map</td><td>DLP</td><td>●</td></tr><tr><td>[72]</td><td>Certificateless Signature</td><td>Elliptic Curve</td><td>DLP</td><td>●</td></tr><tr><td>[73]<sup>1</sup></td><td>Certificateless Signature</td><td>Elliptic Curve</td><td>DLP</td><td>●</td></tr><tr><td></td><td></td><td></td><td></td><td></td></tr><tr><td></td><td>[39]</td><td>Threshold Signature</td><td>Elliptic Curve</td><td>DLP</td><td>●</td></tr><tr><td></td><td>[40]</td><td>Threshold Signature</td><td>Elliptic Curve</td><td>DLP</td><td>●</td></tr><tr><td></td><td>[65]</td><td>Multi-signature</td><td>Lattice</td><td>SIS</td><td>●</td></tr><tr><td></td><td>[74]</td><td>Multi-signature</td><td>Lattice</td><td>SIS</td><td>●</td></tr><tr><td>Blockchains</td><td></td><td></td><td></td><td></td><td></td></tr></tbody></table>
While the online stage is comparable for both schemes, the offline stage is faster for the new O/O construction.

An O/O multi-signer batch verification scheme [20], based on bilinear pairings, employs the hash-sign-switch trick [22]. Doing so, the overall verification cost and computational overhead are reduced, in particular, compared to other similar schemes [76], [77], [78]. However, the final signature becomes larger.

The rest of the reviewed O/O signature schemes generally proposed for constrained devices use lattices. A lattice-based Programmable Hash Function (PHF), based on the idea presented in [79], is proposed in [5]. The PHF serves as a trapdoor hash function for the hash-sign-switch scheme proposed in [22]. The focus here is on reducing computation for constrained devices while maintaining the same signature and key size.

MITAKA [8] is an O/O variant of Falcon for constrained devices. By simplifying computation, MITAKA reduces the secret key size by 25% and signing time by 50%. However, its signature is approximately 10% larger than Falcon's (an increase of around 100 bytes). MITAKA also offers a variant that uses a sampler, eliminating the need for floating-point computation and providing side-channel attack protection.

The Robin signature scheme [44], built upon MITAKA, further reduces complexity and improves side-channel protection. Robin achieves this by minimizing the size and complexity of the secret key, relying on only a few integer operations during the online stage, and avoiding floating-point computation. However, the public key and signature are larger than Falcon by about 40% and MITAKA by around 30%.

## 2) INTERNET OF THINGS

One category of constrained devices that has been proposed to use the O/O signature construction is the Internet of Things (IoT). IoT can be seen as an expanding network of Internet-connected, yet constrained, devices in contexts such as cities, industries, and agriculture. IoT devices are designed to be mobile and omnipresent in their environment but are limited in terms of computation, communication, and storage. Hence, steps such as signing have a noticeable impact on the performance of the devices and thus of the network. O/O constructions help IoT devices shift the computationally heavy and energy-consuming signing processes to an offline stage, when no other computational tasks need to be carried out or when the device is being charged [2].

In the paper [67], a KP-AB O/O scheme for IoT is presented. The scheme is obtained from the hash-sign-switch transformation [22]. However, instead of a regular trapdoor hash as recommended in [22], the scheme uses the double trapdoor hash function from [80], to eliminate the possibility of the key exposure problem. The authors theoretically prove their scheme secure under the CDH problem and compare their scheme to other attribute-based schemes [81], [82], [83], [84]. Specifically, the computational timing for each step

is constant rather than linear or logarithmic, as well as the signature size. The authors also implement their solution such that the online stage is ten times faster than the offline stage.

In [37], the authors modified SM9, the Chinese standard ID-based signature scheme, to increase the speed of signing and improve the practicality of the scheme for use by IoT devices. The O/O shift adds one scalar multiplication during signature verification and increases the signature size by 50%. While the overall (i.e. offline and online) signing time increases, the online stage is 99% faster than for the non-O/O version. Compared to other O/O signatures [19], [54], [69], this O/O SM9 scheme requires less offline storage and has a signature size that is either the same or up to 80% smaller.

A certificateless O/O signature scheme, based on bilinear pairings, is proposed in [68] for use by medical IoT devices. The main goal is to reduce the computation overhead and energy usage through the O/O construction. Such a scheme is used for remote anonymous authentication of entities. Comparing their scheme with four other anonymous signature schemes [85], [86], [87], [88], online computation is reduced by approximately 25% in [68]. Additionally, the total energy usage is cut down by 13-40% compared to non-O/O schemes. However, this improvement in computation and energy usage does result in approximately doubling the communication overhead.

In [6], the authors proposed a certificateless O/O signature scheme specifically designed for use by IoT devices in the health sector. With the O/O construction, they address two main concerns: slow response times and intensive computation. Through using hyperelliptic curves, they reduce the signature size by 50% compared to ECDSA. The scheme reduces signing time by over 85% and verification time by over 90% compared to the O/O schemes proposed in [18], [70], [89]. Additionally, the communication cost is less than a third of what is seen for the other O/O schemes in [18], [70], and [89]. This scheme was found to be forgeable under adaptive chosen message attacks in [90].

The authors in [9] presented a PQ multiple-time signature scheme with O/O verification, which works differently than O/O signing as described so far. The verification of signatures is split into two stages, offline and online. The offline stage is carried out prior to when signatures are received and consists of deriving multiple one-time verification keys from a master public key. The online stage verifies the received signatures using the precomputed one-time verification keys. In [9], minimizing memory, processing, and communication overheads have been identified as the main concerns to address. In particular, online verification is about 10 times faster than for Dilithium and 17 times faster than for Falcon, which are the two standardized PQ signature algorithms. Moreover, the signature size is one-fifth that of the Falcon signature, reducing communication overheads. Memory usage is also reduced since the secret key size is one-tenth of Falcon's.
### 3) WIRELESS SENSOR NETWORKS

WSNs are networks of sensors deployed to monitor a specific area, forwarding all collected information to a central device. These networks are commonly used for environmental and industrial monitoring. Sensors within WSNs are often small and deployed for extended periods, relying on energy harvesting as their power source. Consequently, energy efficiency is a crucial consideration for WSNs. While WSNs are sometimes considered a subset of IoT, there are two key differences. First, WSNs exclusively consist of wireless sensors, while IoT can include a broader range of devices such as remotely controlled and connected devices. Second, IoT devices must be connected to the Internet in some way. WSNs do not necessarily require Internet connectivity for their sensors, although they often do.

Due to the resource constraints of the sensors, symmetric-key algorithms are often used to provide security. However, key management makes the authentication protocol too complex. Therefore, public-key cryptography is preferred and O/O signature constructions have been suggested to improve the efficiency of the authentication protocol in WSNs [19]. In the latter, an ID-based O/O scheme is presented to reduce the computation needed and improve the energy efficiency of the original ID-based DS scheme proposed in [30]. This scheme [19] allows for the reuse of offline computations, greatly improving the overall computational efficiency as it eliminates the need to recompute offline values for every signature. Moreover, the offline signature can be computed on another device before sensor deployment, as it is independent of any private information held by the signer. Comparing their scheme to other lightweight DS approaches [14], [91], the authors found that fewer computations were required for both signing and verification, while the signature size was increased by 50%. Note that the scheme in [19] was proven insecure in [54].

Another ID-based O/O signature scheme was proposed for WSNs in [56]. Specifically, it addresses cluster-based WSNs, which involve creating local hierarchies between sensors to reduce the required communication overhead and improve scalability. Instead of all sensors communicating directly with the base station, cluster heads gather information from other sensors and group it before passing it on to the base station. The focus is on reducing computation overhead and energy use through the use of the O/O construction. The study also found that the O/O construction improves energy efficiency by approximately 50% compared to the non-O/O version of their scheme. Additionally, energy efficiency only decreased by 10% compared to the currently used symmetric scheme.

An improved scheme based on the BDH problem was proposed in [54]. However, this scheme was also broken in [69]. Nevertheless, a possible solution to address the vulnerability is proposed. The scheme in [69] is based on the assumption of the CDH problem. They also propose an extension of their scheme to include aggregation. This allows a node to sign multiple messages simultaneously, resulting

in smaller signatures than if each message had been signed individually. It's important to note that one of the main trade-offs for O/O schemes is that they can lead to slightly larger signature sizes compared to non-O/O schemes.

Another scheme that uses the reuse of the offline signature is the ID-based O/O scheme for WSNs, presented in [55]. They focus on reducing computation and storage costs. When compared to previously proposed O/O schemes [22] and [30], their scheme demonstrates approximately 50% lower storage requirements during the offline stage.

Another O/O scheme, which re-utilizes the offline signature and outsources the offline computation, is proposed in [57]. This ID-based O/O scheme uses the partial DLP and aims to reduce the computation needed. Notably, key information for this scheme can be preregistered, eliminating the need for certificates or other initial forms of authentication. Some of this data can be hard-coded during the assembly or setup stage of the device, reducing the values that need to be computed and communicated to other sensors.

Lastly, an ID-based O/O scheme is proposed in [49] that also allows for preregistration of keys. The author's goal is to have a short signature with a lower computational cost than other previously proposed O/O schemes. Their scheme uses extended chaotic maps for the construction of the DS scheme. They compare their scheme against other similar signature schemes and find a 50% increase in signature size but exponentiation is no longer required for signing or verification, only modular multiplication. In general, it has been found that with the ability to reuse and possibly delegate the most expensive signing computations to another device the overall computation required on the sensor is greatly reduced.

An O/O scheme for use in Underwater WSNs (UWSNs) has been proposed in [41]. UWSNs are WSNs where all sensors that are part of the network are located underwater. In this context, all sensors are battery-operated, and charging them is a more complex process than for general WSNs. This certificateless scheme is based on hyperelliptic curves. The authors compare their scheme to what was proposed in [6], [59], [70], and [92]. Their proposed scheme reduces signing and verification time by nearly half compared to the fastest previously proposed scheme, and it also decreases communication overhead by at least 14% when compared to other O/O schemes.

### 4) MOBILE CONTEXTS

A mobile context involves devices that move between different networks. This mobility requires them to authenticate to new networks often. Therefore, authentication needs to be fast to complete. Moreover, the devices considered in this domain are usually battery-powered, hence, minimizing energy usage is another important consideration. Unlike IoT and WSNs, smartphones and laptops are considered in addition to resource-constrained devices.
The first mobile context considered for O/O signing is mobile health, that is smartphones and other mobile devices employed to assist health-related tasks. In [70], the authors outline a certificateless O/O scheme. They focus on reducing the energy and computation costs required to generate a signature. Notably, a reduction of one scalar multiplication is achieved during the online stage, compared to the O/O scheme proposed in [68]. Moreover, no pairing or exponentiation operations are executed. The scheme is claimed EUF-CMA secure in the ROM under the DLP assumption. However, this scheme was shown to be insecure in [93].

In [7], an O/O scheme is presented for the mobile Internet, referring to Internet-connected portable devices. The authors propose an ID and hash-based signature scheme that is EUF-CMA secure in the standard model, provided that the underlying hash function is collision-resistant. Specifically, the hash function is used to convert any existing ID-based signature construction into an O/O construction using the hash-sign-switch technique [22]. Doing so, a significant reduction (of approximately 66%) in the time taken during the online stage is seen, compared to a non-O/O version.

In [59], the authors outlined a KP-AB O/O signature scheme for mobile crowdsensing. The latter refers to the use of built-in sensors in many portable devices to gain information either about an individual or the environment the individual is in. The scheme employs the hash-sign-switch construction [22] and is secure based on the hardness of the DLP. While computations in the offline stage depend on the number of attributes, they do not in the online stage. Nevertheless, the authors only provide the theoretical version of their scheme and do not provide any evaluation or comparison.

## 5) LOW-POWER DEVICES

Other types of constrained devices may also include devices that prioritize energy efficiency. However, the main difference lies in the fact that low-power devices must always reduce energy consumption, even if it means accepting trade-offs in terms of memory or processing time. Additionally, low-power devices often remain dormant (inactive) when not needed and disable certain functionality to conserve energy.

In [45], the authors outlined a lattice-based O/O signature scheme, built from the Fiat-Shamir transform. They consider low-power devices (smart cards) with a short response time when signing a message to authenticate. Recomputing only half of the random string during the online stage, instead of the entire one, reduces the overall computational time. The size of the resulting signature is decreased. However, the amount of storage is increased to save values computed in the offline stage for use during the online stage. This scheme is EUF-CIA secure due to the interactivity from the Fiat-Shamir transform.

In [35], the authors outlined an O/O scheme that proposes a variant of the Fiat-Shamir transform to create a new signature. They identify the large storage requirements for the signer and the verifier, as well as the need to balance communication and computational overheads, as the main areas for improvement. In this scheme, the signer can send the precomputed offline value to the verifier before sending the signed message. This allows the verifier to also precompute some of the intermediate values needed for signature verification. They compare their scheme with Schnorr's signature [94] and find the offline storage is reduced by at least 33%. Additionally, they compare computational efficiency to DSA [1] and observe that the online stage remains the same, while the offline stage is reduced by one modular inversion. The scheme is secure following the EUF-CIA model.

## B. AD-HOC NETWORKS

Ad-hoc networks are decentralized wireless networks that do not require any previously installed infrastructure to build their network. Since there is no fixed network structure, network decisions are made dynamically, and the links between devices change frequently. Due to the dynamic nature of ad-hoc networks, new connections are made often and authenticating them can incur significant overhead. Devices in ad-hoc networks are usually not as resource-constrained as in some other use cases (e.g. IoT). Nevertheless, minimizing time delays and computational overhead remains a fundamental goal. O/O schemes have been proposed specifically for use in two ad-hoc network contexts, namely Mobile Ad-hoc Networks (MANETs) and Vehicular Ad-hoc Networks (VANETs).

### 1) MOBILE AD-HOC NETWORKS

MANETs are ad-hoc networks made up of mobile wirelessly connected devices. These networks often have devices that change position or move in and out of the network.

An ID-based O/O scheme for MANETs is proposed in [17]. This scheme aims to reduce computation overhead. The authors theoretically assess the computation and find that their scheme's online stage is quite efficient, requiring only one hash operation. However, this efficiency comes at the cost of increased computation required for verification.

The previous scheme was improved in [30]. The authors outline an O/O signature that can be used for two of the most common routing protocols for MANETs: AODV and DSR. The proposed O/O scheme is an ID-based DS scheme that can be either a single- (IOS) or multi- (IBMS) signature scheme. They carried out a theoretical comparison of IOS with other ID-based signature schemes [95], [96]. They halved the online signing cost by moving all elliptic curve scalar multiplication (ESM) to the offline stage. This results in a slight increase in signature size but the verification cost remains the same, as does the overall computation needed for the generation of the signature. They then compared IBMS
with other ID-based multi-signatures [96], [97]. Their scheme maintains the same signature size and verification cost. The precomputation is doubled, and only one ESM is required rather than *n* ESMs in the online stage. This results in an overall increase of one ESM. This scheme was broken in [98].

In [34], the authors outlined that a previously proposed ID-based O/O scheme for MANETs [17] was not actually secure. They then propose an improvement of the scheme that maintains the EUF-CMA security level. They don't carry analysis of the performance of the scheme and only focus on mathematically proving the security of their new scheme.

In another paper [71], an O/O ring signature scheme was presented. This scheme provides both EUF-CMA in the ROM and signer ambiguity. The authors claimed an overall decrease in computation required when theoretically compared to other similar DS schemes.

In [46], the authors outlined an ID-based O/O signature that uses extended chaotic maps and group rings. They have proposed MANETS as a possible use for this O/O signature scheme as a possibility to achieve strong but efficient authentication. They compare their proposed scheme first with other DS schemes that do not have an O/O construction. They find that their signature size is 30% larger than the non-O/O scheme but signature generation is 100 times faster. Compared to other O/O schemes the time taken is nearly doubled (52.5ms rather than 27.5ms) but the signature size is reduced by about 15%.

## 2) VEHICULAR AD-HOC NETWORKS

VANETs are ad-hoc networks made up of vehicles and roadside infrastructure. VANETs differ from MANETs as the vehicles are mobile but the roadside infrastructure is static. Vehicles in the VANET connect with the other vehicles and roadside infrastructure that are near them as they travel.

In [72], the authors proposed an efficient certificate-less aggregate signature scheme for VANET, based on hyperelliptic-curve cryptography. The scheme addresses the computational limitations of Onboard Units (OUs), which are devices responsible for data collection and transmission in vehicles, and minimizes signing delays. Their approach is over 90% faster than other VANET-oriented authentication schemes proposed in [99], [100], [101], and [102].

Another elliptic-curve based certificateless scheme is presented in [73]. Timings for signing are similar to the ones evaluated in [72]. However, the scheme has been broken in [103].

## C. BLOCKCHAIN TECHNOLOGIES

A blockchain is a distributed ledger that securely links blocks together using cryptographic hash functions. The term was popularized with the cryptocurrency Bitcoin [104]. Blockchains have since been used for transactions of cryptocurrencies, such as Ethereum [105] and Tether [106].

Cryptocurrency transactions over a blockchain are authenticated using DS schemes, such as ECDSA in Bitcoin [104]. To launch a transaction between two users of the blockchain network, the transaction must be signed. The signature is verified by miners, which are network nodes maintaining the blockchain (the process is called mining since it releases new coins into circulation). Once the verification is completed, the transaction is finalized and the coins are successfully transferred to the recipient.

The threshold variant of ECDSA has been suggested for Bitcoin to enhance the security of transactions, as it eliminates any single point of failure with signing keys [107]. Subsequently, a 2-threshold O/O scheme based on ECDSA is proposed in [39] with a possible application in blockchains. The authors aim to optimize the online stage to reduce the amount of computations. They identify the main issue of threshold ECDSA as the complexity of the necessary computation, irrespective of which context the algorithm is deployed in. Note that the offline stage is less of a focus, as it can be run several times and in batches during idle CPU time. The authors implement their scheme over the elliptic curve used by Bitcoin and compare it with other two-party ECDSA schemes [108], [109], [110], [111], [112], [113], [114], [115], [116]. The online computation and communication overhead was reduced by a factor of 10 on average compared to those other schemes. In addition, the online computation decreases by around 1,000 times compared to [110] and [115]. This scheme is suggested for use in blockchain but has not been tested in that context.

Another O/O threshold ECDSA scheme was proposed in [40]. The authors stated that the most common use of this type of DS scheme is for cryptocurrencies to distribute trust across multiple signers while facilitating signature generation with precomputations. They achieved a reduction in the communication and computation overhead in the online stage by a tenth compared to [108].

A lattice-based O/O synchronized multi-signature scheme is suggested in [65], specifically designed for cryptocurrencies, particularly Ethereum. The bottleneck of the original synchronized multi-signature scheme [117] is the signature generation cost, which has been mitigated in [65] through the O/O construction. Using a multi-signature scheme, rather than a threshold signature scheme, makes signers identifiable, ensuring that a miner (responsible for verifying transaction signatures) can only vouch for one block (containing several transactions) at a time. Key generation is the most expensive step as multiple one-time signature keys need to be generated. The number of verified signatures is bounded by a pre-determined element denoted as $\tau$. For a large value of $\tau$, key generation is estimated to take over two hours. This could lead to significant time and computation overhead, even if key generation is carried out rarely. The online signature generation is completed in a constant time. Additionally, PQ security is guaranteed from the SIS lattice problem. This scheme is further extended in [74], where the security assumptions have been strengthened and efficiency
improved. Compared to [65], the signing time is reduced by 75%, the key generation time by 90%, and the aggregated signature size by a factor of 5.

## V. TAKEAWAYS

We grouped the 36 papers presented in this survey according to the underlying use case. We have found that underpinning all proposed O/O schemes is the original goal as stated in [4]: improving the efficiency of the signature generation, particularly as the complexity of DS schemes increases. We begin by discussing the general trends identified in the reviewed papers. We focus on common mathematical objects, security assumptions and considerations, cryptographic techniques, and use cases. We continue by addressing the improvements, such as reduced computations and time, and drawbacks, such as additional storage overhead, observed in these papers.

### A. TRENDS

#### 1) IMPLEMENTATIONS

We observe that most of the reviewed papers remain theoretical and only a brief mention is made of the proposed context. Specifically, those schemes are only assessed for their suitability and the achievement of their goals from a theoretical perspective. We only found 7 O/O schemes having been implemented: 3 in Rust [39], [65], [74], 1 in C [8], and 3 that provide experimental results but do not give access to their code [31], [41], [67]. Note that most of the papers with scheme implementations were published in the last four years. The recent trend of including implementation and experimental evaluation is a great sign, indicating more informed assessments of the proposed schemes. Consequently, further work on implementing and testing O/O DS solutions must take place to more confidently assert the improvements achieved.

#### 2) MATH OBJECTS

The 3 main mathematical objects observed in the reviewed schemes are bilinear pairings, lattices, and elliptic curves. Bilinear pairings are used by 11 schemes [17], [20], [30], [34], [37], [54], [56], [68], [69], [70], [71]. Pairings are considered a versatile math object for DS schemes and are often used in combination with the ID-based framework. Six schemes use lattices as their main mathematical object [5], [8], [44], [45], [65], [74]. The lattice-based design choice is linked to the growing popularity of PQ cryptography, as lattices are considered the most promising PQ option, particularly in more resource-constrained contexts. Elliptic curves are used by 6 schemes [6], [39], [40], [41], [72], [73]. The standardized ECDSA is a relatively lightweight scheme, hence has been suggested for resource-constrained environments. O/O DS schemes are expected to extend ECDSA to even further improve its efficiency.

Slightly less common objects include prime numbers [18], [31], [32], [57] and exponentiations [19], [35], [55], [67], each appearing in 4 schemes. Hash functions [7], [9], [59]

and chaotic maps [46], [49] are used even less frequently, appearing in 3 and 2 schemes, respectively.

#### 3) SECURITY ASSUMPTIONS

The primary goal of O/O designers is to achieve a similar security level as the underlying original DS scheme.

The main security assumption used in the reviewed schemes is the DLP and its variants, which appear in 27 papers. Fourteen schemes use the DLP [6], [19], [31], [32], [35], [39], [40], [41], [46], [49], [55], [57], [59], [72], [73], 7 schemes use the CDH assumption [17], [30], [34], [67], [68], [69], [71], 3 schemes use the BDH assumption [54], [56], [70], 2 schemes use the q-SDH assumption [37], [68], and 1 scheme uses the LRSW assumption [20]. This is linked to the prevalent use of elliptic curves and bilinear pairings in O/O schemes.

Among the reviewed schemes, 6 use lattice-based problems. The SIS problem is used in 5 schemes [8], [44], [45], [65], [74], while the inhomogeneous SIS problem [5] and the LWE problem [45] are each mentioned only once. These schemes achieve PQ security, highlighting the growing popularity of O/O schemes in the context of PQ cryptography.

Other security assumptions, such as integer factorization (linked to RSA) and collision resistance (linked to hash functions) are less common. Integer factorization is used in 3 schemes [18], [31], [32], as is collision resistance [7], [9], [59].

#### 4) SECURITY CONSIDERATIONS

The O/O construction introduces additional security considerations, related to the (non-)usage of the secret key during the final signing step and to the offline signature being kept private, to ensure the overall security of the O/O DS scheme.

Most schemes have a secret key composed of at least two elements. At least one element of the secret key is used during the online and offline stages of signature generation, respectively. In the original scheme [4], the secret key is used in the offline stage, while the (secret) one-time signing key is used during the online stage. In the hash-sign-switch scheme [22], the secret key of the signature is used in the offline stage, and the (secret) trapdoor key of the hash is used in the online stage. Although the offline signature may be disclosed/become publicly known, the security of the O/O DS scheme must remain intact.

Some O/O schemes do not require secret key information in the offline stage [49], [54], [55], [57]. This allows for the reuse of the offline signature, as seen in [49], [55], and [57], or for outsourcing offline computation to another entity, as proposed in [54]. In ID-based schemes, the KGC may be a natural candidate for performing offline signing. The scheme in [19] also proposed offline signature reuse, but it was shown to be insecure in [54].

Other O/O schemes have been proposed in which the secret key information is used only during the offline stage [41], [45]. In this case, the offline signature must remain private. If it becomes public, an adversary could forge
a valid signature for a chosen message using the offline signature. This is particularly concerning in [41], where offline computation is outsourced to the KGC. Note that the KGC must be assumed to be trusted in ID-based schemes.

An important security risk in O/O schemes compared to traditional DS schemes is whether the offline signature may disclose sensitive information about the underlying secret key or may be used to forge a final signature. As a consequence, depending on the underlying security model, an offline signature might be kept private and become public. We suggest that O/O schemes should be designed in such a way that even if the offline signatures become known, no valuable information can be gleaned from them.

## 5) CRYPTOGRAPHIC TECHNIQUES

The most common cryptographic technique is the ID-based framework, used by 14 schemes [7], [17], [19], [30], [34], [37], [46], [49], [54], [55], [56], [57], [69], [71], with 2 other schemes using the attribute-based variant [59], [67]. ID-based schemes use device-identifying information as a public key, eliminating the need for digital certificates to link device identifiers to public keys, and thus reducing authentication overhead, in resource-constrained environments such as IoT. Additionally, secret key generation is outsourced to the KGC, reducing the computation required on the device. As a result, combining ID-based and O/O constructions can achieve lower device computation and communication overhead.

Not surprisingly, the next most common cryptographic technique is certificateless signature schemes, found in 6 papers [6], [41], [68], [70], [72], [73]. Certificateless DS schemes can be seen as an extension of ID-based DS schemes, with additional key generation steps to avoid the key escrow problem. Other cryptographic primitives include multi-signatures [20], [65], [74] and threshold signatures [39], [40].

Four schemes use the Fiat-Shamir heuristic [31], [35], [45]. Few papers chose to develop their O/O DS solution based on existing cryptographic schemes, such as RSA [18], [31], [32], Falcon [8], and NTRU [44].

## 6) POST-QUANTUM SECURITY

We choose to discuss more specifically on PQ security since we have found that research on developing O/O DS schemes has moved towards preparing a quantum-resistant future. We have seen a growth in publishing papers proposing PQ O/O DS schemes. We identified that, of the 14 papers published after 2020, nearly half (6 papers) were for this type of scheme. Note that PQ DS schemes being standardized are more computationally intensive than those in use today. Consequently, moving towards an O/O design is a natural shift to enable PQ security in specific contexts such as resource-constrained environments.

## 7) USE CASES

One of the most common use cases is for the general context of resource-constrained devices, which appeared in 8 papers [5], [8], [9], [18], [20], [31], [32], [44]. The

proposed schemes aim to improve the efficiency of the signing process conducted by devices, by considering their limitations. In particular, the most common improvement, mentioned in 6 papers, is a decrease in computation on the device side, while the most common drawback, mentioned in 4 papers, is an increase in parameter size. The other most common use case is WSNs, also appearing in 8 papers [19], [41], [49], [54], [55], [56], [57], [69]. Here, the most common improvement, mentioned in 3 papers, is a lower computation overhead. Note that a major factor in WSNs is the need to reduce energy consumption to increase the longevity of the sensors. There is no drawback clearly standing out.

The next most common use case is MANETs, appearing in 5 papers [17], [30], [34], [46], [71]. Similarly to the two aforementioned use cases, the improvement mostly cited (3 papers) is a decrease in computation. Note that MANETs involve communication channels among devices dynamically and frequently changing. Consequently, a major aspect of this use case is to minimize the computation required to connect with and to authenticate to other nodes.

IoT came out in 4 papers [6], [37], [67], [68]. The most common improvement, mentioned in 3 papers, is a decrease in time, which is tightly linked to the computation overhead. Similarly to more generic resource-constrained environments, the drawback mostly cited (2 papers) is an increase in parameter size.

In general, each use case, including blockchain technologies [39], [40], [65], [107], is characterized by the fact that participating entities face limitations either in computational capability or in the time required for signing.

## B. IMPROVEMENTS

Reviewed papers focused on 7 areas of noticeable improvement in O/O DS schemes compared to original DS schemes. Those metrics, that overlap, are the following: computation cost, running time, energy consumption, communication overhead, parameter size, memory usage, and storage cost. We outline them in Table 4, along with their frequency among the 36 selected papers. Note that more than one area might have been cited in the reviewed papers. Moreover, the underlying use case may influence which metrics for improvement are focused on.

We choose to create two categories from those metrics: (i) *Computation* which includes the computation cost, running time, and energy consumption; (ii) *Communication and Storage* which encompasses the communication overhead, parameter size, memory usage, and storage cost. Percentages of the different kinds of improvement in each category are outlined in Figure 2.

### 1) COMPUTATION

Computation-related metrics are the most frequent area for improvement, representing nearly two-thirds of all improvement areas. Such an observation is clearly linked to the O/O design.
<table><caption>**TABLE 4.** Areas and metrics for improvements and their frequency of appearance.</caption><thead><tr><td>Area</td><td>Frequency</td></tr></thead><tbody><tr><td>Computation Cost</td><td>19</td></tr><tr><td>Running Time</td><td>10</td></tr><tr><td>Energy Consumption</td><td>5</td></tr><tr><td>Communication Overhead</td><td>7</td></tr><tr><td>Parameter Size</td><td>9</td></tr><tr><td>Memory Usage</td><td>1</td></tr><tr><td>Storage Cost</td><td>3</td></tr></tbody></table>

<table><caption>**TABLE 5.** Areas and metrics for drawbacks and their frequency of appearance.</caption><thead><tr><td>Area</td><td>Frequency</td></tr></thead><tbody><tr><td>Signature Size</td><td>9</td></tr><tr><td>Public Key Size</td><td>1</td></tr><tr><td>Communication Overhead</td><td>1</td></tr><tr><td>Storage Cost</td><td>1</td></tr><tr><td>Overall Signing Time</td><td>1</td></tr><tr><td>Verification Cost</td><td>1</td></tr></tbody></table>

<figure><img src="image_4.png" /><figcaption>**FIGURE 2.** Improvement percentages in both proposed categories.</figcaption></figure>

The computation cost is the most straightforward improvement metric. Nineteen papers [5], [9], [17], [18], [19], [20], [30], [35], [39], [40], [44], [49], [55], [56], [57], [65], [68], [70], [71] identify a decrease in computation cost in the online stage. By nature of dividing the signature generation into two stages, any effectively designed O/O DS scheme should result in a notable decrease in the online computation of the signature.

Nevertheless, a decrease in computation cost during the online stage may usually be achieved by slightly increasing the overall computation necessary to generate signatures, which would be noticed during the offline stage. Note that allowing the reuse of the precomputation for several signatures enables the decrease of the overall computation cost, compared to a traditional DS scheme. This improvement type was also referred to as “computation size” and “complexity”.

The second most common improvement metric, mentioned in 11 papers [6], [7], [8], [31], [37], [41], [45], [46], [67], [72], [74], is the running time. This is due to the reduced computation overhead during the online stage, once the to-be-signed message is known. Energy consumption has been

discussed as an improvement area in 5 different papers [9], [19], [56], [68], [70]. Energy is typically interconnected with computation and time. Reduced computation cost leads to faster task completion, and thus to lower energy consumption.

Latency has not been evoked, and thus not even tested, in the papers we reviewed. We suppose that latency constraints do not tend to substantially impact the deployment of an O/O scheme in restrictive environments such as WSNs and IoT. Note that in the latter, there is an equal number of signing and verification steps, meaning that the decreased signing time usually offsets any increase in verification time. However, in the case of blockchain technologies, the greater number of verifications compared to signature generations could impact the underlying protocol and its latency.

## 2) COMMUNICATION AND STORAGE

This group of improving metrics makes up just over one-third of the overall discussed improvement areas. Parameter size [6], [8], [9], [18], [44], [45], [49], [67], [74] and communication overhead [6], [9], [35], [39], [40], [41], [56] were discussed in 9 papers and 7 papers, respectively. These values are often interrelated as decreased parameter sizes usually result in smaller signatures, and thus reduce the amount of data to be transmitted. These improvements are of note as there is no clear link between using the specific O/O construction and any improvements in communication cost or parameter size. Note that papers focusing on improving communication overhead chose DS schemes with the same focus as a baseline. Nevertheless, most of the O/O DS schemes targeting reduced communication costs are computationally expensive.

Storage and memory requirements were discussed in 3 papers [35], [37], [55] and 1 paper [9], respectively. These types of improvements are typically related to parameter sizes. When the size of parameters decreases, the space required to store them is also reduced, and hence, the space in memory needed to carry out computations with these parameters is similarly reduced. Note that one would expect both memory and storage requirements to increase due to the nature of the precomputation that takes place with the O/O construction.

## C. DRAWBACKS

As we saw in the previous section, the reviewed schemes were proposed to noticeably improve specific metrics and areas, such as computation cost and communication overhead. However, such a practice has impacts on other areas. We identified six of them, these are signature size, public key size, communication overhead, overall signing time (comprising both offline and online stages), storage cost, and verification cost. These are outlined in Table 5. Note that only 14 out of 36 papers mention drawbacks, even though they are inevitable in most cases.
## 1) COMPUTATION

Computation-related metrics were only mentioned in less than 20% of all reviewed papers. However, this could likely be a concern for more of them.

Longer running times for overall signature generation, which were only cited once in the literature [37], is a consideration that many papers overlooked. Restructuring the total signature computation is needed to optimize the online stage, resulting in an additional cost during the offline stage. While this additional cost is often treated as negligible since it occurs during the precomputation process, it is still conducted by resource-constrained devices.

Finally, design impacts on the verification process were only discussed in one paper [17]. This has a slightly less apparent link to the O/O construction. From the aforementioned drawbacks, it seems natural that verification costs rise. In particular, if an O/O DS scheme has been developed from the original O/O scheme [4], then verification happens twice, once for the original signature and once for the one-time signature. This drawback probably affects more O/O DS schemes than indicated.

Thus, our literature review reveals that the above-listed drawbacks were not consistently mentioned or discussed in detail. Further observations and discussions of these drawbacks would provide a more balanced perspective on the effectiveness of the proposed O/O DS schemes.

## 2) COMMUNICATION AND STORAGE

Communication and storage aspects were the most frequently mentioned drawbacks, representing 86% of all papers.

The most common drawback highlighted by the use of the O/O construction was an increase in signature size, which was mentioned in 9 different papers [8], [19], [20], [30], [37], [44], [46], [49], [69]. Splitting the signature generation into two stages results in computing and exchanging more information. For instance, schemes that use the original construction [4] require a second, one-time signature in addition to the original signature. Other schemes based on the hash-sign-switch technique [22] need an extra random variable embedded into the signature.

Larger public key sizes were explicitly pointed out in [44], but were observed in many O/O DS solutions. In particular, schemes relying on the original scheme [4] add a one-time verification key to the static public key. Moreover, schemes based on the hash-sign-switch paradigm [22] add the trapdoor hash key to the public key.

A larger communication overhead was only mentioned in [68]. Note that communication overhead is highly inter-related with the previous two drawbacks, namely, larger sizes of signature and public key. Those two elements imply an increase in the total amount of transmitted information.

Similarly, larger storage requirements were only mentioned in one paper [45]. However, extra storage space is likely to be required for precomputed values. For instance, depending on the underlying framework [4], [22], additional

offline signatures must be stored until the to-be-signed messages are known.

## D. CONSIDERATIONS

In this subsection, we discuss the existing limits in adopting O/O schemes in resource-constrained and latency-sensitive contexts and possible mitigating options.

Design choices have a substantial impact on the overall performance of the O/O scheme. In particular, O/O schemes using the hash-sign-switch paradigm and extending existing DS schemes, instead of relying on one-time signature frameworks, manage to smooth the inevitable additional overhead in terms of computation, communication, and storage. Hence, we support the former techniques for future O/O schemes.

Some papers properly discuss the trade-off between reduced time/computation and increased storage/parameter size, which is essential to promote the adoption of an O/O design for message integrity and authentication in resource-constrained environments. Moreover, O/O schemes remain practical in most contexts since the extra storage overhead is manageable by current resource-constrained devices.

Through our survey, we noticed that the proposed O/O schemes have not been widely implemented, and that experimental results have been lacking. This practice makes it difficult to establish confidence in adopting the O/O design in the reviewed use cases. Furthermore, only 4 papers made their source code publicly available, which is essential for validating experiments and checking the reproducibility of results. Not publishing codes presents a significant barrier for the wide adoption of the O/O design.

Finally, the widespread adoption of O/O schemes may also be limited by the insufficient awareness of these schemes as a viable option in resource-constrained and latency-sensitive contexts. We aimed to address this lack of awareness through this survey.

## VI. RELATED STUDIES

To the best of our knowledge, there are no surveys on O/O DS schemes. Therefore, we give a review of survey papers that discuss more broadly lightweight DS schemes, where “lightweight” describes schemes that are feasible to run on constrained devices. Indeed, one can suggest O/O schemes for use in specific scenarios that require lightweight operations for signature generation and verification.

In [118], Elliptic Curve (EC) based schemes are reviewed. In particular, the survey discusses the applicability of EC-based schemes in resource-constrained schemes such as IoT and WSNs. It also addresses questions around classifying EC-based schemes as lightweight, and notes that PQ security is not achieved. However, the use of the O/O design is not mentioned in this survey paper.

In [119], the authors review lightweight cryptosystems deployed in IoT environments. The survey indicates that the majority of lightweight systems use symmetric cryptography and the few public-key cryptosystems reviewed rely on
elliptic-curve cryptography. Notably, the survey does not
cover any PQ constructions.

In another survey [3], the authors explore lightweight
schemes for WSNs and highlight the O/O scheme proposed
in [56] as a potential DS scheme for WSNs. Specifically,
they review existing cryptographic protocols for WSNs with
a focus on security considerations such as confidentiality,
integrity, authenticity, availability, and data freshness. Conse-
quently, their survey has a broader security focus compared to
ours, which exclusively surveys integrity and authentication.

Although this survey was published in 2015, it did not
encompass all O/O schemes for WSNs available at that time,
such as those in [19] and [54], which we have included in our
review. Due to the wider range of schemes reviewed in our
paper, we were able to identify more trends, improvements,
and drawbacks, in particular for WSNs.

One survey that specifically discusses O/O constructions
is [2]. The authors review proposed mechanisms for achiev-
ing energy-efficient security for IoT devices, identifying O/O
design as one of the methods to achieve this goal. This
review covers various aspects of security needed for IoT,
including confidentiality and authentication. Consequently,
encryption schemes are included in this survey. However, the
survey's focus is relatively narrow, concentrating solely on
energy efficiency in IoT. As a result, it does not provide a
comprehensive review of O/O solutions in contexts other than
IoT, nor does it mention PQ security.

We found that the aforementioned papers only review a
minimal number of schemes, not necessarily O/O related, and
in very few contexts. As a result, they fail to identify and
examine broader trends and considerations associated with
this design.

VII. CONCLUSION

Digital Signature (DS) schemes are cryptographic tools
designed to ensure two critical aspects of secure communi-
cation: integrity, ensuring that data remains unaltered during
transmission, and authentication, verifying that communi-
cating entities are genuine. The O/O construction divides
the signing process into two distinct stages. In the offline
stage, most computationally intensive tasks are performed
in advance, even before the message to be signed is known.
In the subsequent online stage, once the message becomes
available, the precomputed data is used to expedite the final
signing process.

This survey reviewed 36 O/O DS schemes, with a focus on
analyzing their common trends, challenges, and applications.
The schemes were categorized by their intended use cases,
which predominantly involve resource-limited environments
such as IoT, WSNs, and low-power or mobile systems.
Another key application area is blockchain technologies,
where minimizing latency is a primary concern.

Our analysis revealed that the O/O construction can
effectively address issues related to expensive computations,
prolonged delays, and high energy consumption in DS
schemes, provided that the increased storage demands for

precomputed offline signatures are manageable. While the
final signing process sees significant improvement, the
practicality of implementing the O/O construction heavily
depends on the availability of sufficient storage for offline
signatures. Based on our study, we find that an O/O design
can be an effective way to improve the practicality of
DS schemes, especially in resource-constrained or latency-
dependent environments. Further consideration of use-case
specific factors is important to identify contexts where the
O/O construct is most suitable. This is especially true when
the focus is on reducing computation and time for signature
generation, as long as storage capacity is not a limitation.

As the cryptography landscape evolves, further research
into the practical implementation and testing of O/O DS
schemes will be essential. More experiments will improve
our understanding of their potential and limitations. Such
efforts will not only advance our knowledge but also allow
for more informed decisions in the development of future
DS schemes. This, in turn, will promote the wider adoption
of the O/O construction in resource-constrained and latency-
sensitive environments.

With the advent of quantum computing, PQ DS schemes
will be adopted to achieve the necessary security. Currently,
there are only a few PQ O/O schemes, and even fewer
have been implemented and tested. As PQ cryptography
comes with increased overhead (in terms of computation,
communication, and/or storage), the O/O construction will
become even more relevant for use by previously mentioned
resource-limited and latency-sensitive environments.

REFERENCES

[1] Digital Signature Standard (DSS), Federal Inf. Process. Standards Publications (FIPS PUBS) 186-5, U.S. Department of Commerce, Washington, DC, USA, 2023.

[2] H. Hellaoui, M. Koudil, and A. Bouabdallah, "Energy-efficient mechanisms in security of the Internet of Things: A survey," *Comput. Netw.*, vol. 127, pp. 173-189, Nov. 2017.

[3] S. T. Patel and N. H. Mistry, "A survey: Lightweight cryptography in WSN," in *Proc. Int. Conf. Commun. Netw. (ICCN)*, Nov. 2015, pp. 11-15.

[4] S. Even, O. Goldreich, and S. Micali, "On-line/off-line digital schemes," in *Proc. 9th Ann. Int. Cryptol. Conf. Adv. Cryptol.*, vol. 435, 1989, pp. 263-275.

[5] M. Zheng, S.-J. Yang, W. Wu, J. Shao, and X. Huang, "A new design of online/offline signatures based on lattice," in *Proc. 14th Int. Conf. Inf. Secur. Pract. Exper.*, 2018, pp. 198-212.

[6] M. A. Khan, S. U. Rehman, M. I. Uddin, S. Nisar, F. Noor, A. Alzahrani, and I. Ullah, "An online-offline certificateless signature scheme for Internet of Health Things," *J. Healthcare Eng.*, vol. 2020, no. 1, Dec. 2020, Art. no. 6654063.

[7] Z. Xie, Q. Shen, C. Li, J. Dong, and Y. Fang, "Identity-based chameleon hash without random oracles and application in the mobile internet," in *Proc. IEEE Int. Conf. Commun. (ICC)*, Jun. 2021, pp. 1-6.

[8] T. Espitau, P.-A. Fouque, F. Gérard, M. Rossi, A. Takahashi, M. Tibouchi, A. Wallet, and Y. Yu, "MITAKA: A simpler, parallelizable, maskable variant of FALCON," in *Proc. Annu. Int. Conf. Theory Appl. Cryptograph. Techn.*, 2022, pp. 222-253.

[9] A. A. Yavuz, S. Darzi, and S. E. Nouma, "LiteQSign: Lightweight and quantum-safe signatures for heterogeneous IoT applications," 2023, arXiv:2311.18674.

[10] F. Zhang, Y. Mu, and W. Susilo, "Reducing security overhead for mobile networks," in *Proc. 19th Int. Conf. Adv. Inf. Netw. Appl. (AINA)*, vol. 1, Mar. 2005, pp. 398-403.
[11] X. Ding, D. Mozzacchi, and G. Tsudik, "Experimenting with server-aided signatures," in Proc. Netw. Distrib. Syst. Secur. Symp., 2002, pp. 1-16.

[12] J. Mache, C.-Y. Wan, and M. Yarvis, "Exploiting heterogeneity for sensor network security," in Proc. 5th Annu. IEEE Commun. Soc. Conf. Sensor, Mesh Ad Hoc Commun. Netw., Jun. 2008, pp. 591-593.

[13] N. Gura, A. Patel, A. Wander, H. Eberle, and S. C. Shantz, "Comparing elliptic curve cryptography and RSA on 8-bit CPUs," in Proc. 6th Int. Workshop Cryptograph. Hardw. Embedded Syst. Berlin, Germany: Springer, 2004, pp. 119-132.

[14] A. S. Wander, N. Gura, H. Eberle, V. Gupta, and S. C. Shantz, "Energy analysis of public-key cryptography for wireless sensor networks," in Proc. 3rd IEEE Int. Conf. Pervasive Comput. Commun., Mar. 2005, pp. 324-328.

[15] X. Li, M. R. Lyu, and J. Liu, "A trust model based routing protocol for secure ad hoc networks," in Proc. IEEE Aerosp. Conf., vol. 2, Mar. 2004, pp. 1286-1295.

[16] S. Hohenberger and A. Lysyanskaya, "How to securely outsource cryptographic computations," in Proc. Theory Cryptogr. Conf. Berlin, Germany: Springer, 2005, pp. 264-282.

[17] S. Xu, Y. Mu, and W. Susilo, "Efficient authentication scheme for routing in mobile ad hoc networks," in Proc. Int. Conf. Embedded Ubiquitous Comp. Workshops, Jan. 2005, pp. 854-863.

[18] P. Yu and S. R. Tate, "Online/offline signature schemes for devices with limited computing capabilities," in Proc. Topics Cryptol. Berlin, Germany: Springer, 2008, pp. 301-317.

[19] J. K. Liu, J. Baek, J. Zhou, Y. Yang, and J. W. Wong, "Efficient online/offline identity-based signature for wireless sensor network," Int. J. Inf. Secur., vol. 9, no. 4, pp. 287-296, Aug. 2010.

[20] Z. Chen, Y. Zhang, L. Xu, and F. Guo, "Efficient batch verification of online/offline short signature for a multi-signer setting," Wuhan Univ. J. Natural Sci., vol. 16, no. 6, pp. 481-486, Dec. 2011.

[21] S. Even, O. Goldreich, and S. Micali, "On-line/off-line digital signatures," J. Cryptol., vol. 9, no. 1, pp. 35-67, 1996.

[22] A. Shamir and Y. Tauman, "Improved online/offline signature schemes," in Proc. 21st Ann. Int. Cryptol. Conf. Adv. Cryptol., vol. 2139, 2001, pp. 355-367.

[23] K. Kurosawa and K. Schmidt-Samoa, "New online/offline signature schemes without random oracles," in Proc. 9th Int. Conf. Theory Pract. Public-Key Cryptogr. Springer, 2006, pp. 330-346.

[24] P. Yu and S. R. Tate, "An online/offline signature scheme based on the strong rsa assumption," in Proc. 21st Int. Conf. Adv. Inf. Netw. Appl. Workshops (AINAW), vol. 1, May 2007, pp. 601-606.

[25] C. Crutchfield, D. Molnar, D. Turner, and D. Wagner, "Generic online/off-line threshold signatures," in Proc. Int. Workshop Public Key Cryptogr. Berlin, Germany: Springer, 2006, pp. 58-74.

[26] E. Bresson, D. Catalano, and R. Gennaro, "Improved on-line/off-line threshold signatures," in Proc. Int. Workshop Public Key Cryptogr. Berlin, Germany: Springer, 2007, pp. 217-232.

[27] D. Catalano, M. Di Raimondo, D. Fiore, and R. Gennaro, "Off-line/online signatures: Theoretical aspects and experimental results," in Proc. 11th Int. Workshop Pract. Theory Public-Key Cryptogr. Berlin, Germany: Springer, 2008, pp. 101-120.

[28] C.-Z. Gao, B. Wei, D. Xie, and C. Tang, "Divisible on-line/off-line signatures," in Proc. Topics Cryptol. Berlin, Germany: Springer, 2009, pp. 148-163.

[29] M. H. Au, W. Susilo, and Y. Mu, "Is the notion of divisible on-line/off-line signatures stronger than on-line/off-line signatures?" in Proc. 3rd Int. Conf. Provable Secur. Berlin, Germany: Springer, 2009, pp. 129-139.

[30] S. Xu, Y. Mu, and W. Susilo, "Online/offline signatures and multisignatures for AODV and DSR routing security," in Proc. 11th Australas. Conf. Inf. Sec. Privacy, vol. 4058. Berlin, Germany: Springer, 2006, pp. 99-110.

[31] M. Girault, G. Poupard, and J. Stern, "On the fly authentication and signature schemes based on groups of unknown order," J. Cryptol., vol. 19, no. 4, pp. 463-487, Oct. 2006.

[32] M. Joye, "An efficient on-line/off-line signature scheme without random oracles," in Proc. 7th Int. Conf. Cryptol. Netw. Secur., 2008, pp. 98-107.

[33] S. Goldwasser, S. Micali, and R. L. Rivest, "A digital signature scheme secure against adaptive chosen-message attacks," SIAM J. Comput., vol. 17, no. 2, pp. 281-308, Apr. 1988.

[34] Y. Ming and Y. Wang, "Improved identity based online/offline signature scheme," in Proc. 7th Int. Conf. Ubiquitous Intell. Comput. 7th Int. Conf. Autonomic Trusted Comput., Oct. 2010, pp. 126-131.

[35] A. C. Yao and Y. Zhao, "Online/offline signatures for low-power devices," IEEE Trans. Inf. Forensics Security, vol. 8, no. 2, pp. 283-294, Feb. 2013.

[36] M. Bellare and P. Rogaway, "Random oracles are practical: A paradigm for designing efficient protocols," in Proc. 1st ACM Conf. Comput. Commun. Secur. (CCS), 1993, pp. 62-73.

[37] J. Lai, X. Huang, D. He, and W. Wu, "Provably secure online/offline identity-based signature scheme based on SM9," Comput. J., vol. 65, no. 7, pp. 1692-1701, Jul. 2022.

[38] T. Aljrees, A. Kumar, K. U. Singh, and T. Singh, "Enhancing IoT security through a green and sustainable federated learning platform: Leveraging efficient encryption and the quondam signature algorithm," Sensors, vol. 23, no. 19, p. 8090, Sep. 2023.

[39] H. Xue, M. H. Au, X. Xie, T. H. Yuen, and H. Cui, "Efficient online-friendly two-party ECDSA signature," in Proc. ACM SIGSAC Conf. Comput. Commun. Secur., Nov. 2021, pp. 558-573.

[40] G. Castagnos, D. Catalano, F. Laguillaumie, F. Savasta, and I. Tucker, "Bandwidth-efficient threshold EC-DSA revisited: Online/offline extensions, identifiable aborts proactive and adaptive security," Theor. Comput. Sci., vol. 939, pp. 78-104, Jan. 2023.

[41] S. S. Ullah, S. Hussain, M. Uddin, R. Alroobaea, J. Iqbal, A. M. Baqasah, M. Abdelhaq, and R. Alsaqour, "A computationally efficient online/offline signature scheme for underwater wireless sensor networks," Sensors, vol. 22, no. 14, p. 5150, Jul. 2022.

[42] L. Chen, S. Jordan, Y.-K. Liu, D. Moody, R. Peralta, R. Perlner, and D. Smith-Tone, "Report on post-quantum cryptography," NIST, Gaithersburg, MD, USA, Tech. Rep. NISTIR 8105, 2016.

[43] D. Micciancio and O. Regev, Lattice-Based Cryptography. Springer, 2009, pp. 147-191.

[44] Y. Yu, H. Jia, and X. Wang, "Compact lattice gadget and its applications to hash-and-sign signatures," in Proc. Ann. Int. Cryptol. Conf. Adv. Cryptol., Jan. 2023, pp. 390-420.

[45] P. Zhang, H. Yang, L. Zhu, Y. Zhang, H. Wang, and Q. Xu, "A new lattice-based online/offline signatures framework for low-power devices," Theor. Comput. Sci., vol. 962, Jun. 2023, Art. no. 113942.

[46] G. Mittal, S. Kumar, and S. Kumar, "An efficient procedure for online/offline ID-based signature using extended chaotic maps and group ring," Secur. Privacy, vol. 6, no. 3, p. e279, May 2023.

[47] B. A. Forouzan, Introduction to Cryptography and Network Security. New York, NY, USA: McGraw-Hill, 2008.

[48] H. Krawczyk and T. Rabin, "Chameleon signatures," in Proc. Symp. Netw. Distrib. Sys. Secur., 2000, pp. 143-154.

[49] C. Meshram, C.-T. Li, and S. G. Meshram, "An efficient online/offline ID-based short signature procedure using extended chaotic maps," Soft Comput., vol. 23, no. 3, pp. 747-753, Feb. 2019.

[50] A. Menezes, "An introduction to pairing-based cryptography," in Recent Trends in Cryptography, vol. 477. Providence, RI, USA: American Mathematical Society, 2009, pp. 47-65.

[51] A. Lysyanskaya, R. L. Rivest, A. Sahai, and S. Wolf, "Pseudonym systems," in Proc. Sel. Areas Cryptogr., H. Heys and C. Adams, Eds., Berlin, Germany: Springer, 2000, pp. 184-199.

[52] D. Pointcheval and O. Sanders, "Reassessing security of randomizable signatures," in Proc. Topics Cryptol., 2018, pp. 319-338.

[53] S. D. Galbraith, Mathematics of Public Key Cryptography. Cambridge, U.K.: Cambridge Univ. Press, 2012.

[54] J. Kar, "Provably secure online/off-line identity-based signature scheme for wireless sensor network," Cryptol. ePrint Arch., Tech. Paper 2012/162, 2012. [Online]. Available: https://eprint.iacr.org/2012/162

[55] S. J. Aboud, "Secure online-offline identity-typed signature scheme," Int. J. Sci. Res. Manage. Stud., vol. 1, pp. 2349-3371, Jan. 2015.

[56] H. Lu, J. Li, and M. Guizani, "Secure and efficient data transmission for cluster-based wireless sensor networks," IEEE Trans. Parallel Distrib. Syst., vol. 25, no. 3, pp. 750-761, Mar. 2014.

[57] C. Y. Meshram, P. Powar, and M. S. Obaidat, "An UF-IBSS-CMA protected online/offline identity-based short signature technique using PDL," Proc. Comput. Sci., vol. 93, pp. 847-853, Jan. 2016.

[58] V. Goyal, O. Pandey, A. Sahai, and B. Waters, "Attribute-based encryption for fine-grained access control of encrypted data," in Proc. 13th ACM Conf. Comput. Commun. Secur., Oct. 2006, pp. 89-98.
[59] H. Hong, B. Hu, and Z. Sun, "An efficient and secure attribute-based online/offline signature scheme for mobile crowdsensing," *Hum.-Centric Comput. Inf. Sci.*, vol. 11, p. 26, Jun. 2021.

[60] S. S. Al-Riyami and K. G. Paterson, "Certificateless public key cryptography," in *Proc. Int. Conf. Theory Appl. Cryptol. Inf. Sec.*. Berlin, Germany: Springer, 2003, pp. 452–473.

[61] V. Shoup, "Practical threshold signatures," in *Proc. Int. Conf. Theory Appl. Cryptograph. Techn.*, Jan. 2000, pp. 207–220.

[62] C. Stathakopoulou and C. Cachin, "Threshold signatures for blockchain systems," *Swiss Federal Inst. Technol.*, vol. 30, p. 1, Apr. 2017.

[63] L. Harn and T. Kiesler, "New scheme for digital multisignatures," *Electron. Lett.*, vol. 25, no. 15, pp. 1002–1003, Jul. 1989.

[64] E. Bresson and J. Stern, "Proofs of knowledge for non-monotone discrete-log formulae and applications," in *Proc. 5th Int. Conf. Inf. Sec.*, vol. 2433. Berlin, Germany: Springer, 2002, pp. 272–288.

[65] N. Fleischhacker, M. Simkin, and Z. Zhang, "Squirrel: Efficient synchronized multi-signatures from lattices," in *Proc. ACM SIGSAC Conf. Comput. Commun. Secur.*, Nov. 2022, pp. 1109–1123.

[66] N. I. of Standards and Technology, *Module-Lattice-Based Digital Signature Standard*, Federal Inf. Process. Standards Publications (FIPS PUBS) 204, U.S. Department of Commerce, Washington, DC, USA, 2024.

[67] H. Hong and Z. Sun, "TS-ABOS-CMS: Time-bounded secure attribute-based online/offline signature with constant message size for IoT systems," *J. Syst. Archit.*, vol. 123, Feb. 2022, Art. no. 102388.

[68] M. E. S. Saeed, Q.-Y. Liu, G. Tian, B. Gao, and F. Li, "Remote authentication schemes for wireless body area networks based on the Internet of Things," *IEEE Internet Things J.*, vol. 5, no. 6, pp. 4926–4944, Dec. 2018.

[69] Y. Gao, P. Zeng, K.-K. R. Choo, and F. Song, "An improved online/offline identity-based signature scheme for WSNs," *Int. J. Netw. Secur.*, vol. 18, no. 6, pp. 1143–1151, 2016.

[70] A. A. Addobea, J. Hou, and Q. Li, "MHCOOS: An offline-online certificateless signature scheme for M-health devices," *Secur. Commun. Netw.*, vol. 2020, pp. 1–12, Jan. 2020.

[71] J. Kar, "Online/off-line ring signature scheme with provable security," in *Proc. IEEE Int. Conf. Intell. Secur. Inform. (ISI)*, Baltimore, MD, USA, 2015, p. 197, doi: 10.1109/ISI.2015.7165979.

[72] K. Li, M. H. Au, W. H. Ho, and Y. L. Wang, "An efficient conditional privacy-preserving authentication scheme for vehicular ad hoc networks using online/offline certificateless aggregate signature," in *Proc. 13th Int. Conf. Provable Secur.*. Berlin, Germany: Springer, 2019, pp. 59–76.

[73] J. Cui, J. Zhang, H. Zhong, R. Shi, and Y. Xu, "An efficient certificateless aggregate signature without pairings for vehicular ad hoc networks," *Inf. Sci.*, vols. 451–452, pp. 1–15, Jul. 2018.

[74] N. Fleischhacker, G. Herold, M. Simkin, and Z. Zhang, "Chipmunk: Better synchronized multi-signatures from lattices," in *Proc. ACM SIGSAC Conf. Comput. Commun. Secur.*, Nov. 2023, pp. 386–400.

[75] *Information Technology—Security Techniques—Digital Signatures With Appendix—Part 2: Integer Factorisation Based Mechanisms*, 2nd ed., Standard ISO/IEC 14888-2, International Organization for Standardization, Geneva, Switzerland, 2008.

[76] J. Camenisch, S. Hohenberger, and M. Ø. Pedersen, "Batch verification of short signatures," in *Proc. 26th Ann. Int. Conf. Theory Appl. Cryptograph. Techn.*. Berlin, Germany: Springer, 2007, pp. 246–263.

[77] D. Boneh, B. Lynn, and H. Shacham, "Short signatures from the Weil pairing," in *Proc. Int. Conf. Theory Appl. Cryptol. Inf. Sec.*, Jan. 2001, pp. 514–532.

[78] B. Waters, "Efficient identity-based encryption without random oracles," in *Proc. Ann. Int. Conf. Theory Appl. Cryptograph. Techn.*, Jan. 2005, pp. 114–127.

[79] J. Zhang, Y. Chen, and Z. Zhang, "Programmable hash functions from lattices: Short signatures and IBEs with small key sizes," in *Proc. Ann. Int. Cryptol. Conf. Adv. Cryptol.*, Jan. 2016, pp. 303–332.

[80] X. Chen, F. Zhang, W. Susilo, and Y. Mu, "Efficient generic online/off-line signatures without key exposure," in *Proc. Int. Conf. Appl. Cryptography Netw. Secur.*, Jan. 2007, pp. 18–30.

[81] Q. Su, R. Zhang, R. Xue, and P. Li, "Revocable attribute-based signature for blockchain-based healthcare system," *IEEE Access*, vol. 8, pp. 127884–127896, 2020.

[82] K. Gu, W. Jia, G. Wang, and S. Wen, "Efficient and secure attribute-based signature for monotone predicates," *Acta Inf.*, vol. 54, no. 5, pp. 521–541, Aug. 2017.

[83] H. Cui, R. H. Deng, and G. Wang, "An attribute-based framework for secure communications in vehicular ad hoc networks," *IEEE/ACM Trans. Netw.*, vol. 27, no. 2, pp. 721–733, Apr. 2019.

[84] H. Cui, G. Wang, R. H. Deng, and B. Qin, "Escrow free attribute-based signature with self-revealability," *Inf. Sci.*, vols. 367–368, pp. 660–672, Nov. 2016.

[85] J. Liu, Z. Zhang, X. Chen, and K. S. Kwak, "Certificateless remote anonymous authentication schemes for WirelessBody area networks," *IEEE Trans. Parallel Distrib. Syst.*, vol. 25, no. 2, pp. 332–342, Feb. 2014.

[86] D. He, S. Zeadally, N. Kumar, and J.-H. Lee, "Anonymous authentication for wireless body area networks with provable security," *IEEE Syst. J.*, vol. 11, no. 4, pp. 2590–2601, Dec. 2017.

[87] H. Xiong, "Cost-effective scalable and anonymous certificateless remote authentication protocol," *IEEE Trans. Inf. Forensics Security*, vol. 9, no. 12, pp. 2327–2339, Dec. 2014.

[88] C. Wang and Y. Zhang, "New authentication scheme for wireless body area networks using the bilinear pairing," *J. Med. Syst.*, vol. 39, no. 11, pp. 1–8, Nov. 2015.

[89] T.-S. Wu, Y.-S. Chen, and K.-Y. Lin, "ID-based online/offline signature from pairings," in *Proc. Int. Comput. Symp. (ICS)*, Dec. 2010, pp. 198–203.

[90] S. Hussain, S. S. Ullah, M. Shorfuzzaman, M. Uddin, and M. Kaosar, "Cryptanalysis of an online/offline certificateless signature scheme for Internet of Health Things," *Intell. Automat. Soft Comput.*, vol. 30, no. 3, pp. 983–993, 2021.

[91] A. Liu and P. Ning, "TinyECC: A configurable library for elliptic curve cryptography in wireless sensor networks," in *Proc. Int. Conf. Inf. Process. Sensor Netw. (ipsn)*, Apr. 2008, pp. 245–256.

[92] D. Liu, S. Zhang, H. Zhong, R. Shi, and Y. Wang, "An efficient identity-based online/offline signature scheme without key escrow," *Int. J. Netw. Secur.*, vol. 19, pp. 127–137, Jan. 2017.

[93] F. Xu and H. Zeng, "Cryptanalysis of two signature schemes for IoT and mobile health systems," *Wireless Pers. Commun.*, vol. 122, no. 3, pp. 2035–2043, Feb. 2022.

[94] C.-P. Schnorr, "Efficient signature generation by smart cards," *J. Cryptol.*, vol. 4, pp. 161–174, Jan. 1991.

[95] J. C. Choon and J. Hee Cheon, "An identity-based signature from gap Diffie-Hellman groups," in *Proc. Int. Workshop Pract. Theory Public Key Cryptogr.*, 2002, pp. 18–30.

[96] R. Sakai, K. Ohgishi, and M. Kasahara, "Cryptosystems based on pairing," in *Proc. Symp. Cryptogr. Inf. Secur.*, 2000, pp. 26–28.

[97] X. Chen, F. Zhang, and K. Kim, "ID-based multi-proxy signature and blind multisignature from bilinear pairings," in *Proc. Conf. Korea Inst. Inf. Secur. Cryptol.*, vol. 3, 2003, pp. 11–19.

[98] F. Li, M. Shirase, and T. Takagi, "On the security of online/offline signatures and multisignatures from ACISP'06," in *Proc. Int. Conf. Cryptol. Netw. Secur.*, 2008, pp. 108–119.

[99] S.-J. Horng, S.-F. Tzeng, P.-H. Huang, X. Wang, T. Li, and M. K. Khan, "An efficient certificateless aggregate signature with conditional privacy-preserving for vehicular sensor networks," *Inf. Sci.*, vol. 317, pp. 48–66, Oct. 2015.

[100] D. Liu, R.-H. Shi, S. Zhang, and H. Zhong, "Efficient anonymous roaming authentication scheme using certificateless aggregate signature in wireless network," *J. Commun.*, vol. 37, no. 7, p. 182, 2016.

[101] A. K. Malhi and S. Batra, "An efficient certificateless aggregate signature scheme for vehicular ad-hoc networks," *Discrete Math. Theor. Comput. Sci.*, vol. 17, no. 1, pp. 317–338, May 2015.

[102] H. Zhong, S. Han, J. Cui, J. Zhang, and Y. Xu, "Privacy-preserving authentication scheme with full aggregation in VANET," *Inf. Sci.*, vol. 476, pp. 211–221, Feb. 2019.

[103] I. A. Kamil and S. O. Ogundoyin, "An improved certificateless aggregate signature scheme without bilinear pairings for vehicular ad hoc networks," *J. Inf. Secur. Appl.*, vol. 44, pp. 184–200, Feb. 2019.

[104] S. Nakamoto. (2008). *Bitcoin: A Peer-to-Peer Electronic Cash System*. [Online]. Available: https://bitcoin.org/bitcoin.pdf

[105] V. Buterin. (2013). *Ethereum White Paper*. [Online]. Available: https://ethereum.org/en/whitepaper/

[106] *Tether. Tether: Fiat Currencies on the Bitcoin Blockchain*. Accessed: Nov. 12, 2024. [Online]. Available: https://assets.ctfassets.net/vyse88cgwfbl/5UwGHMVz071t2Cq5yTw5vi/c9798ea8db99311bf90ebe0810938b01/TetherWhitePaper.pdf
[107] R. Gennaro, S. Goldfeder, and A. Narayanan, "Threshold-optimal DSA/ECDSA signatures and an application to Bitcoin wallet security," in *Proc. Int. Conf. Appl. Cryptogr. Netw. Secur.*, Jan. 2016, pp. 156–174.

[108] R. Canetti, R. Gennaro, S. Goldfeder, N. Makriyannis, and U. Peled, "UC non-interactive, proactive, threshold ECDSA with identifiable aborts," in *Proc. ACM SIGSAC Conf. Comput. Commun. Secur.*, Oct. 2020, pp. 1769–1787.

[109] G. Castagnos, D. Catalano, F. Laguillaumie, F. Savasta, and I. Tucker, "Bandwidth-efficient threshold EC-DSA," in *Proc. IACR Int. Conf. Public-Key Cryptogr.* Berlin, Germany: Springer, 2020, pp. 266–296.

[110] G. Castagnos, D. Catalano, F. Laguillaumie, F. Savasta, and I. Tucker, "Two-party ECDSA from hash proof systems and efficient instantiations," in *Proc. 39th Ann. Int. Cryptol. Conf. Adv. Cryptol.* Berlin, Germany: Springer, 2019, pp. 191–221.

[111] J. Doerner, Y. Kondi, E. Lee, and A. Shelat, "Secure two-party threshold ECDSA from ECDSA assumptions," in *Proc. IEEE Symp. Secur. Privacy (SP)*, May 2018, pp. 980–997.

[112] J. Doerner, Y. Kondi, E. Lee, and A. Shelat, "Threshold ECDSA from ECDSA assumptions: The multiparty case," in *Proc. IEEE Symp. Secur. Privacy (SP)*, May 2019, pp. 1051–1066.

[113] R. Gennaro and S. Goldfeder, "Fast multiparty threshold ECDSA with fast trustless setup," in *Proc. ACM SIGSAC Conf. Comput. Commun. Secur.*, Oct. 2018, pp. 1179–1194.

[114] Y. Lindell, "Fast secure two-party ECDSA signing," in *Proc. Ann. Int. Cryptol. Conf. Adv. Cryptol.* Berlin, Germany: Springer, 2017, pp. 613–644.

[115] Y. Lindell and A. Nof, "Fast secure multiparty ECDSA with practical distributed key generation and applications to cryptocurrency custody," in *Proc. ACM SIGSAC Conf. Comput. Commun. Secur.*, Oct. 2018, pp. 1837–1854.

[116] T. H. Yuen, H. Cui, and X. Xie, "Compact zero-knowledge proofs for threshold ECDSA with trustless setup," in *Proc. IACR Int. Conf. Public-Key Cryptogr.* Berlin, Germany: Springer, 2021, pp. 481–511.

[117] J. H. Ahn, M. Green, and S. Hohenberger, "Synchronized aggregate signatures: New definitions, constructions and applications," in *Proc. 17th ACM Conf. Comput. Commun. Secur.*, Oct. 2010, pp. 473–484.

[118] C. A. Lara-Nino, A. Diaz-Perez, and M. Morales-Sandoval, "Elliptic curve lightweight cryptography: A survey," *IEEE Access*, vol. 6, pp. 72514–72550, 2018.

[119] M. Rana, Q. Mamun, and R. Islam, "Lightweight cryptography in IoT networks: A survey," *Future Gener. Comput. Syst.*, vol. 129, pp. 77–89, Apr. 2022.

<figure><img src="image_5.png" /></figure>

**JULIET SAMANDARI** received the B.Sc. degree (Hons.) in computer science from the University of Canterbury (UC), Christchurch, New Zealand, in 2021, where she is currently pursuing the Ph.D. degree. Her current research interests include post-quantum cryptography and its implementation in the IoT, and lattice-based cryptography and authentication protocols.

<figure><img src="image_6.png" /></figure>

**CLÉMENTINE GRITTI** received the M.Sc. degree in computer science from Grenoble Alpes University, France, in 2012, and the Ph.D. degree in computer science from the University of Wollongong, Australia, in 2017. She was a Postdoctoral Researcher at the Norwegian University of Science and Technology, Norway, and Eurecom, France. She was a Lecturer at the Computer Science and Software Engineering Department, University of Canterbury, from 2020 to 2023. She previously

worked on several research projects dealing with information security and privacy for electronic health and electronic voting. She is currently an Associate Professor at INRIA, INSA Lyon, France. Her current research interests include designing and evaluating public-key cryptographic protocols for security and privacy in various environments, such as federated learning, the Internet of Things, and blockchain technologies.

...