## 5 Performance Comparisons  
In this section, our proposed scheme is compared with some existing lattice-based authentication schemes [3; 4]. Tables 3 and 4 summarize the comparisons between the proposed scheme and those schemes in performance.  
In the authentication phase of the proposed scheme, when there is only one user (\(Q^{\prime}=1\)), the manager uses one symmetric encryption operation, one symmetric decryption operation, and \(n\times(m+m^{\prime})\) module multiplications. The user performs one SampleD operation, two hashing operations, one symmetric encryption operation, one symmetric decryption operation, and one exclusive-or operation. We adopt AES 256 as the symmetric encryption operation. The cost of AES 256 is 15.875 ms [12]. The cost of SampleD is 0.00045 ms [13]. We take SHA-3 256 bits as our hashing operation. According to [14], the time taken to hash a 100-byte message is 0.001295 ms. We use the Montgomery algorithm with 256 bits as our modular multiplication. The time of a modular multiplication is 0.137 ms [15]. According to [16], we set \(n\times(m+m^{\prime})=192\ \times\ 417=80\),064. Hence, the computation time of \(n\times(m+m^{\prime})\) module multiplications is 0.137 ms \(\times\) 80.064 = 10,968.77 ms. In conclusion, the total computation cost of the manager is 15.875 \(\times\ 2\ +\ 10\),968.77 \(\approx\) 11,000.52 ms. The total cost of the user is 0.00045 \(+\ 0.001295\ \times\ 2\ +\ 15.875\ \times\ 2\approx 31.753\) ms. When there is more than one user (\(\mathrm{Q^{\prime}}\ >\ 1\)), the manager uses one symmetric encryption operation, one symmetric decryption operation, one hashing operation, and \(n\times(m+m^{\prime})\) module multiplications. Each user uses one SampleD operation, one hashing operation, one symmetric encryption operation, and one symmetric decryption operation. The total computation cost of the manager is 15.875 \(\times\ 2\ +\ 0.001295+22\),446.08 \(\approx\) 22,477.83 ms. The total computation cost of each user is \(\approx\) 31.753 ms.  
In the authentication phase of [PERSON] et al.'s Scheme [3], the reader/back-end executes one NTRU decryption operation, two rotation operations, two exclusive-or operations, one hashing operation, one subtraction, and \(2N^{2}\) multiplications. The tag performs four addition operations, three rotation operations, one hashing operation, and two exclusive-or operations. According to [17], \(HMAC(K,m)=H((K^{\prime}\oplus opad)\ ||\ H((k^{\prime}\oplus ipad)\ ||\ m))\approx 2\times\) SHA-3 hashing operations. Thus, the running time of HMAC is 0.001295 \(\times\ 2\ =\ 0.00259\) ms. According to [3], the cost of an NTRU decryption is \(2N^{2}\) modular multiplications \((N=167)\). Hence, the cost of an NTRU decryption is \(2\ \times\ 167\ \times\ 167\ \times\ 0.137\approx 7641.586\) ms. In summary, the cost of the reader/back-end is 7641.586 \(\times\ 2\ +\ 0.00259\approx 15\),283.1746 ms. The cost of the tag is 0.00259 ms.  
In the authentication phase of [PERSON] et al.'s Scheme [4], the user performs \(2N^{2}\) multiplication operations, one hashing operation, two rotation operations, one exclusive-or operation, and two addition operations. The bank executes \(N^{2}\) multiplication operations, one exclusive-or operation, one rotation operation, and one hashing operation. In conclusion, the cost of the bank is 167 \(\times\ 167\ \times\ 0.137\ +\ 0.001295\approx 3820.79\) ms. The cost of the user is \(2\ \times\ 167\ \times\ 167\ \times\ 0.137\ +\ 0.001295\approx 7641.59\) ms.  
Note that for a single-user situation, the computation cost of the server side is 28% faster than [3], and the computation cost of the user side is 99% faster than [4]. As for the computation cost of the group authentication scenario, we can see that the total cost of the server side and the user side is less than those of [3,4].