An apparatus, comprising: hash logic configured to generate the message representative (M') based on an input message and a randomly sampled nonce by at least one application of the SHA256 function; and signature logic configured to: generate a signature to be transmitted in association with the message representative (M'), the signature logic configured to apply a hash-based signature scheme to a private key (sk) to generate the signature comprising a public key (pk); and determine whether the message representative (M') satisfies a target threshold allocation of computational costs between a cost to generate the signature and a cost to verify the signature, wherein the apparatus is configured to: in response to determining that the message representative (M') does not satisfy the target threshold allocation, generate a new message representative (M') based on the input message and a new randomly sampled nonce, the apparatus further comprises accelerator logic configured to pre-compute an internal state of the SHA256 function for a part of its input that precedes the randomly sampled nonce, and the hash logic is configured to continue computation of the SHA256 function departing from this intermediate state to process the part of its input that starts with the randomly sampled nonce, for each new nonce. hash logic configured to generate the message representative (M') based on an input message and a randomly sampled nonce by at least one application of the SHA256 function; and signature logic configured to: generate a signature to be transmitted in association with the message representative (M'), the signature logic configured to apply a hash-based signature scheme to a private key (sk) to generate the signature comprising a public key (pk); and determine whether the message representative (M') satisfies a target threshold allocation of computational costs between a cost to generate the signature and a cost to verify the signature, wherein the apparatus is configured to: in response to determining that the message representative (M') does not satisfy the target threshold allocation, generate a new message representative (M') based on the input message and a new randomly sampled nonce, generate a signature to be transmitted in association with the message representative (M'), the signature logic configured to apply a hash-based signature scheme to a private key (sk) to generate the signature comprising a public key (pk); and determine whether the message representative (M') satisfies a target threshold allocation of computational costs between a cost to generate the signature and a cost to verify the signature, wherein the apparatus is configured to: in response to determining that the message representative (M') does not satisfy the target threshold allocation, generate a new message representative (M') based on the input message and a new randomly sampled nonce, the apparatus further comprises accelerator logic configured to pre-compute an internal state of the SHA256 function for a part of its input that precedes the randomly sampled nonce, and the hash logic is configured to continue computation of the SHA256 function departing from this intermediate state to process the part of its input that starts with the randomly sampled nonce, for each new nonce.