Length of Signatures and Public Keys

Signatures and public keys in existing fail-stop signature schemes are not much longer than in ordinary digital signature schemes. Hence the lower bounds are very small, too. 

It must have at least 2 acceptable signatures otherwise the correct signature could be guessed with a too high probability by a computationally unrestricted attacker. 

For unforgeability, it must be infeasible for a computationally restricted attacker to find acceptable signatures at all. Thus the density of the set of acceptable signatures within the signature space should be small, e.g., at most 2 for some 7.  

Hence one can expect the size of the signature space to be at least 2. Formally, only is proved, but on the other hand, it is proved more generally that the 

the security against the stupid forging algorithm mentioned above is defined precisely. 

---