For each private key "yi,j" and its corresponding "zi,j" public key pair, the private key length must be selected so performing a preimage attack on the length of the input is not faster than performing a preimage attack on the length of the output. For example, in a degenerate case, if each private key "yi,j" element was only 16 bits in length, it is trivial to exhaustively search all 216 possible private key combinations in 216 operations to find a match with the output, irrespective of the message digest length. Therefore a balanced system design ensures both lengths are approximately equal.