I would like to use different EC keys for different purposes in an app, and I would like to easily see the purpose for which particular key (pair) was generated.
With ~65K attempts, I can generate a key-pair where the first byte of both the public and private key are equal to a particular "purpose code" byte value.
(e.g. 0x01
is for signing Xs, 0x02
is for signing Ys, 0x03
is for encrypting Zs, etc.)
Does this significantly weaken the keys, in ways other than lowering the brute-force workload from 2^256 to 2^248?
(The obvious approach is to keep the full 256 bits and use an extra byte for the "purpose" information. Generating a key, chosen to store a little data, has the advantage that this extra data can be encoded in all common key serialization formats, whereas a new "purpose" byte would need all new tools.)