Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I want to send out short messages to the world which listeners could verify to be send from me.

The way this is usually done is to encrypt the message with a private key where the readers decrypt it with my public key. My problem is that I need small messages, smaller than 64 bytes in base64, plain RSA won't work since the algorithm makes the encrypted message around 128 bytes.

Can someone suggest the name of an algorithm to me that may work?

share|improve this question
5  
Actually you are looking for a signature scheme not an encryption scheme. BLS signatures are very short, but ECDSA is also ok for your requirements and implementations are widely available. –  DrLecter Jan 8 at 20:54
2  
"(I) encrypt the message with a private key where the readers decrypt it with my public key" is a sin in terminology. That should be "(I) sign the message with a private key where the readers verify it with my public key". The change in terminology also comes with a change in the appropriate methodology, even though in RSA the modular exponentiation remains the same. In RSA, using only exponentiation is called textbook RSA or naked RSA, and is unsafe (often for encryption, most often for signature). –  fgrieu Jan 9 at 6:27
add comment

1 Answer

Note that encrypting "the message with a private key where the readers decrypt it with my public key"
is usually insecure, although there are signatures with message recovery that are presumably secure.

The canonical short signature scheme is BLS.
The main alternative that I'm aware of is the random-oracle part of this paper,
although that scheme cannot safely sign a large number of messages.

share|improve this answer
    
Signature schemes with message recovery only aim at saving bandwidth, compared to signature schemes with appendix. For example, the signature scheme of ISO/IEC 9796-2 allows to convey a 480-byte message as a 514-byte cryptogram (assuming 4096-bit RSA and SHA-256 hash), when SSA schemes of PKCS#1 would make that a 992-byte cryptogram. –  fgrieu Jan 9 at 6:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.