# ECC cryptography with shorter signature when not needing high security?

I am new here and fairly new to cryptography, so if I say something wrong, let me know.

I am trying to set up a system where a user can receive a temporary license key over the phone, put it into the system, and get the privileges and expiration date which was encoded into the license key.

The limitation for this key is about 100 bits. About 27 will hold the properties of the key, and the rest will be a signature verifying someone didn't make their own license key.

I think we can get away with having a smaller signature size than usual because we are using a cryptography IC which can hold private keys and hash data using SHA-256, and it takes some time to do this (maybe 100ms). If we used this in the verification of a signature, it would keep a hacker from using their supercomputer to crack keys quickly.

For the crypto calculations done in software and not on the crypto IC, we want to use public key crpytography, and ECC seems like the best option right now due to the already relatively short signatures.

Assuming the random component can be calculated based on the 27 data bits (and will always be different for a different license key), can I make the other half of the ECC signature only take up 73 bits? How would this be done?

• The shortest usable signatures I know are BLS at twice the security level in size. You can truncate a few bits, raising the verification cost exponentially. Even if you'd use a 112 bit curve (which matches the largest academic ECDL break) this only goes down to about 90 bits. Aug 21, 2014 at 14:59
• The time to break the crypto goes down exponentially with the bitsize. Currently the shortest ECC keys are about 192 for secure applications, but say we use 160 bit ECC keys for lower security. Then your key has about 160 - 73 = 87 bits less security. Does your attacker actually have $2^{87}$ less time to crack it? Note that this is assuming that the signature is the same size as the key size; in practice it is about twice that size. Note that with ECC it could actually be $2^{87/2}$ less time, but that would still be a huge number). Aug 21, 2014 at 15:10
• @owlstead, do you think it may still be enough time? We were expecting these to expire monthly, and if it requires hashes which are done in the relatively slow cryptography chip we have, I think that may be acceptable. Aug 21, 2014 at 17:03
• @CodesInChaos, I have looked into BLS some and saw that the signatures can get pretty small, but I never saw specifics like that. Do you know of a place which talks about getting signatures down to that size. That may be a possibility. Aug 21, 2014 at 17:04
• @owlstead Considering that the academic ECDL record is 113 bits, a 128 curve should be acceptable for license keys. It's generally easier to crack the application, removing the key check than it is to compute that DL. Aug 22, 2014 at 9:15