Our application requires some 'mild' form of 'proof of origin' for the tokens we issue (~200 bytes), however, the value of each is trivial. The requirement is to provide 'tamper resistance' rather than 'unforgeable', to not bloat the token size, and to use commonly available 'standard' libraries and tools.
In the token, we include a hash of the request we received, and I understand we can crop this down to the last n (e.g. 48) bits easily enough, and do the same with the token hash/digest before signing.
Is something similar possible with the signature, or do we need to just generate the smallest key and a tiny digest to get the output as small as possible?
I've been mucking about with openssl rsautl - is this as good as any other given our requirements as above? The signatures are coming out at ~24 bytes, I'd like to reduce that a bit further if possible.
EDIT TO ADD
For us, the ability to forge a single signature within a few minutes is perfectly fine, sub-minute is getting problematic. The ability to derive our private key, and subsequently bulk-produce counterfeit signatures with negligible time/energy cost is the primary risk.
With the advice of those below I've been looking at ECDSA and the secp112r1 OpenSSL built-in curve, assuming that is better than a 256bit RSA primary key.