I have an application that would benefit from very small (e.g. 16-20 byte) EDDSA keys and small signatures. It's an application where the goal is more to deter DOS attacks than "hard" security, so having the signature be attackable by someone with a lot of resources is not a huge problem. (Full ed25519 or similar are used for the real security parts of the system.)
How would one go about generating such a curve? Or is this an extremely nontrivial thing to do? I can find some sample code for general EDDSA but no curves other than 25519 and 448. This makes sense since small curves wouldn't have many use cases, but I have one. :)
Right now I have sample code using traditional ECDSA with the Brainpool P-160t curve. It works but I'm wondering if an Edwards curve would be faster and would offer better security with an even smaller key and signature size.