# Security strength EC signature for variable message size

I am implementing a system using some sort of 32bytes OTC (One-Time Code) and signing it with ECDSA to get verification of a public key owner.

The key I'm using is secp256r1.

Since the nature of this mechanism is very short-lived (say I will refresh the OTC within 1 minute), I doubt whether I can shorten the OTC in some sense that it still gives acceptable security.

Therefore I would like to know the following as a direction to measure the security strength:

• The probability of best attack known to secp256r1 key per trial, with variable "length of the message-to-be-signed"
• The expected number of trials to make expected value of success = 1

I'm okay if you just refer some papers or guidance and not doing the calculation here; or any other direction of such measurement.

You haven't specified the signature algorithm, but let's assume ECDSA.

The probability of best attack known to secp256r1 key per trial, with variable "length of the message-to-be-signed"

The hash over the message is computed as the first step to generate the signature. The size of the message doesn't matter. So the security strength remains at $$2^{128}$$, i.e. nothing to be worried about.

The expected number of trials to make expected value of success = 1

It is unclear why the expected value of success should be 1; I'd worry if the chance of success would be $$1 \over 2$$ as well. I presume it is when you've tried all options for a specific public key, so close to $$2^{128}$$ (trying all possible start values in Pollards Rho if I'm not mistaken).

This is all rather basic, I doubt if you can find any explicit references for it, because this is just what's assumed.

What this has to do with the size of the input message for the OTP is unclear to me. I'd rather worry about the security of the overall scheme rather than the signature.

If you want to shorten the signatures themselves then you could take a look at the BLS signature scheme. ECDSA has a signature size of 64 bytes for secp256r1 (independent of the message size, as you may now imagine), while BLS may halve the number of bytes required.

• The problem to me is, since "the input size of message is less than the size of signature" could be known to attacker, is there some feasible attack on forging the message or other attack? I want to shorten the OTP message because I also face some other constraint when delivering the OTP message. – orb Apr 27 '19 at 1:28
• I was trying to tell you that no, such an attack should not be feasible. Of course your One Time Code should be unique, regardless of the signature scheme or value. – Maarten Bodewes Apr 27 '19 at 1:40