Is there a lower limit on message length for signature?

Question

I was working on a tool that signs small messages (~20 bytes) when a question occurred about message size: What would be the risk of using extremely small/restricted input (say, 5 bytes of hexadecimal chars) messages? Since the data is a hash and replay attack is not a concern, the message wasn't originally salted.

Would a signature and/or collision be easier (/easy) to generate without the private key? Or would that make the private key vulnerable in any way?

In this particular case we are using Ed25519, which does double hashing on the value before encryption, so I don't see an issue for the public key, but I'm still concerned.

Answer 1

The lower limit is a single byte. Ed25519 is not defined for units smaller than a byte, but if it were, there would be, in principle, no security issue with signing a single-bit message: the expected cost of forgery on a message of any length, from a bit to an exabit, remains near $2^{128}$ and therefore well out of reach for humanity.