16 bit (2 byte) Digital Signature

Question

I'm developing an experimental Amateur Radio digital protocol for over-the-air data exchange. A part of any protocol over fallible transport layers is of course some kind of error control (ECC, FEC, CRC, etc). My original intention was to use a simple 16 bit CRC to checksum each individual packet.

An additional concern is the potential spoofing of packets. With a simple CRC this is pretty trivial, as the protocol and implementation will be open-source, it would be easy to construct packets that appear to be from any station.

The protocol may also be used over error-free transport layers as well, in which case the CRC, used purely for error checking, would become redundant.

What I'd like to explore is replacing a simple 16-bit CRC with what amounts to a digital signature. Thus it would serve the purpose of providing at least 16-bit quality CRC, along with a unique CRC that cannot be trivially generated to spoof packets from a station.

I realize that, cryptographically speaking, a signature as small as 16 bits can be easily brute forced. However, similarly, a 16-bit CRC also has a fairly high probability of collisions. Unfortunately that is the limitation when dealing with data transfer at rates as potentially low as 300 baud, and typically at 1200 - 9600 baud. There is no luxury to transmit large signatures and checksums.

For critical information, such as an OTA software update, that data would be properly signed using standard methods with appropriate length bit lengths. Of course the higher level data can also be signed as well. My question is pertaining to the lower-levels of data exchange at the individual packet level, and adding at least some level of anti-spoofing that would also serve the same purpose as basic CRC.

The public and private keys can be pretty much any size, as the public keys would only need to be exchanged once for each pair of stations that wish to communicate. It is the individual packet signing I would like recommendations on.

Note that the entire payload cannot be encrypted, as that would be in violation of FCC regulations for Amateur Radio.

A method such as encrypting just the CRC using an asymmetrical encryption would not suffice, because not all packets are intended for consumption by a single station. Beacons and other broadcast packets are intended to be received by all listening stations. So encrypting the CRC so it can only be decoded by a single receiving station would only solve the issue for direct station-to-station communication and not more generally.

Answer 1

TLDR: Can't do.

---

16-bit is simply not enough for digital signature, which requires many times more bits¹, and can't be checked if truncated (becoming useless).

One may want to consider a Message Authentication Code, such as HMAC with SHA-256. At least, that's cryptographically better than an encrypted CRC². But there must be a shared secret between sender and receiver(s), thus that's not usable in the question's stated context.

If one absolutely needs public-key verification, the only option that I see is signing a group of earlier packets in a special signature packet (or group of signature packets), as the question proposes for "critical information". Problem is that losing a single packet prevents verification of the signature.

---

¹ To attain even mild security (80-bit), the most compact signature schemes around require about 224 bits (or 160 for a BLS scheme once used but now thought quite vulnerable), for something that is added to data renaming in clear; or down to 64 bits if you accept that about 1200 bits of the payload remains scrambled until cryptographic verification (even though only the public key is involved for the unscrambling, it's very debatable that the later meets the requirement of non-encryption in amateur radio).

² It is trivial to alter a message without changing the CRC, thus the encrypted CRC.