Using first, say, 50 letters from a public key as user identifier?

Question

I am making a messaging system where users are identified by their public keys. It doesn't matter which friendly username they have, so I'm not going to prompt them to choose one. Each user will have a directory that will get their messages saved to, so it would be nice if the directory that belongs to them has a short name. I.e. I can't create a very large directory name by using the entirety of their public keys (might be too long and hit file system limits).

I was considering to use, say, sha3_244(their_public_key) and consider that hash for their home directory names.

But then I thought, how about I take the 1st 50 bytes of their public key, base32 encode it, and use this instead of the sha3_244 checksum? Should I be worried about collisions?

Answer 1

Should I be worried about collisions?

If these are RSA keys, yes, at least, if people find it in their interest to collide with someone else.

It is entire practical to generate an RSA key where to top 400 bits of the modulus are some specified value. Since you use those 400 bits as your identifier, then that means the user can pick any identifier they want, for example, the same identifier as another user.

Whether that is a concern depends on whether users would actually gain an advantage.

As for how you would generate a (say 2048 bit) RSA key with the top 400 bits being the value $X$, here's what you do:

• Select your 1024 bit prime $p$ as usual

• Select a prime $q$ from the range $2^{2048-400}X / p < q < 2^{2048-400}(X+1) / p$; there will be plenty of primes in a range that large.

It's easy to see that $pq$ would be a valid RSA modulus with the top 400 bits being the value $X$.