For a software registration code, I would like to sign a phone number of around 14 digits with a private key and then check it in an app.

I would imagine to use RSA or something but the signature should be typed in manually (registration code) and also have only some 10 digits to be typed in easily.

RSA signatures are usually longer. So can I just Hash it and still verify it?

I have read, that RSA signatures are as long as the private key, so I have tried to sign with a 32 bit RSA key, but this gives me "modulus to short".

The next approach would be to use a longer key size and hash the signature to have a shorter one. But I think then I can not verify it anymore, or is there still a way?

My public key would be contained in the app. The private better not :-)

I know that Elliptic Curve keys are shorter, so would that help?

It does not have to be super safe (which is probably impossible), but just as safe as possible as it gets with this limitation.

Bonus: It is possible to use a even shorter signature results, like for example 16 bits. My approach is to have multiple signatures in the result so I am able to check only one and use another public key later.

Bonus 2: The implementation should be relatively easy to code with well available libs for Java/Android and PHP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.