Generating a small EdDSA curve I have an application that would benefit from very small (e.g., 16-20 byte) EdDSA keys and small signatures. It's an application where the goal is more to deter DOS attacks than &quot;hard&quot; security, so having the signature be attackable by someone with a lot of resources is not a huge problem. (Full Ed25519 or similar are used for the real security parts of the system.)
How would one go about generating such a curve? Or is this an extremely nontrivial thing to do? I can find some sample code for general EdDSA but no curves other than 25519 and 448. This makes sense since small curves wouldn't have many use cases, but I have one.
Right now, I have sample code using traditional ECDSA with the Brainpool P-160t curve. It works, but I'm wondering if an Edwards curve would be faster and would offer better security with an even smaller key and signature size.
After more Googling I found a paper called "A note on high-security
general-purpose elliptic curves" which contains some "legacy strength" Edwards curves that might work. Thought I'd self-answer in case anyone else ever needs something like this.