diff --git a/automotive-cse.cabal b/automotive-cse.cabal
--- a/automotive-cse.cabal
+++ b/automotive-cse.cabal
@@ -1,6 +1,6 @@
 
 name:                automotive-cse
-version:             0.1.1.0
+version:             0.1.2.0
 synopsis:            Automotive CSE emulation
 description:         This package includes Cryptography Security Engine (CSE)
                      codec emulation for automotive things.
@@ -29,6 +29,7 @@
   other-extensions:    GeneralizedNewtypeDeriving
   build-depends:         base >=4.5 && <5
                        , bytestring
+                       , bytestring-short
                        , cereal
                        , memory
                        , cryptonite
diff --git a/src/Codec/Automotive/CSE.hs b/src/Codec/Automotive/CSE.hs
--- a/src/Codec/Automotive/CSE.hs
+++ b/src/Codec/Automotive/CSE.hs
@@ -31,6 +31,8 @@
 import Data.Word (Word8, Word32)
 import Data.ByteString (ByteString)
 import qualified Data.ByteString as BS
+import Data.ByteString.Short (ShortByteString)
+import qualified Data.ByteString.Short as Short
 import Data.Serialize.Get (runGet, getWord64be)
 import Data.Serialize.Put (runPut, putWord64be)
 import Numeric (showHex)
@@ -44,14 +46,20 @@
 import Backport.Crypto.ConstructHash.MiyaguchiPreneel (MiyaguchiPreneel(..), mp)
 
 
-hdump :: ByteString -> String
-hdump = (`appEndo` "") . mconcat . map (Endo . showW8) . BS.unpack
+dump8 :: [Word8] -> String
+dump8 = (`appEndo` "") . mconcat . map (Endo . showW8)
   where
     showW8 w
       | w < 16     =  ('0' :) . showHex w
       | otherwise  =  showHex w
 
+hdump :: ByteString -> String
+hdump = dump8 . BS.unpack
 
+hdump' :: ShortByteString -> String
+hdump' = dump8 . Short.unpack
+
+
 data Enc
 data Mac
 
@@ -80,29 +88,31 @@
 data NotAuth
 
 newtype KeyAuthUse k =
-  KeyAuthUse ByteString
+  KeyAuthUse ShortByteString
   deriving Eq
 
 makeKeyAuthUse :: MonadPlus m => ByteString -> m (KeyAuthUse k)
 makeKeyAuthUse k = do
   guard $ BS.length k == 16
-  return $ KeyAuthUse k
+  return . KeyAuthUse $ Short.toShort k
 
 unKeyAuthUse :: KeyAuthUse k -> ByteString
-unKeyAuthUse (KeyAuthUse bs) = bs
+unKeyAuthUse (KeyAuthUse bs) = Short.fromShort bs
 
 newtype Derived k c =
-  Derived ByteString
+  Derived ShortByteString
   deriving Eq
 
 instance Show (Derived k c) where
-  show (Derived k) = unwords ["DerivedCipher", hdump k]
+  show (Derived k) = unwords ["DerivedCipher", hdump' k]
 
 unDerived :: Derived k c -> ByteString
-unDerived (Derived k) = k
+unDerived (Derived k) = Short.fromShort k
 
 kdf :: KeyAuthUse k -> UpdateC c -> Derived k c
-kdf (KeyAuthUse k) (UpdateC c) = Derived . B.convert $ chashGetBytes (mp $ k <> c :: MiyaguchiPreneel AES128)
+kdf k (UpdateC c) =
+  Derived . Short.toShort . B.convert
+  $ chashGetBytes (mp $ unKeyAuthUse k <> c :: MiyaguchiPreneel AES128)
 
 kdfEnc :: KeyAuthUse k -> Derived k Enc
 kdfEnc = (`kdf` keyUpdateEncC)
@@ -113,11 +123,11 @@
 newtype DerivedCipher k c = DerivedCipher AES128
 
 derivedCipher :: Derived k c -> DerivedCipher k c
-derivedCipher (Derived k) =
+derivedCipher k =
   DerivedCipher
   . either (error . ("Codec.Automotive.CSE.derivedCipher: internal error: " ++) . show) id
   -- assume refined length (16 byte) of miyaguchi-preneel AES128 result
-  . eitherCryptoError $ cipherInit k
+  . eitherCryptoError . cipherInit $ unDerived k
 
 type K1' = Derived Auth Enc
 type K1  = DerivedCipher Auth Enc
@@ -148,18 +158,18 @@
 makeK4 = kdfMac
 
 
-newtype UID = UID ByteString deriving (Eq, Ord)
+newtype UID = UID ShortByteString deriving (Eq, Ord)
 
 instance Show UID where
-  show (UID s) = unwords ["UID", hdump s]
+  show (UID s) = unwords ["UID", hdump' s]
 
 unUID :: UID -> ByteString
-unUID (UID u) = u
+unUID (UID u) = Short.fromShort u
 
 makeUID :: MonadPlus m => ByteString -> m UID
 makeUID s = do
   guard $ BS.length s == 15
-  return $ UID s
+  return . UID $ Short.toShort s
 
 newtype M1 = M1 ByteString deriving Eq
 
@@ -170,13 +180,13 @@
        -> Word8      -- ^ Key ID       -  4 bit
        -> Word8      -- ^ Auth key ID  -  4 bit
        -> M1
-makeM1 (UID uid) kid akid = M1 $ uid <> BS.singleton (kid `shiftL` 4 .|. akid)
+makeM1 uid kid akid = M1 $ unUID uid <> BS.singleton (kid `shiftL` 4 .|. akid)
 
 unM1 :: M1 -> ByteString
 unM1 (M1 m1) = m1
 
 extractM1 :: M1 -> (UID, Word8, Word8)
-extractM1 (M1 m1) = (UID uid, lw `shiftR` 4, lw .&. 0x0F)
+extractM1 (M1 m1) = (UID $ Short.toShort uid, lw `shiftR` 4, lw .&. 0x0F)
   where
     (uid, x) = BS.splitAt 15 m1
     lw = head $ BS.unpack x
@@ -192,7 +202,7 @@
        -> Word8              -- ^ Key Flag  -  6 bit
        -> KeyAuthUse NotAuth -- ^ Key Data for AES128
        -> M2
-makeM2 (DerivedCipher k1) counter flags (KeyAuthUse keyData) =
+makeM2 (DerivedCipher k1) counter flags keyData =
     M2 $ cbcEncrypt k1 nullIV plain
   where
     plain = (runPut $ do
@@ -201,7 +211,7 @@
                   fromIntegral flags `shiftL` 30
                   ---  fromIntegral (flags `shiftR` 1) `shiftL` 31  ---  SHE standard
                 putWord64be 0)
-            <> keyData
+            <> unKeyAuthUse keyData
 
 unM2 :: M2 -> ByteString
 unM2 (M2 m2) = m2