Home/ Questions/Q 8148093
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-06T14:34:47+00:00

I have been reading a lot about QR codes and how the code itself

  • 0

I have been reading a lot about QR codes and how the code itself can lead to serious security risks. But one thing that I did not come across is the following.

In the following scenario:
I have a QR code which displays some of my data lets say:
– Name
– Address
– A list of things I’m allowed to do

And I scans my code to see its contents, add some stuf to the list of things that I’m allowed to do and reprint the QR code.
The next day I come to work scan my code and am allowed to do the extra thing I added to the code.

My question is: how can I stop this scenario from happening.
Note that it is not possible to check if my data is consistent with DataBase data.

More info:

I’m using phonegap in combination with Sencha Touch 2 to create my QR code reader.
It is an Android application designed only for Android 4.0 devices.
The QR codes are provided once a year.
If someone would scan his QR code of last year it would not work.
Note that: in theory if he’d change the date on the code that he would be able to get in, this is exactly what I’m trying to block.
Some employees have access to the application which reads the code.
The application does not have any way to verify the data on the QR code, so it has to be something using only the data on the QR code.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Sign the QR code data with a private key. The readers will need the public key to verify the QR code, but the public key need not be kept secret.

    If you use an ECDSA Secp256K1 key, the signature will only add about 68 bytes to the QR code data.

    Include the date of issue in the QR code as well. The reader will need a local clock to check that the QR code isn’t too old. If the reader doesn’t have a clock, you can at least keep track of the newest valid code you have ever seen. Any code issued more than a year before that date is definitely invalid.

    Both BouncyCastle and OpenSSL contain implementations of the code you’ll need.

    If it’s okay for the code readers/verifiers to contain all the information needed to generate a fake QR code, then you can use HMAC instead of ECDSA. That’s simpler and an HMAC can be as little as 16-bytes and still do the job.

    • 0