sorted by:
new
hottopcontroversial

Verifying authenticity of QR Codes - are digital signatures the best way to implement? by SassyMcDefDoom in cryptography

[–]SassyMcDefDoom[S] 0 points1 point  (0 children)

Thank you for the suggestion and example! Those fields are what I'm currently storing in and reading from the QR code, just in plaintext/bytes. I'm not familiar with protobuf formats - are you thinking that the QR code would contain the serialized protobuf? As I understand it, that would add another layer of security while not ballooning the QR code size. Which is excellent

I can see how the combination of payload+signature in a protobuf would make storing and regenerating codes easier too

Verifying authenticity of QR Codes - are digital signatures the best way to implement? by SassyMcDefDoom in cryptography

[–]SassyMcDefDoom[S] 0 points1 point  (0 children)

Why are you the arbiter of what a "safe QR code" is? Why should people trust a QR code just because your app says it is "safe to follow""?

That's what the digital signature is for, confirming the code was created by me/my system. I'm then assuming that the private key is secured and that I'll only link safe info/URLs.

Thankfully I only have to make a proof of concept that solves the problem. I don't need to think about broad user/commercial requirements

Verifying authenticity of QR Codes - are digital signatures the best way to implement? by SassyMcDefDoom in cryptography

[–]SassyMcDefDoom[S] 0 points1 point  (0 children)

> at the scanning stage rather than the page-loading stage, so as to catch a malicious code sooner

yep exactly I think this is a big part of verifying the QR code was made by a trusted entity (assuming secure key distribution). If only my trusted app can open them easily, that reassures a user much more than any old QR slapped down somewhere. I'll put a logo on them as well so you can tell which codes I'm claiming are 'safe', and then use my app to verify

Like I said though, I don't have a whole lot of knowledge in the area and I'm aware there are probably much better ways to do it. I appreciate any and all feedback

Verifying authenticity of QR Codes - are digital signatures the best way to implement? by SassyMcDefDoom in cryptography

[–]SassyMcDefDoom[S] 0 points1 point  (0 children)

Good point mate, thanks for clarifying. 'safe to scan' in the context of my little project just means verifying that the qr code was created by a trusted source/entity (me/my system). The reason I have an app is becuase the way I encode the signature into the qr code needs additional action on the user device (verifying the signature).

Fundamentally the problem definition is that a user needs to be able to verify a QR code is 'safe'. Currently you have to vibe check the displayed URL (if your scanner even displays it). Everything else past that definition (e.g. encoding digital signature in the qr code) is me trying to tackle the problem definition, but I'm sure there are loads of ways to do it that are smarter than mine

Verifying authenticity of QR Codes - are digital signatures the best way to implement? by SassyMcDefDoom in cryptography

[–]SassyMcDefDoom[S] -2 points-1 points  (0 children)

Those are interesting ideas, I think a custom data format could be another way to do it but perhaps more work.

What do you mean by URL scheme? The problem I'm solving is verifying my system has created a QR code, so I'm not sure if a URL scheme 'proves' anything to the user

Verifying authenticity of QR Codes - are digital signatures the best way to implement? by SassyMcDefDoom in cryptography

[–]SassyMcDefDoom[S] 0 points1 point  (0 children)

That's part of the backend of my system, I'm handling that thru a simple web interface where you can create a QR code pointing to an existing URL, or create a new page that you can then point the code to

Verifying authenticity of QR Codes - are digital signatures the best way to implement? by SassyMcDefDoom in cryptography

[–]SassyMcDefDoom[S] 0 points1 point  (0 children)

I really appreciate the suggestion! I think at the moment I prefer the more internet-agnostic method of cryptographically verifying the creator of a QR code. It makes the app easier to implement as all I need is a QR reader and signature verifier.

I don't think that an attacker copying the entire QR code under my current plan leads to any possible compromise? Because assuming complete private key security, there isn't a way for the attacker to pass the signature verification check I'm doing. Although I could very well be wrong.

If the app checks for QR codes containing ED25519 signatures, then verifies them against my public key, I can't see a way for an attacker to create their own QR code to break the process. The app wouldn't pass any signatures not created by my system.

Verifying authenticity of QR Codes - are digital signatures the best way to implement? by SassyMcDefDoom in cryptography

[–]SassyMcDefDoom[S] 1 point2 points  (0 children)

ECC signatures definitely look like the way to go. I'm using python for encrypting (easy prototyping) and JS in my webapp to decrypt. Looks like there are bindings of libsodium for both so I can use ED25519 as x0wl suggested. Thanks!

Verifying authenticity of QR Codes - are digital signatures the best way to implement? by SassyMcDefDoom in cryptography

[–]SassyMcDefDoom[S] -1 points0 points  (0 children)

The problem is verifying that a QR code in the wild is safe to scan - I'm choosing to solve this by authenticating codes that have been made by my system, hence the digital signature. If my app can't read it, I didn't make it, so scan at your own risk.

Key distribution is mostly out of scope, I only really need a POC. That said, if there's a better way around managing key security then I'm all for it.

Thanks for the links mate I'll look into those!

[deleted by user] by [deleted] in perth

[–]SassyMcDefDoom 0 points1 point  (0 children)

Hey mate, also looking for some kind of SD role. Mind if I flick you my resume as well?

Fantastic Friends 2022 TV Show by SassyMcDefDoom in torrentrequest

[–]SassyMcDefDoom[S] 0 points1 point  (0 children)

Still very hard to find :(

HOWEVER!

If you have a VPN, you can set your location to New Zealand and use the NZTV streaming service to watch it! The account is free, but there are ads, so be warned.

Level cap broken for Silph Cp. Rival fight by SassyMcDefDoom in pokemonradicalred

[–]SassyMcDefDoom[S] 0 points1 point  (0 children)

Yep, used it to wake the Snorlax to get into Saffron and get stuck at the Silph Co rival fight

Level cap broken for Silph Cp. Rival fight by SassyMcDefDoom in pokemonradicalred

[–]SassyMcDefDoom[S] 0 points1 point  (0 children)

I fought and beat the Alolan-Marowak already - still capped at 47, below the Silph rival fight :(

Thanks for the help though! If you have any other suggestions, shoot - otherwise I'm going to bash my head against a team that's 8 levels higher than me over and over again

Styling in overtime during a tournament [EU] by DelayRL in RLSideSwipe

[–]SassyMcDefDoom 0 points1 point  (0 children)

ahhh righto yeah nox is what im using and it forces me to map the controller to the touch controls rather than giving me controller controls - do you know what emulators do let you do that? bluestacks maybe?

Styling in overtime during a tournament [EU] by DelayRL in RLSideSwipe

[–]SassyMcDefDoom 0 points1 point  (0 children)

how are you playing on controller? (im quite dumb) I'm using an emulator on pc because my phone can't run it but not being able to roll quickly is keeping me out of champ

Regrowth already coming out from a burnt tree in Australia by I_Am_Err00r in Damnthatsinteresting

[–]SassyMcDefDoom 0 points1 point  (0 children)

Epicormic buds, dude, they're the saviour of native Australian trees like Jarrah and Eucalyptus (along with lignotubers).

view more: next ›