So I'm making an Android application, I need my application to be only able to scan my own generated QR codes, and I want to make sure that nobody else can generate fake ones.
The data isn't sensitive, it's very okay to be read by anyone, and even be in plaintext.
The problem comes is that, I need to verify the source of the QR code, I've been suggested to digitally sign it, thus, I have my private key, and I ship my application with a public key, and the application then uses the public key to check the QR code
Some of the things I don't get:
- Am I encrypting the whole message using the private key? or I just generate some separate signature that sits next to me message?
- As far as I know, with RSA, for example, everytime I encrypt a message, a new private and public key are generated, right? So how is the application going to verify/decrypt the message if the public key is constantly changing per QR code?
Simply said:
My QR code data are something like:
{"a": 1, "b": 2, "c": 3}
And I want my application to make sure that this data comes from an authorized source, and not generated by anyone else.