I'm working on an device that will have its own keypair to sign data that it acquires. The public key will be signed with a provisioning key to ensure authenticity of the device. I want to put the public key in a QR code printed on the device, as well as the signature by the provisioning key. If I use a regular X509 certificate structure the barcode gets really huge. Are there any pitfalls or really good reasons not to just put the public key and signature - base64 encoded - instead?
1 Answer
$\begingroup$
$\endgroup$
X509 certificates contain a lot of additional (management) data that is required to manage the PKI. If you do not require interoperability, you do not need this extensive structure. However, you might want to go through the basic fields of an X509 certificate and think over if you really do not need each of these fields. E.g., you might want the ID of the device signed together with the public key. You also might want a validity period assigned to a key pair and so on. You could also have a look at WAP or CVC certificates. These are more compact than X509 certs.
