We have an old system using the following algorithm related to authentication:
- input: a fixed format integer (hex):
- user-id: 4 bytes
- device-id: 4 bytes
- algorithm: textbook RSA 2048, sign with (N, d).
and assumes that an attacker can request limited times (5 times per account per day) with arbitrary
device-ids, or try with different
- sign with (N, d), not (d, e), already updated above;
- the background is, logged-in users can apply for usage of a device, if the device is not in use, the user will get a QR code containing the info of the signature. The device will check it (
device-id), if succeeded, the device will unlock automatically.
Question: is it possible that an attacker without login can generate a QR code to unlock any device (
device-id is right on the device, and is a random number each time)?
by the way, the device does not deserve much cost. We consider it is not safe when there is an easily-adopted hacking method. And also ignore the case that one can
remember the corresponding QR code.