I want to be able to verify the authenticity of a QR code text without internet connection.
Let's say I have a peanut butter store, and I have an online store too. After purchasing at my online store the customer will be given a QR code. They print that QR code and bring it to my actual store, which doesn't have internet connection, and by scanning the QR code with my mobile app I will give them the amount they have purchased.
The QR code plain text will be something like : "John, Doe, 3 jars". Upon scanning this I will give John Doe 3 jars of peanut butter.
Now as far as I know the conventional method for this is to sign the message. But that adds a lot of overhead because I will have to generate the QR code for plaintext+signature. QR codes size is very limited and my messages are very short. So any performance consideration about hashing the message and encrypting that hash are of no importance. While ciphertext size is very important.
So I was thinking, is there any security flaw if I just encrypt the message instead of signing it? If I can decrypt the message in my offline store it means it has really come from my online store and that it has not been tampered with. This way I will avoid the size overhead of signatures, since my messages are not much longer than an SHA-256 hash themselves.
Here's the steps that will be performed:
In online store's web application:
- create a text message that says a certain customer has purchased a certain amount of peanut butter
- encrypt the message with my private/public key
- convert to base64 and generate QR code
In actual store:
- scan QR code and base64 decode
- decrypt the message with my public/private key
- if I'm able to decrypt the message it means the message is authentic and I will give the customer the amount of peanut butter specified in the QR code
Currently I've been able to successfully perform these steps with ECIES encryption in Java. I was just wondering if this is secure. I chose ECIES because after some research I figured it produces small sized cipher text. And I'm using "secp192r1" keys as a compromise between ciphertext size and key security.
Also I want the encryption to be asymmetric, because for security reasons I don't want to hard code my symmetric key into the mobile app.
This is not an actual work project, but it's something that's always been on my mind and I want to be able to do this in a real project if need arises.