Skip to main content
Tweeted twitter.com/#!/StackSecurity/status/541480286119546880
deleted 14 characters in body
Source Link
user61429
user61429

I am developing a system to prevent frauds in tickets.

What do I need?

  1. An algorithm to generate a QR Code that will be shown to my clients in a ticket.

Ticket

  1. An algorithm to validate (offline) the QR Code, using the user's smartphone (Android or iOS).

App

I would like to start by saying that I know nothing about cryptography, but I did read a few articles about asymmetric encryption.

What did I learn?

With the public key, I can create cypher texts.
With the private key, I can decrypt the cypher texts.

The regular scenario is to keep the private-key private, and the public-key public. Right?

My question is, to achieve what I need, can I invert this process?

Keeping the private key in the app (anyone can tamper the key, but it would be useless), and keeping the public key private (in the server).

I am calling it "inverted" asymmetric encryption.

Why? With the public key I will create the QR Code with the ticket code, and if no one else have my public key, I believe no one can create QR Codes similar to mine, then hard to fake.

Using the smartphone, my client could use my mobile app with the private key to decrypt the text inside the QR Code, and if it could not be decrypted the app would say that the ticket is fake.

Is this assumptions correct and is this method secure?
Stealing the private key (tampering it from the app), can an attacker generate cypher texts like with the public key?

EDITED

I am developing a system to prevent frauds in tickets.

What do I need?

  1. An algorithm to generate a QR Code that will be shown to my clients in a ticket.

Ticket

  1. An algorithm to validate (offline) the QR Code, using the user's smartphone (Android or iOS).

App

I would like to start by saying that I know nothing about cryptography, but I did read a few articles about asymmetric encryption.

What did I learn?

With the public key, I can create cypher texts.
With the private key, I can decrypt the cypher texts.

The regular scenario is to keep the private-key private, and the public-key public. Right?

My question is, to achieve what I need, can I invert this process?

Keeping the private key in the app (anyone can tamper the key, but it would be useless), and keeping the public key private (in the server).

I am calling it "inverted" asymmetric encryption.

Why? With the public key I will create the QR Code with the ticket code, and if no one else have my public key, I believe no one can create QR Codes similar to mine, then hard to fake.

Using the smartphone, my client could use my mobile app with the private key to decrypt the text inside the QR Code, and if it could not be decrypted the app would say that the ticket is fake.

Is this assumptions correct and is this method secure?
Stealing the private key (tampering it from the app), can an attacker generate cypher texts like with the public key?

EDITED

I am developing a system to prevent frauds in tickets.

What do I need?

  1. An algorithm to generate a QR Code that will be shown to my clients in a ticket.

Ticket

  1. An algorithm to validate (offline) the QR Code, using the user's smartphone (Android or iOS).

App

I would like to start by saying that I know nothing about cryptography, but I did read a few articles about asymmetric encryption.

What did I learn?

With the public key, I can create cypher texts.
With the private key, I can decrypt the cypher texts.

The regular scenario is to keep the private-key private, and the public-key public. Right?

My question is, to achieve what I need, can I invert this process?

Keeping the private key in the app (anyone can tamper the key, but it would be useless), and keeping the public key private (in the server).

I am calling it "inverted" asymmetric encryption.

Why? With the public key I will create the QR Code with the ticket code, and if no one else have my public key, I believe no one can create QR Codes similar to mine, then hard to fake.

Using the smartphone, my client could use my mobile app with the private key to decrypt the text inside the QR Code, and if it could not be decrypted the app would say that the ticket is fake.

Is this assumptions correct and is this method secure?
Stealing the private key (tampering it from the app), can an attacker generate cypher texts like with the public key?

edited title
Source Link
user61429
user61429

I am developing a system to prevent frauds in tickets.

What do I need?

  1. An algorithm to generate a QR Code that will be shown to my clients in a ticket.

Ticket

  1. An algorithm to validate (offline) the QR Code, using the user's smartphone (Android or iOS).

App

I would like to start by saying that I know nothing about cryptography, but I did read a few articles about asymmetric encryption.

What did I learn?

With the public key, I can create cypher texts.
With the private key, I can decrypt thisthe cypher texts.

The regular scenario is to keep the private key-key private, and the public key-key public. Right?

My question is, to achieve what I need, can I invert it ("inverted asymmetric encryption")this process?

Keeping the private key in the Appapp (anyone can tamper the key, but it would be useless), and keeping the public key private (in the server).

I am calling it "inverted" asymmetric encryption.

Why? With the public key I will create the QR Code with the ticket code, and if no one else have my public key, I believe no one couldcan create QR Codes similar to mine, then hard to fake.

Using the smartphone, my client wouldcould use my Appmobile app with the private key to decrypt the text inside the QR Code, and if it could not be decrypted the app would say that the ticket is fake.

Is this assumptionassumptions correct and is this method secure?
Stealing the private key (tampering it from the app), can an attacker generate cypher texts like with the public key?

EDITED

I am developing a system to prevent frauds in tickets.

What do I need?

  1. An algorithm to generate a QR Code that will be shown to my clients in a ticket.

Ticket

  1. An algorithm to validate (offline) the QR Code, using the user's smartphone (Android or iOS).

App

I would like to start by saying that I know nothing about cryptography, but I did read a few articles about asymmetric encryption.

What did I learn?

With the public key, I can create cypher texts.
With the private key, I can decrypt this texts.

The regular scenario is to keep the private key private, and the public key public. Right?

My question is, to achieve what I need, can I invert it ("inverted asymmetric encryption")?

Keeping the private key in the App (anyone can tamper the key, but it would be useless), and keeping the public key private (in the server).

Why? With the public key I will create the QR Code with the ticket code, and if no one else have my public key, I believe no one could create QR Codes similar to mine, then hard to fake.

Using the smartphone, my client would use my App with the private key to decrypt the text inside the QR Code, and if it could not be decrypted the app would say that the ticket is fake.

Is this assumption correct and is this method secure?
Stealing the private key (tampering it from the app), can an attacker generate cypher texts like with the public key?

I am developing a system to prevent frauds in tickets.

What do I need?

  1. An algorithm to generate a QR Code that will be shown to my clients in a ticket.

Ticket

  1. An algorithm to validate (offline) the QR Code, using the user's smartphone (Android or iOS).

App

I would like to start by saying that I know nothing about cryptography, but I did read a few articles about asymmetric encryption.

What did I learn?

With the public key, I can create cypher texts.
With the private key, I can decrypt the cypher texts.

The regular scenario is to keep the private-key private, and the public-key public. Right?

My question is, to achieve what I need, can I invert this process?

Keeping the private key in the app (anyone can tamper the key, but it would be useless), and keeping the public key private (in the server).

I am calling it "inverted" asymmetric encryption.

Why? With the public key I will create the QR Code with the ticket code, and if no one else have my public key, I believe no one can create QR Codes similar to mine, then hard to fake.

Using the smartphone, my client could use my mobile app with the private key to decrypt the text inside the QR Code, and if it could not be decrypted the app would say that the ticket is fake.

Is this assumptions correct and is this method secure?
Stealing the private key (tampering it from the app), can an attacker generate cypher texts like with the public key?

EDITED

edited title
Link
user61429
user61429

Inverted "Inverted" asymmetric encryption

[Edit removed during grace period]
Source Link
user61429
user61429
Loading
Source Link
user61429
user61429
Loading