Secure QR Codes: Authenticity Verification via EdDSA Signatures and CBOR Certificates

2026-07-09

AI Summary

This work addresses the vulnerability of QR codes to forgery attacks—such as quishing—due to their lack of inherent security mechanisms, particularly in self-service terminal scenarios. The authors propose a dual-mode secure QR code architecture: a fully offline scheme leveraging EdDSA signatures, CBOR-encoded certificates, and ZLIB compression; and a hybrid Web PKI model integrating JWKS endpoints, a centralized trust registry, and URL fragments to support both offline verification and online dynamic validation. Notably, this is the first approach to embed Ed25519 signatures and CBOR certificates within standard QR code capacity limits, providing strong cryptographic integrity while enabling real-time key revocation, backward compatibility, and native camera scanning. The solution effectively mitigates forgery threats and resolves scalability challenges in large-scale IoT deployments.

Abstract

QR codes are a ubiquitous part of daily life, widely trusted by millions. However, their lack of inherent security features has given rise to critical attack vectors, such as spoofing (quishing) on public infrastructure like self-service parking machines. To address this, we present a comprehensive evolution of secure QR code architectures. First, we evaluate a fully offline proof-of-concept leveraging EdDSA signatures (instantiated on the Ed25519 curve), CBOR-encoded certificates, and ZLIB compression, demonstrating that robust cryptographic integrity can be achieved within the QR code's strict static capacity. However, recognizing the scalability limitations of fully offline models-specifically the inability to perform immediate key revocation in massive smart-city IoT deployments-we subsequently propose a scalable Hybrid Web PKI architecture. This forward-looking model utilizes standardized JWKS endpoints, a Central Trust Registry, and URL fragments to ensure seamless backward compatibility with standard native cameras while providing dynamic, real-time validation for compliant applications. This dual-mode approach offers a practical, deployable path toward eliminating QR spoofing.

Problem

• QR code security
• spoofing
• authenticity verification
• quishing
• trust

Innovation

• EdDSA signatures
• CBOR certificates
• Hybrid Web PKI
• QR code security
• key revocation