I am developing a system to prevent frauds in tickets.
What do I need?
- An algorithm to generate a QR Code that will be shown to my clients in a ticket.
- An algorithm to validate (offline) the QR Code, using the user's smartphone (Android or iOS).
I would like to start by saying that I know nothing about cryptography, but I did read a few articles about asymmetric encryption.
What did I learn?
With the public key, I can create cypher texts.
With the private key, I can decrypt the cypher texts.
The regular scenario is to keep the private-key private, and the public-key public. Right?
My question is, to achieve what I need, can I invert this process?
Keeping the private key in the app (anyone can tamper the key, but it would be useless), and keeping the public key private (in the server).
I am calling it "inverted" asymmetric encryption.
Why? With the public key I will create the QR Code with the ticket code, and if no one else have my public key, I believe no one can create QR Codes similar to mine, then hard to fake.
Using the smartphone, my client could use my mobile app with the private key to decrypt the text inside the QR Code, and if it could not be decrypted the app would say that the ticket is fake.
Is this assumptions correct and is this method secure?
Stealing the private key (tampering it from the app), can an attacker generate cypher texts like with the public key?