0

I have to build a system that will ultimately print a pass allowing access to a building. The validation of this ticket will be done manually (it can also be automatic but that's not likely at this stage). There is the chance that the person checking does not have access to a computer to validate it.

The idea is to print some recognizable pattern for the day.

I started thinking about an hash, but that wouldn't work. So I thought of some symmetric cryptography where the key would generate different patterns. But that doesn't make much sense either.

The only request is that the person that checks the pattern can recognize it. This pattern would change in a daily or weekly basis.

I know these would be subject of replay attacks, but for now this would be enough.

  • 1
    This kind of system would never work well. I have had the "pleasure" of using a regional bus operator in London that had a "bright" idea to create a smartphone app that displays the "color of the day" to prove that you've purchased a ticket covering the day. These are very unpleasant to use. – Lie Ryan Jun 1 '15 at 12:50
  • 1
    Daily printed paper pass is also going to be a logistical and security nightmare. What you'll bound to see is a lot of people will dispose their passes in bins near the entrance or just drop it around the floor as people are likely less careful about losing a daily piece of paper than with a permanent pass. Also consider the economical and ecological cost of printing passes for a building full of people everyday. – Lie Ryan Jun 1 '15 at 13:13
  • @LieRyan I am not concerned with the logistical problem. Persons will be able to print it themselves. In the future they will probably be allowed to use their mobile even to solve the paper issue. – nsn Jun 1 '15 at 13:52
  • 1
    Persons will be able to print it themselves. that just makes the logistical issues even worse. How many people do you think would be thrilled to be forced to print passes everyday? How many would forget to print their pass? How many people don't have printers at home? How would you have to use up an entire A4 page to communicate a small image? This is not very secure anyway, intruders only need to steal one pass, which wouldn't be very hard given the circumstances. Usability is part of security system. If a security system is not usable, it's useless. – Lie Ryan Jun 1 '15 at 14:21
  • 2
    @LieRyan Easy there. In your rant about why this sucks, you're making a lot of assumptions about how this system will work, which are not in the question. The OP said "I am not concerned with the logistical problem", which means that they are intentionally omitting details and may have a valid reason for doing it this way. So let's stick to the facts of the question, rather than raging about similar systems that you've seen. – Mike Ounsworth Jun 1 '15 at 15:05
4

I'm going to ignore the horrible usability issue in this answer and just focus on the title question here.

--

One idea is to generate a visual fingerprint like OpenSSH visual fingerprint. OpenSSH Visual fingerprints produce blotch of ASCII characters that are supposedly somewhat memorable can be quickly compared visually.

If you want to be slightly fancy, there's the Aestheticode. Aestheticodes like Penguin Barcode can be scanned, is distinctive and aesthetically pleasing, and is fairly easy to visually compare without a machine. Problem is that aestheticode are short and most aestheticode are generated manually; you'll need to be able to procedurally generate these images if you're going to do this everyday.

  • 1
    Thanks for the input. Regarding the system, you're making too many assumptions. I never implied that every person would need to print this every day of their life. – nsn Jun 1 '15 at 15:09
2

There is a trivial answer: decide of a daily password, print it on a pass and you have exactly the system you're describing: a "pattern" that is printed on a physical medium, that can be check by a human being without any extra device or hardware.

If you're willing to rfelax requirement a bit, there is a technique called "visual cryptography" that does something a bit similar but that also requires the person performing the validation to have access to a specific piece of hardware (in this case, a transparent mask which - which can be printed whenever needed).

The Wikipedia article linked has a good, simple example of such an algorythm:

There is a simple algorithm for binary (black and white) visual cryptography that creates 2 encrypted images from an original unencrypted image. The algorithm is as follows: First create an image of random pixels the same size and shape as the original image. Next, create a second image the same size and shape as the first, but where a pixel of the original image is the same as the corresponding pixel in the first encrypted image, set the same pixel of the second encrypted image to the opposite color. Where a pixel of the original image is different than the corresponding pixel in the first encrypted image, set the same pixel of the second encrypted image to the same color as the corresponding pixel of the first encrypted image. The two apparently random images can now be combined using an exclusive-or (XOR) to re-create the original image.

This simple technique has several disadvantages, however: first, anyone having access to a valid access pass can reproduce it very easily, even without understanding the code. second, you need to roll out the validation mask to everyone each time you generate a new access password. Third, all access are equivalent.

There are more advances algorythm that are more flexible (for instance, that will use a single mask to generate a different output depending on th input which, in turn could be used for discriminating between different access rights or simple making each access pass unique).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.