search

admin-ch / CovidCertificate-Apidoc

API documentation for the integration of primary systems with the machine to machine API
72 stars 7 forks source link

QRCode #12

Open ghost opened 3 years ago

ghost commented 3 years ago

Better use a digitally signed pdf and not a image. An image can later be manipulated.

ypiguet-epfl commented 3 years ago

My understanding is that it's the QR code message itself which is signed ("tamper-proof signed QRCode"), not its visual rendering or PDF container. There is no much gain to stack signatures. The purpose of the QR code is to be scanned in a standard way and only the message data, after error correction, to be used (digital signature checked or validation by some central database).

ghost commented 3 years ago

I think the spec need to be improved to really make sure that no image on a device is arround that could be captured for manipulation.