Secure QR Codes: Authenticity Verification via EdDSA Signatures and CBOR Certificates

Source: arXiv:2607.08383 · Published 2026-07-09 · By Wojciech Jonderko, Wojciech Wodo

TL;DR

This paper addresses the critical security vulnerability of QR codes known as "blind trust," where users cannot visually verify the authenticity or origin of a code, leading to attacks such as "quishing" (QR phishing). The authors present a novel secure QR code architecture using EdDSA signatures on the Ed25519 curve combined with compact CBOR-encoded certificates and ZLIB compression to achieve cryptographic integrity within the strict fixed capacity constraints of typical QR codes. They propose two complementary modes: a fully offline "Matryoshka" model embedding nested signatures and certificates entirely within the QR for air-gapped verification, and a scalable Hybrid Web PKI architecture that offloads the certificate chain to web-hosted JWKS endpoints for real-time verification and dynamic key revocation.

The offline proof-of-concept demonstrates that a robust chain of trust can be encoded into QR codes at lower versions (e.g., version 8-13) with high error correction, enabling straightforward scanning using standard smartphone cameras. However, they identify offline revocation and scaling challenges for large smart city deployments. To address this, their Hybrid Web PKI model maintains backward compatibility with native camera scanning by encoding a URL with a signature fragment and dynamically fetching authorized keys and revocation data from Central Trust Registries via standardized JWKS. This combination balances strong cryptographic guarantees with practical deployment constraints, providing a deployable path to eliminating QR spoofing in public infrastructures.

Key findings

• EdDSA (Ed25519) signatures and minimal CBOR certificates reduce QR cryptographic payload size to ~300 bytes, enabling secure codes in small QR versions (7-10) with High error correction (H, ~30%), suitable for robust public use.
• Offline verification of a nested signature and certificate chain ('Matryoshka' model) successfully fits within QR code version 8 (direct root trust) and version 13 (with delegated certificate chain), validated via custom Python toolchain scans and signature checks.
• Hybrid Web PKI approach offloads certificate storage to standardized JWKS endpoints hosted on issuer web domains, reducing QR code size to fit within version 6-8, improving scan reliability and enabling immediate key revocation in smart city deployments.
• Base64 encoding during proof-of-concept evaluation adds overhead; fully binary encoding in QR binary mode would improve efficiency and data density further.
• Operational key management separates the offline Root Private Key (stored securely offline or in HSM) from online application/device keys, allowing targeted revocation without compromising the entire hierarchy.
• Using ZLIB compression on CBOR payloads reduces data size by approximately 30% for text-based payloads, critical for fitting cryptographic data within QR capacity constraints.
• Embedding full X.509 certificates or RSA signatures exceeds QR capacities of lower versions (<20) and reduces scan reliability, confirming EdDSA + CBOR as a superior compact alternative.
• Verification follows a fail-fast logic: first, verify Root or Certificate chain, then validate validity period, finally verify payload signature, enabling trustworthy offline or online validation.

Threat model

Adversaries are attackers capable of physical tampering—overlaying, replacing, or generating fraudulent QR codes to redirect users to malicious sites (quishing). They may compromise individual edge device keys but cannot access or replicate the offline Root Private Key held securely offline or in HSMs. They also cannot compromise the root key hardcoded in verifying clients or forge signatures without detection. The model assumes attackers lack continuous network control to tamper with key distribution or revocation infrastructure, although DNS or web attacks against JWKS endpoints are acknowledged threats mitigated by root trust validation.

Methodology — deep read

The methodology is centered around securing QR codes via lightweight cryptographic proofs that fit within QR capacity constraints, balancing offline and online validation needs. Key steps include:

1. Threat Model and Assumptions: The adversary is capable of physically replacing or overlaying QR codes in public infrastructure to redirect users to malicious URLs (quishing). They may have compromised edge device keys but cannot compromise the offline Root Private Key, nor can they impersonate the Root without detection. The adversary does not have continuous internet access to update clients or push revocations offline.

2. Data and Payloads: The system encodes signed payloads (e.g., URLs, ticket IDs) in a compact binary format. The data includes payload, Ed25519 signature, and optionally, a lightweight CBOR-encoded certificate containing issuer ID, public key, and validity windows. Data is compressed with ZLIB to optimize size before QR encoding. Baseline payload sizes stay under 300 bytes to fit in versions 7-15 depending on mode.

3. Architecture and Algorithms: The dual PKI modes utilize the EdDSA signature scheme instantiated on the Ed25519 curve for all signatures. The offline "Matryoshka" model nests payload, payload signature, CBOR certificate, and root signature within a compressed binary structure, enabling full chain verification without network calls.

The certificate structure is custom CBOR, including issuer, subject, validity times, and app public key, signed by the root. In Hybrid mode, only a URL with a signature fragment and key ID are embedded; certificate retrieval and chain validation occur online via standardized JWKS JSON endpoints, keeping the static QR small.

4. Training Regime: Not applicable; the cryptographic operations use standard Ed25519 schemes with Python cryptography libraries.

5. Evaluation Protocol: Verification tests used a custom Python toolchain to create and decode QR codes, verifying signatures offline for Matryoshka mode and via simulated JWKS fetch for Hybrid mode. QR versions between 6-13 were tested. Verification steps follow strict fail-fast logic including signature validation, certificate period checks, and trusted root confirmation. Terminal outputs and QR images demonstrate practical generation and scanning.

6. Reproducibility: The authors provide open-source Python scripts for key management, QR code creation, and verification on GitHub, enabling straightforward reproduction. Datasets are not public as this is a cryptography methodology paper rather than empirical dataset study.

Example end-to-end offline flow (Scenario 2): The issuer generates a payload and signs it with its private key. The issuer’s CBOR certificate, signed by the root key, is embedded alongside. The combined CBOR object is ZLIB compressed and Base64 encoded, then rendered into a version 13 QR code. A verifying app scans, decompresses, extracts the CBOR, verifies the root signature on the cert, checks validity dates, uses app public key to verify payload signature, and finally displays verified content. This verifies origin and integrity without any online communication.

Technical innovations

• Use of EdDSA (Ed25519) signatures combined with tightly packed CBOR certificates and ZLIB compression to fit a full cryptographic chain-of-trust inside standard QR code capacity limits.
• Design of a nested 'Matryoshka' cryptographic container model encapsulating payload, signature, certificate, and root signature in a compact binary format for offline verification.
• Introduction of a hybrid online/offline architecture leveraging standardized Web PKI infrastructure (JWKS endpoints and Central Trust Registries) for scalable, real-time key revocation while maintaining compatibility with native camera scanning.
• Operational separation of root offline keys and online application keys enabling hierarchical trust delegation and localized certificate revocation without invalidating the entire system.

Baselines vs proposed

• RSA-2048 based QR package: total payload ~1600-1800 bytes requiring QR version 25+ vs EdDSA+CBOR solution at ~300 bytes fitting within version 7-13 with high error correction.
• ECDSA (P-256) with X.509 certificates: total payload ~750-1000 bytes fitting medium QR versions vs EdDSA+CBOR at ~300 bytes fitting smaller, easier to scan QR codes.
• Offline QR code version 8 with direct root trust vs version 13 for delegated trust chain embedding, successfully verified in terminal with custom toolchain.

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.08383.

Fig 1: Anatomy of a QR Code symbol showing functional patterns, including

Fig 2: Logical structure of the ”Matryoshka” model in Scenario 2. The entire

Fig 3: Terminal output demonstrating the Scenario 1 generation process:

Fig 4: Scenario 1: Secure QR Code using Direct Trust. The low density

Fig 5: Terminal output demonstrating the Scenario 1 verification process:

Fig 6: Terminal output demonstrating the Scenario 2 generation process:

Fig 7: Scenario 2: Secure QR Code using a Certificate Chain. Increased

Fig 8: Terminal output demonstrating the Scenario 2 verification process:

Limitations

• Fully offline model does not support immediate key revocation, requiring distributed CRLs pushed to all verifying apps, which is impractical at scale.
• Embedding full certificate chains increases QR code density and reduces scanning reliability, limiting use to medium or higher QR versions (≥13).
• Proof-of-concept implementation uses Base64-encoding for broad library compatibility which adds size overhead; binary mode alone would improve efficiency.
• The Hybrid Web PKI model relies on network connectivity, caching, and secure access to issuer JWKS endpoints; availability or network attacks could impact verification.
• No active adversarial evaluation presented against attempts to spoof or tamper with the web-hosted certificate registry or DNS spoofing attacks; mitigation depends on trust anchor hardcoding.
• Code released but no frozen weights or formal security proofs; real-world deployment may expose implementation or operational complexities.

Open questions / follow-ons

• How to efficiently distribute and update Certificate Revocation Lists (CRLs) to offline verifiers at scale without network connectivity?
• How resilient is the Hybrid Web PKI model to network-level attacks such as DNS spoofing or man-in-the-middle attacks intercepting JWKS fetches?
• Can further compression or coding optimizations reduce cryptographic payload size to fit full certificate chains into even smaller QR versions while maintaining high error correction?
• How would this system perform under adversarial QR code forgery attempts or deliberate physical QR degradation in real deployment environments?

Why it matters for bot defense

For bot-defense and CAPTCHA practitioners, this work offers a cryptographic method for authenticating QR codes embedded in public-facing, physical or digital authentication challenges. The demonstrated balance between cryptographic security, offline verification capability, and efficient encoding within limited QR capacity directly addresses the usability-security tradeoff critical to CAPTCHA design. The dual-mode offline and hybrid online validation approach allows scalable deployment where instant revocation or real-time issuer status checking is paramount, such as in smart city scenarios or payment terminals. However, solutions must consider the operational complexity of key management, certificate distribution, and network reliability for hybrid verification. From a bot-defense perspective, embedding cryptographic proof of authenticity inside QR challenges reduces spoofing risk and strengthens trust without requiring user cryptographic knowledge. These insights could inform next-generation CAPTCHA systems that use verified QR codes as human interaction tokens or proofs of legitimacy.

Cite

@article{arxiv2607_08383,
  title={ Secure QR Codes: Authenticity Verification via EdDSA Signatures and CBOR Certificates },
  author={ Wojciech Jonderko and Wojciech Wodo },
  journal={arXiv preprint arXiv:2607.08383},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.08383}
}

Read the full paper

• arXiv:2607.08383 (abstract)
• arXiv:2607.08383 (PDF)