So, a while back I blogged an idea I had about cryptographically signing various documents. I specifically talked about checks, but you can apply the principle anytime you have a fairly small amount of data which is supposed to be issued from a trusted source: cashier’s checks, money orders, driver’s licenses, event tickets, passports, boarding passes, etc.
Well, I spent some time playing around and put together a working example. It’s not fancy, but it does the job. It’s been a few months, but it really didn’t take that long. Especially since I had to do some reading about QR codes and using them, along with public-key cryptography, from Python. So I had a basic prototype done in about a week. Then back in August I decided to flesh things out a bit more and produce a nice demo application. I’m calling the system “PaperTrust” as it allows you to embed the trust element onto the paper item.
Here’s a video demonstration:
Text description of the demo:
So, in my demo, we generate data for a cashier’s check and then sign it using the demo private key. We stick the signed data (which includes a signing-organization ID) and the signature into a QR code and stick that onto the check and print it. Now the check is physical and can be carried around as usual.
Now say you’re going to use this check to pay for something from a stranger. This stranger needs to know they can trust the check. So they use their verifier application to scan the QR code from your check. It reads the organization ID, looks up the correct public key for that organization, and verifies that the signature is valid. It also displays the signed data so the person can compare it to what’s physically printed on the check. This is a cryptographically secure guarantee that the check is valid (or at worst an exact copy of a real check, which should make tracking down counterfeiters a lot easier). So you would use this in tandem with traditional anti-forgery measures like watermarks, micro-print, thermal ink, etc.
I’ve put the code up on GitHub: PaperTrust on GitHub.
