Dynamic Encrypted QR Authentication
Budget: ₹12,500 – ₹37,500 INR
I’m putting together a secure, time-sensitive QR authentication flow and need a developer who can own the full cryptographic side of it.
Here’s what I already have in mind: each QR must be signed with HMAC-SHA256, contain a UNIX timestamp, and rotate automatically every 5 seconds. Rotation is driven purely by elapsed time—no user tap or server ping should be required—so the moment five seconds are up the displayed code is invalid. The code will be scanned only from our mobile app, which then performs a short handshake with the web session to prove that both sides share the same secret. Once the timestamp has expired the backend must refuse any attempt to reuse that payload, blocking replay attacks completely.
What I need from you:
• A backend routine (Node, Python, or Go—your call) that produces the QR payload, signs it with HMAC-SHA256, and exposes it to the web front end.
• A verification endpoint that the mobile app can hit right after scanning to confirm the HMAC, timestamp window, and one-time-use status.
• Clear, concise documentation so my mobile team can integrate the scanning logic and handshake without guesswork.
Acceptance criteria
• QR refreshes every 5 seconds with no perceptible lag.
• Any QR older than its five-second window is rejected server-side.
• HMAC signature validates successfully only when the shared secret matches.
• All code passes a basic security review (no hard-coded secrets, no timing-attack vulnerabilities).
If this sounds straightforward to you and you have prior experience with time-based tokens or TOTP-style flows, let’s get it done.
Here’s what I already have in mind: each QR must be signed with HMAC-SHA256, contain a UNIX timestamp, and rotate automatically every 5 seconds. Rotation is driven purely by elapsed time—no user tap or server ping should be required—so the moment five seconds are up the displayed code is invalid. The code will be scanned only from our mobile app, which then performs a short handshake with the web session to prove that both sides share the same secret. Once the timestamp has expired the backend must refuse any attempt to reuse that payload, blocking replay attacks completely.
What I need from you:
• A backend routine (Node, Python, or Go—your call) that produces the QR payload, signs it with HMAC-SHA256, and exposes it to the web front end.
• A verification endpoint that the mobile app can hit right after scanning to confirm the HMAC, timestamp window, and one-time-use status.
• Clear, concise documentation so my mobile team can integrate the scanning logic and handshake without guesswork.
Acceptance criteria
• QR refreshes every 5 seconds with no perceptible lag.
• Any QR older than its five-second window is rejected server-side.
• HMAC signature validates successfully only when the shared secret matches.
• All code passes a basic security review (no hard-coded secrets, no timing-attack vulnerabilities).
If this sounds straightforward to you and you have prior experience with time-based tokens or TOTP-style flows, let’s get it done.