Implementation of Advanced Encryption Standard (AES) and QR Code Algorithm on Digital Legalization System

. A certificate is an important document that its validity must be ascertained. Fraud over the originality of this document demands a high level of security to ensure that this document is genuine. The Digital Certificate Legalization system (DCL) can regulate and guarantee the mechanism of document validity procedure. By implementing AES and QR Code algorithm, the information contained in the photo-scan of the certificate can be authenticated. The results of the scan are encrypted by using the legalized code in AES Algorithm. The code will be translated using the QR Code and matched to the data contained in the server system. The system will confirm whether the certificate is original or not. In order to test the system, black box testing is applied for functionality check; capacity testing in terms of execution time and memory load of benchmark testing are also examined for system performance measurement. Finally, user response testing is conducted to identify the user acceptance towards the system. As the result, the implementation of AES and QR Code algorithm provides good performance, efficient, light, and fast execution responses (less than one second and less than one megabyte) in a legalized certification checking system.


Introduction
One of the requirements for the job application is a legalized copy of the certificate. The problem may arise due to the limited number of the copied certificates, the numbers of applicants, and the limited time and place. Moreover, fraud or plagiarism on the original documents became an issue in the academic world [1]. Thus, the need for a system that can prove the originality of a certificate is necessary. Besides being able to verify the authenticity of documents, prevention of possible falsification of certificates/diplomas can also be minimized [2]. Document security becomes more protected through official access and privacy provided [3]. Some previous studies such as Rochman et.al., (2017) applied QR Code and Digital Signature to determine the validity of KRS (Kartu Rencana Studi / Study Plan Card) and KHS (Kartu Hasil Studi / Study Result Card) Documents in Higher Education Institution [4]. While Ahmed et.al., (2017) applied QR Code Tag in the process of authenticating documents through digital signatures signed by the Higher Education Institute. Herein, QR Code Tag consists of students data such as students' name, major program, and Grade Point Average (GPA) [5] for such purpose. Another example of QR Code application was on online bank authentication system [6] and attendance system [7]. The implementation of the QR Code is simple, low cost, open source, and the ease of use make this technique interesting to be developed [8 and 9]. QR Code also secure and has a quite large capacity for data storage [10].
Therefore, this research studies the development of the system which encrypts the code (ciphertext) in diploma or certificate to ensure its legalization. The system which will issue and ensure the authentication of certificate copies would require the secrecy of the code placed on the copy of the certificate. It takes cryptography to encrypt and protect the legalized code. Next, the encrypted code (ciphertext) will be translated into a Quick Response Code (QR Code) image so that the encrypted code is more practical in memory usage, execution time, and capacity of data encryption size [3]. QR Code is used to allow the legalization process to be faster by simply scanning it. For the encryption process, the Advanced Encryption Standard Algorithm (AES) was applied in this study. This algorithm has advantages in memory usage, execution time, and capacity of data encryption compared to other algorithms (Such as Rivest, Shamir, and Adleman-RSA, Data Encryption Standard -DES, and BLOWFISH) on implementation in cloud computing [11]. AES also has a security advantage in the formation of key combinations (2 128 -2 256 ) and the flexibility of key application in both hardware and software, if compared to DES and 3DES [12].
This study applies the AES algorithm to encrypt the legalized copy of the certificate, then the ciphertext will be translated into QR Code which will be attached to the copy of the certificate to replace the conventional stamp. Thus, to produce a digital legalization system called LID that can make copies of the certificate from educational institutions and prove the truth of the information in it. Some applications of AES Algorithm include hybrid encryption algorithm based on AES and RSA on improving data security transmission in Bluetooth communication [13]; The simulation of AES Algorithm process for encryption/decryption [12] which can improve AES used in a variety of application, such as digital video/audio recorders, FRID tags, Smart Cards, ATM, TV set up box, military applications, secure communication system, and etc.

Legalization
Legalization is an activity of endorsement of something. Meanwhile, certificate legalization is administrative services to authorize photocopies of certificates or other documents in accordance with their original documents, then certified copies of certificates with the same award as their original certificates. Regarding legalization or certification of certificate, it has been regulated in the ministerial regulation in article one, paragraph three, which reads: Validation is a process of signature and/or seal of photocopy of certificate/STTB/certificate of replacement of certificate/STTB by authorized official after verification in accordance with facts and data or original documents [5].

AES
The AES algorithm is a symmetric-key cryptographic algorithm and a block cipher. This algorithm uses the same key to encrypt and decrypt. AES actually supports a variety of block sizes and keys that will be used. But after being standardized by the National Institute of Standards and Technology (NIST), Rijndael uses fixed block and key length sizes of 128, 192, and 256 bits, so commonly referred to as AES-128, AES-192, and AES-256 [14]. In general, the encryption process in AES divided into two namely the encryption process itself (Encryption Process) and key generation (Key Expansion / Key Schedule) or round key. In the encryption process the AES-128 algorithm operates as follows (outside the round key generation process) [

QR code
QR Code is a two-dimensional barcode [16] which is the development of the barcode bar code previously. If the old barcode data is stored horizontally, but the QR Code data is stored horizontally and vertically. With the ability to store in two dimensions of QR Code certainly can store more data and varied rather than the barcode. The type of data that can be stored in QR Code is [4] including

Research methodology
By applying the Rapid Application Development (RAD) software development model, the steps taken from the planning stage consist of literature study and business modeling; The analysis and design stage contains the general system description, the unique coding of the dean, the AES encryption process, the QR Code Encode and the watermark of the certificate. The analysis results are then used in system design by using Unified Model Language (UML) tool, data modeling, and interface design. Stages continued with the implementation and testing process. The implementation is restricted by some rules, viz. The encryption algorithm used is AES-128 with ECB as electronic codebook mode. The parameter of the QR Code is using PHP QR Code library, such as the output format in PNG, ECC Level is Middle, the Image size is 6, and the frame size is 2. The object file format target must be in JPG/JPEG, PNG, and GIF. The output file format is in JPG/JPEG. The maximum width of the output file is 2126 and 1414 for max height. The quality image of the output file is 79. Finally, the conclusions and suggestions are given as closing the research. This explanation can be depicted in Fig.1.

System analysis
In general, the LID system is as same as the conventional legalization process. Where begins with a request from the owner of a certificate to the educational institution that issued the certificate. After the request is received by the admin of the administration then the file is forwarded to the official who certifies the copy of the certificate. Once the file is in the hands of the official, the file will be directly signed and still need the stamp of approval. Compared with the conventional legalized process, LID systems have little difference. Besides can be done online, there are other differences in the stages of the ratification process, where once the file has been signed by the official, the file can be directly used by the applicant by downloading the file. In contrast to the conventional way that, after being signed by the certifier, the file still needs to be stamped with the educational institution.

Step system work
The step begins with the submission process, the applicant who is here is the alumni requesting the legalization of the certificate with two options which to use the certificate photo file that has been provided from the system (uploaded by admin) or use the certificate photo file uploaded by the applicant himself. Then, the file will go to the admin workspace (administration admin) which will be reviewed whether to proceed to the dean or rejected (returned). Procedural applicable in UIN Suska Riau environment, only Dean can do the file legalization. In this process, the encryption is done by providing a combination code of the certificate number, the unique code of the certifier officer, and the time when the process is performed. Next encryption result of the code combination will be made its QR Code. QR Code will be affixed to the photo of the certificate that will be used on examination of the originality of legalized data through code matching process.

Fig. 2.
Step system work

Legalization process
The legalization process is done by the certifier officer to the incoming certificate file. This process is the main process that produces certified copies of certificates. In this process, the certificate photo file will be affixed with a QR Code image that contains the legalized data checking address link and AES-encrypted AES-128 encryption code. Further translational links are made into a QR Code image embedded on the photo certificate.

Legalized data checking
The process of examining legalized data is done by scanning the QR Code in the photo certificate by using a special camera application or smartphone. The results of the scan will be obtained a link that leads to the legalized checking module available on the LID. In the link, there is a variable that contains the encrypted code which then the code will be decrypted with AES-128 to get the original legalized code. Once the legalized code is obtained it will be checked whether the code is contained in the database or not, if not the system will tell that the data does not exist, on the contrary, the next can be done for withdrawal of existing legalization databases on the database to be displayed along with the certificate photo.

System implementation
The following are the description of system implementation. Figure 5 illustrates the legalization request process which began with data input process such as students graduation number, name, students identity number (nim), submission date, request number of certified to copy, status and date of status issued and photo. The legalized process form is executed by the dean as an authorized official. The dean application form can be seen in Figures 6. Then the examination process is begun. The system will check the legalized code in the database (Please see Figure 7). As the result, the examination status will be declared as shown in Figure  8a as "data not found" and 8b as "data found".

System testing
The testing of LID system was done in several stages, including the functional module testing through the application of black box testing, system performance testing by examining the execution time and memory load used during the process, and the latest testing is User Acceptance Test (UAT) to identify the user responses on the system applications. The above testing mode was performed in two implementation environments, namely Web-based standard computer System application has some menu function, such as log in process menu, legalized menu (alumni access), legalized submission menu, legalized information menu (alumni access), legalized download button menu, legalized menu ( administrative/admin access), legalized request review menu, legalized menu (dean access), legalizing certificate menu, legalized checking menu with smartphones, legalized checking menu in LID web for original/fake/deleted legalization, unique codes menu for Deans and logging out system menu. Black box testing found that the entire menu and function was running well and correctly. Meanwhile, for system performances testing several benchmarks are installed on the target source code in menu legalization process and legalization checking process. Three benchmark models performed on legalization process includes AES algorithms benchmarks, legalized module benchmarks, and legalized page benchmarks. Meanwhile, legalization checking process applied two benchmarks model namely AES algorithm benchmark and legalized checking module. The average execution time and memory load of benchmarks applied to 15 simulation data in each process can be seen in Table 1. For 15 data, AES encryption benchmark spent the fastest execution time from 0.0059104 seconds to the slowest in 0.001703024 seconds thus provided average value was 0.001181571 seconds (s) or 1.181571 in milliseconds (ms). The fluctuated of execution time in AES benchmark testing can be depicted in Figure 10. Next, legalized module benchmark spent the fastest execution time in 0.47792602 seconds and the slowest is in 1.48998284 seconds thus provided an average value is 0.704013634 seconds or 704.013634 milliseconds. Lastly, the legalized page menu benchmark provided the fastest execution time is 0.58162999 seconds and the slowest is 1.65834403 seconds or spent in average as 0.762566141 seconds or 762.566141 milliseconds. The execution time performance of legalized module and page menu is explained in Figure 10.   Figure 11.
For legalization checking process, 31 data testing were simulated. AES decryption benchmark provided the fastest execution time in 0.01621246338 milliseconds and the lowest in 4.427195 milliseconds thus the average values in 1.282007 milliseconds. The performance of 31 data simulation can be depicted in Figure 12.
Meanwhile, checking module spent the fastest execution time in 0.022562027 seconds and the slowest one in 0.555138826 seconds thus the average time in 114.386128 milliseconds. The performance of simulation benchmark testing is explained in Figure 13.
Memory load for AES decryption benchmark during the legalization process provided the smallest one is in 0.5431519 MB and the biggest is in 0.5504684 MB thus proposed the average value is 0.546623229 MB. Meanwhile, checking module spent memory load in 0.5436478 for the smallest and 0.553215 MB for the highest thus provided the average value is 0.548683165 MB. The description of this performance is explained in Figure 14.

User Acceptance Test
User Acceptance Test (UAT) testing is conducted through the dissemination of the questionnaire for 100 respondents as graduate students, 25 official leaders, and 40 administrators. The questionnaire performed 7 questions using 4 Linkert scales, including very agree, agree, less agree and disagree statement. The questions related to the respondents' responses on LID application interface, the ease use of application and all functions, the functionality of application and all menu, the accuracy of information and data during the legalization process, the beneficial of LID system, the agreement statement in implementing this LID system, the future prospect of LID system. As the result, 91.667% respondents gave a very positive response and agree with this application.

Conclusion
Some conclusions and suggestions that can be obtained from this research are: 1. Implementation of AES algorithm as code encryption in the legalization process and QR Code as translation tool of ciphertext into an image in LID system application has been successfully done. 2. Based on the result of functionality, capacity testing, and user response, this application can be used as well as in assisting digital legalization process in a college. This LID system is beneficial for both the applicant/graduate students and the administration in facilitating the legalization process and improving the service. 3. As the result of execution time and memory load testing, this LID system has good performance, efficient, light, and fast execution responses (less than one second and less than one megabyte). This LID system also can run in a fairly standard infrastructure environment. For future work, this LID system can be applied to the other method such as the CBC model. The legalization process checking can be done without internet access, for example by applying the Least Significant Bit (LSB) method. Moreover, this LID system can also be used for other documents.