<![CDATA[Replay attacks, data tampering, and signature forgery are well-documented threats to QR Code-based digital identity systems. Multi-scenario evaluations of such systems, however, remain rare in the Indonesian literature. This paper evaluates the security of an RSA-PSS QR Code system with an integrated nonce-timestamp anti-replay mechanism; the design of that mechanism and its performance efficiency appear in a companion paper. Testing proceeded in two stages. A calibrated discrete-event simulation covered 350,000 operations over eight sessions and thirteen CAPEC-based attack subtypes; a subsequent empirical campaign of 66,500 operations exercised the production verification path directly. Under simulation, replay detection reached 92.21% synthetically and 100% under production conditions; data tampering detection reached 78.14% against a ≥85% target (z = −42.97; p < 0.001), and signature forgery rejection reached 97.08% against an aspirational EUF-CMA target of ≥99.9%. The empirical campaign detected every attack across all four scenarios and rejected none of the 5,549 valid negative controls, giving one-sided 95% lower bounds of 99.994% for tampering, 99.925% for forgery, and 99.900% for replay under the rule of three. The simulated shortfall in semantic validation therefore reflects the parameterisation of the test harness rather than a weakness of the deployed system, whose cryptographic core rejects every modification to signed fields. Scalability held at 500 concurrent users with a 1.78% error rate. A separate PRISMA 2020 novelty review examined twenty-six Indonesian QR Code studies published between 2016 and 2026 against five criteria. Only one uses RSA-PSS, and there as an auxiliary layer above a DSA primary signature; none satisfies all five criteria (0/26). The system therefore has no direct predecessor in this literature, which makes its novelty architectural rather than a matter of parameter tuning.]]>
Copyrights © 2026
