> there are some gaps in that chain

for example, a reliance on apple wallet, instead of an open standard.

With that quibble aside, I do like the basic structure of your solution.

> Seems doubtful! I expect the forgers used a real signature from another card instead, so it has the right key but the wrong data. Reverse engineering the process as the author did and making up their own key wouldn't be of any value to the forgers.

This was just bad wording. I meant to say "someone else's key" in the context that it was a key generated by the forgers rather than the state DMV, will update to make it more clear!

> This is not wrong, but should come with a little warning. A real verifier needs to additionally check the encoded data matches the human-readable data on the front of the card.

Correct, but simply checking that it matches the front is likely not enough to deter fraud. You could extract the barcode data from a real ID and put it on a physically different (fake) ID with a different photo and it would still return as valid. To detect this you generally would need a higher end solution (IDScan.net/VeriScan's ID authentication solution (yes... the one that just leaked everyone's data), TokenWorks' IdentiFake, IDScience, amongst others) that does the same high resolution UV/IR checks TSA does. But the forgers are good enough now to be able to sometimes pass those scanners too.

> A real verifier needs to additionally check the encoded data matches the human-readable data on the front of the card.

I mean, not really? Only the machine-readable part is signed, so it should be treated as the sole source of truth. Besides, only an idiot forger would put different data in the human-readable part - it would be the easiest way to get caught!

Think about it, the key analogy is just terrible. In the origin domain, losing a key is always bad, and making a key available to all is a non sequitur.

It's not like non-technical people understand asymmetric cryptography. Or even technical people, for that matter.

Maybe we should refer to the public key as an address, and the private key is just a password again. You can send stuff, securely, to an address. And you can verify the sender when you have their address (ie check the signature).

That implies they chose not to. More likely the other states simply didn’t realize the value derived from paying a vendor to enable a ‘feature’, not realizing both the necessity of such signatures and that the cost to the vendor and mechanism of delivery is precisely the same regardless. One might consider what sort of pressures a citizen could apply to compel those states to act more to their own benefit, but I have no specific ideas to suggest at this time.

I think it depends on the context? It's in an ID card's design goals to be provably valid, so it's pointless to not publish its public keys, but something like SSH pubkeys, uhh, should I really be so eager to just publicly dump all of mine…?

Where did you get the impression the author thinks it’s a bad thing? From the article:

> These are public keys, which are meant to be published - recovering one lets anyone check a signature, not forge one.

its even called "public" lol

And it's a classic case of Not Invented Here as well: this problem was solved decades ago and the solution is widely-deployed in passports and most European identity documents - just use NFC!

Cryptographic NFC chips are basically free these days, and any modern smartphone can read them. The photo issue is solved by having the chip contain a copy of the photo, as a few extra kilobytes of data isn't an issue when you aren't using barcodes. The copy issue is solved by having the chip sign a verifier-provided nonce together with the data, and having the government sign the chip's public key instead.

You can only store ~1100 bytes in a PDF417 barcode so storing the image itself it unfeasible. And storing a signature of an image you don't have access to is useless. Passports are able to do this because the smartcard chips they use can store at least 32 KB of data (usually more).

The Austrian ID card does that. It’s a really blurry black-and-white photo only, but it’s still recognizable and I find it quite impressive that any type of photo (in addition to its public key signature) can fit into a QR code at all.

I wonder if we might have the equivalent of Certificate Revocation List for IDs leaked this way.

The first thing I do with a real ID is widen the reference bars on the sides so the checkout scanner can't read it. If they want my birthday they can type it in manually, I don't need all my info in some store database.

The other thing I remember was California fakes folding in half and not breaking

Looks like the criteria were 1. No cost to the government/taxpayer. 2. Minimal work for the civil service.

Thank you! Just updated it to use the the browser default monospace for inline text.