Keys Not Included: recovering the signing keys for US driver's license barcodes
Points and comments are a snapshot, not live.
Researchers recovered public signing keys from US driver's license barcodes by reverse-engineering undocumented ECDSA signatures.
California's DMV publishes open documentation for verifying ECDSA P-256 signatures on its PDF417 barcodes, including a public key at a well-known URL. The author discovered that Canadian Bank Note (CBN) embeds similar signatures in licenses for New York, Virginia, North Carolina, South Carolina, and Wisconsin, but without any published verification method. By analyzing multiple physical cards, the author reverse-engineered the signed-message construction (a placeholder overwritten by the real signature) and recovered the public keys for New York and Virginia. Both CBN and IDEMIA (which produces California's cards and 31 total U.S. jurisdictions) have working signature systems, but only California makes verification accessible.
The author argues that IDEMIA should ship this feature to all its clients and that CBN should publish documentation and public keys for the five states it serves.
What commenters are saying
Commenters broadly praised the technical detective work, with several noting the article's subtitle was misleading-it describes recovering public keys, not private signing keys. A correction thread clarified that ECDSA's public key recovery property allowed this, and that publishing public keys is standard practice, not a security risk.
Two substantive discussions emerged: (1) whether signed barcodes are useful without also signing the photo, since valid barcodes can be copied onto fake cards; (2) whether NFC chips (as used in passports) would be a better solution, as they support challenge-response protocols that prevent copying. Some commenters noted that a few hundred thousand leaked real IDs could defeat any barcode-only verification system.