Researchers restored the signature keys of US driver's license barcodes

Researcher Ryan Stevens published the results of an analysis of the security of driver's license barcodes in the US. During the work, it was possible to restore public signature keys used to verify data encrypted in PDF417 codes on the back of documents. The process of restoring keys is based on the analysis of the data structure corresponding to the AAMVA standard. The researcher demonstrated that the lack of proper protection of private keys in a number of states allows third parties to verify the authenticity of the digital signature contained in the barcode. This gives the ability to read and confirm personal information encoded in the document without the participation of official government verification systems. The technical implementation of the method includes extracting certificates from publicly available databases and subsequent decryption of signature parameters. During the experiment, the data of rights issued in several states were successfully verified, which confirms the vulnerability of the current document protection architecture. The results obtained caused a discussion in the Hacker News community about the need to implement more stringent cryptographic standards. The main problem is that many states use outdated signature algorithms that do not provide a sufficient level of key isolation. Although key recovery allows verifying the integrity of the data, it does not guarantee protection against counterfeiting the physical cards themselves, as visual elements such as photographs remain outside the scope of barcode digital verification. This study highlights critical flaws in the implementation of identification systems relying on static keys. The lack of regular key rotation and the use of weak signature schemes create risks to the privacy of personal data of millions of citizens whose documents can be read and verified using standard equipment.