US Driver's License Barcode Signing Keys Recovered
Original: Keys Not Included: recovering the signing keys for US driver's license barcodes
Why This Matters
Millions of ID scans occur daily; forged barcodes that pass cryptographic checks break a core retail and security trust layer.
Security researcher Ryan Fahey recovered the cryptographic signing keys used to authenticate US driver's license PDF417 barcodes, exposing that several states rely on publicly accessible or weakly protected keys — undermining the integrity of digital ID verification systems nationwide.
Researcher Ryan Fahey documented how he extracted the signing keys used to verify PDF417 barcodes on US state driver's licenses — the same barcodes scanned by bouncers, retailers, and age-verification apps. The attack surface is surprisingly mundane: many states embed their public keys in the very SDK libraries or apps they distribute to verifiers, and some signing keys were either recoverable through reverse engineering or were never properly protected to begin with.
Fahey found that the trust model underlying these barcodes is largely security theater. An attacker with the signing key can generate a barcode that passes cryptographic verification while containing entirely fabricated identity data. The post details which states were vulnerable and how the keys were obtained — through app decompilation, SDK extraction, and in some cases, open government repositories.
The broader issue: there is no centralized, audited key management standard for state-issued ID barcodes. Each state implements its own scheme, and many did so without serious cryptographic review. Some keys have apparently never been rotated.