3 ms·

There's been multiple efforts towards some type of PKI verification of driver's licenses, but they've all failed to gain adoption for various reasons. Perhaps t

There's been multiple efforts towards some type of PKI verification of driver's licenses, but they've all failed to gain adoption for various reasons. Perhaps the simplest is this one: driver's licenses are not really intended by the state to be verifiable offline, as in basically every case the state has to verify a driver's license they will need to perform an online check anyway (for revocation, for example, if not also for warrants and the whole NCIC gamut). So the level of motivation for the state (and more specifically the AAMVA which promulgates standards for driver's license) to implement this kind of verification is pretty low. Add to that the moral hazard of normalizing digital imaging of driver's licenses (which is a real concern as "digital ID" schemes or anything that looks like one face significant political opposition in the US) and practical challenges (cryptographic signatures compact enough to add to the PDF417 are possible but not as well standardized, the federal government has consolidated cryptographic ID efforts on ICC "smart cards" which are costly) and it's just a hard sell.

porker 5y ago
> cryptographic signatures compact enough to add to the PDF417 are possible but not as well standardized Do you know which are compact enough while remaining secure? I looked into this recently and failed to find one. Went for online verification in the end so data being signed was minimal.
- _Nat_ 5y ago
  [Removed: Mistaken information.]
  - nemo1618 5y ago
    Signatures aren't just uniformly-distributed entropy, like hashes are; they encode real information, e.g. elliptic curve coordinates. Hashing and truncating the signature would destroy that information, meaning the signature could no longer be verified.
    - _Nat_ 5y ago
      Ick, yeah, you're right: might've been thinking hash-then-sign, but backwards.
- jcrawfordor 5y ago
  An ECDSA signature for example can be represented as 64 bytes with good security, and adding 64 bytes to a PDF417 isn't too big of a deal. That's basically just the curve coordinates and nothing else though, so the verifying device has to either guess-and-check or use some other data to figure out what public key it should be verifying against, and there's no expiry or anything like that. In practice, now that we have elliptic curve algorithms that tend to allow very compact keys at a good security level, the bigger problem is less the actual cryptographic signature and more all the PKI metadata that normally needs to be tied to a signature to make it useful (especially if you have multiple levels of authority, which you probably want to or revocation becomes a huge problem). There are ways around carrying around PKI metadata with the signature (i.e. a normal x509 certificate) but there are tradeoffs and it's not like a well-established standard, which tends to make government organizations uncomfortable about adoption.

porker 5y ago

> cryptographic signatures compact enough to add to the PDF417 are possible but not as well standardized Do you know which are compact enough while remaining secure? I looked into this recently and failed to find one. Went for online verification in the end so data being signed was minimal.

_Nat_ 5y ago
[Removed: Mistaken information.]
- nemo1618 5y ago
  Signatures aren't just uniformly-distributed entropy, like hashes are; they encode real information, e.g. elliptic curve coordinates. Hashing and truncating the signature would destroy that information, meaning the signature could no longer be verified.
  - _Nat_ 5y ago
    Ick, yeah, you're right: might've been thinking hash-then-sign, but backwards.
jcrawfordor 5y ago
An ECDSA signature for example can be represented as 64 bytes with good security, and adding 64 bytes to a PDF417 isn't too big of a deal. That's basically just the curve coordinates and nothing else though, so the verifying device has to either guess-and-check or use some other data to figure out what public key it should be verifying against, and there's no expiry or anything like that. In practice, now that we have elliptic curve algorithms that tend to allow very compact keys at a good security level, the bigger problem is less the actual cryptographic signature and more all the PKI metadata that normally needs to be tied to a signature to make it useful (especially if you have multiple levels of authority, which you probably want to or revocation becomes a huge problem). There are ways around carrying around PKI metadata with the signature (i.e. a normal x509 certificate) but there are tradeoffs and it's not like a well-established standard, which tends to make government organizations uncomfortable about adoption.