Researcher recovers the ECDSA public keys states hid inside US driver's license barcodes
ryan.science·low signal
Ryan Fahey recovered signing public keys from PDF417 driver's license barcodes by exploiting the property that ECDSA permits public key recovery from multiple signatures, then brute-forcing the signed message construction across hundreds of thousands of candidate field orderings. Affected issuers include Canadian Bank Note (New York, Virginia, North Carolina, South Carolina, Wisconsin) and IDEMIA, whose California implementation is publicly documented while roughly 30 other jurisdictions are not. His argument is that a signature nobody can verify provides no security, and California already shipped the documented version.