Signing Keys for US Driver's License Barcodes Recovered by Researcher

A security researcher has recovered the signing keys used to validate barcodes on US driver's licenses, according to a post on Hacker News. The discovery reveals that the verification system for these documents is fundamentally broken and could enable widespread forgery. Should you be worried? Yes, and here's why.

Context: a standard stuck in the '90s

The barcode format on US driver's licenses dates back to the 1990s, when states adopted the AAMVA (American Association of Motor Vehicle Administrators) standard. This specification defines how driver data is encoded on a magnetic stripe or barcode but lacks a robust digital signature mechanism. For years, states have relied on shared or poorly managed cryptographic keys to sign the data, assuming the secret was safe.

Details: keys out in the open

The researcher, who chose to remain anonymous, used reverse engineering on commercial barcode readers and mobile apps to extract the signing keys. According to the analysis, at least eight states use the same 1024-bit RSA key pair, a size considered insecure for years. Moreover, verification at many checkpoints (bars, airports, stores) relies on software that blindly trusts the signature without validating the trust chain. The result: anyone with access to those keys can generate fake licenses that pass basic checks.

Analysis: forgers win, everyone else loses

This is not just a technical failure; it's a systemic governance failure. States have prioritized interoperability over security, and now the keys are in the hands of anyone patient enough to extract them. The losers are citizens, whose identities can be more easily impersonated, and authorities, facing a credibility problem in their verification systems. The security industry has warned for years that RSA-1024 is obsolete; ignoring it has consequences.

Implications: toward a new standard?

Affected states will likely be forced to migrate to ECDSA or RSA-2048 signatures, but the transition will be slow and costly. Meanwhile, barcode readers will need updates to validate trust chains, not just signatures. Public pressure could accelerate adoption of a national standard, but recent history suggests that without a massive breach, changes get postponed. The key question: how many fake IDs will be created before they react?

Driver's license security has never been this fragile, and the keys are no longer safe.

Source: Hacker News