Keys Not Included: recovering the signing keys for US driver's license barcodes

Commenters debated what the recovery of keys for US driver's license barcodes actually means and whether it is harmful. Several pointed out that the recovered material is public keys, which by design are meant to be published and can only be used to verify, not forge, signatures (what, kccqzy). Others questioned the submitter's subtitle and clarity: simoncion asked whether a signing (private) key was recovered, and trollbridge clarified the recovery was of public keys due to ECDSA. Practical implementation concerns surfaced too: EPWN3D criticized the placeholder-and-overwrite signing pattern as fragile, while woodruffw and lazide defended content-aware padding as a realistic trade-off. isomorphic suggested some states fear public-key disclosure, and kccqzy wondered if a revocation list for leaked IDs is feasible.

Views diverged on the real-world risk from signed barcodes versus unsigned biometric data. KingMachiavelli argued that if photos aren’t signed into the barcode, leaked IDs and fake photos make verification ineffective; kqp and others warned about copying serial numbers plus signatures. Several commenters recounted that scannable fake IDs often work in practice (RockRobotRock, wildzzz), and some suggested broader applications or mitigations - piratejon proposed QR-signed serials for anti-counterfeiting, teravor proposed blind signatures for privacy-preserving e-cash, and NDlurker or CSSer recommended simple physical checks like flex tests.