IdeaWell

Project ideas from Hacker News discussions.

Keys Not Included: recovering the signing keys for US driver's license barcodes

Original Article

Hacker News Discussion

📝 Discussion Summary (Click to expand)

Theme 1: Public‑vs‑Private‑Key Clarification

“I only see claims that the public key can be determined from license barcodes, not that a signing key can be determined.” — SimonCion

Theme 2: NFC/Chip Solutions Already Exist

“And it's a classic case of Not Invented Here as well: this problem was solved decades ago and the solution is widely‑deployed in passports and most European identity documents — just use NFC!” — crote

Theme 3: Practical Concerns About Fake IDs and Verification

“All of this is nearly pointless unless the photo itself is in the barcode and also signed. You only need a leak of a few hundred real IDs to cover all of the identifiable characteristics (hair, eye, skin color, approx height and weight). Leak a few hundred thousand a year and now you can’t even flag leaked IDs without some false positives.” — KingMachiavelli

🚀 Project Ideas

[IDVerifier – Mobile Driver‑License Verifier]

Summary

  • A cross‑platform mobile app that scans the PDF417 barcode on US driver’s licenses, verifies the embedded ECDSA signature using the state’s public key, and OCR‑matches the human‑readable fields (name, DOB, photo) to prevent forged or tampered IDs.
  • Core value: gives businesses, bouncers, and retailers a fast, cryptographically sound way to reject fake IDs without relying on proprietary government apps.

Details

Key Value
Target Audience Bars, restaurants, retail stores, event staff, and privacy‑conscious individuals who need to verify IDs on the spot
Core Feature Barcode scan → signature verification → OCR/face‑match cross‑check → revocation‑list lookup
Tech Stack React Native (or Flutter) for UI, ZXing for barcode decoding, OpenCV/Tesseract for OCR, TensorFlow Lite for face similarity, Node.js backend for key distribution & CRL, AWS S3 for public‑key storage
Difficulty Medium
Monetization Revenue-ready: SaaS subscription per venue ($15/mo) + optional premium features (audit logs, API access)

Notes

  • HN commenters complained that current barcode scanners ignore the photo and can be fooled by a fake ID with a valid barcode; this app directly addresses that gap (see KingMachiavelli and crote comments).
  • Provides a practical utility that could be adopted immediately by small businesses, sparking discussion on ID security standards and the feasibility of verifiable credentials.

[SignID – Cryptographic ID Issuance SDK]

Summary

  • A developer‑friendly SDK and hosted API that lets state DMVs or private issuers create driver‑license‑style barcodes with ECDSA signatures, manage key pairs, and publish revocation lists.
  • Core value: removes the barrier to adopting cryptographically signed IDs by providing ready‑made signing/verification tools, key‑rotation, and CRL distribution.

Details

Key Value
Target Audience State DMV IT teams, identity‑solution vendors, and developers building verifiable credential systems
Core Feature Generate PDF417 barcode with embedded ECDSA signature, verify signatures, rotate keys, distribute public keys & CRL via CDN
Tech Stack Rust library (core crypto) with WASM bindings, Node/Express admin API, PostgreSQL for key metadata, Cloudflare Workers for CRL distribution, Docker for deployment
Difficulty High
Monetization Revenue-ready: Tiered usage pricing ($0.001 per signed barcode) + enterprise support contracts

Notes

  • Commenters like crote and lxgr noted that cryptographic NFC chips already solve the problem, but many states still rely on barcodes; SignID gives them a low‑cost software path to add signatures without hardware changes.
  • Enables discussion about standardization (AAMVA) and provides a concrete tool that states could pilot, addressing the frustration expressed about missing pressure to adopt signed barcodes.

[CryptoID Explorer – Interactive Web Tutorial]

Summary

  • An educational web app that lets users experiment with driver‑license barcode data: generate a mock ID, sign it with an ECDSA key, recover the public key, attempt to forge, and see how verification fails. Includes visual explanations of why public keys are safe to share and how signatures protect against tampering.
  • Core value: builds intuition around public‑key cryptography in the context of IDs, reducing misunderstandings like those seen in the HN thread.

Details

Key Value
Target Audience Students, developers, security enthusiasts, and curious HN readers who want to grasp ID‑signing concepts
Core Feature Interactive sandbox: edit barcode fields, sign/verify, visualize key recovery, view attempted forgeries, revocation‑list simulation
Tech Stack React + TypeScript frontend, SubtleCrypto Web Crypto API, D3.js for key diagrams, hosted on Vercel/Netlify
Difficulty Low
Monetization Hobby

Notes

  • Directly tackles the confusion expressed by jmathai, simoncion, and bzmrgonz about what recovering a “signing key” actually means; an interactive demo makes the distinction between public and private keys crystal clear.
  • Encourages practical utility and discussion: users can share their experiment results, deepening community understanding of why publishing ID public keys is safe and why signature verification matters.

Read Later