+Physical credentials, such as driver's licenses, passports, and travel +credentials often include machine-readable data that can be used to quickly read +the information from the document. This information is encoded in formats such +as PDF417 [ISO15438-2015], machine-readable zone (MRZ) [ICAO9303-3], and +other optically scannable codes that are formatted in one-dimensional or +two-dimensional "bars"; thus the term "barcode". This information is often +not protected from tampering and the readily available barcode generation and +scanning libraries mean that it is fairly trivial for anyone to generate these +barcodes. +
++It is, therefore, useful for an issuer of these barcodes to protect +the information contained within the barcode as well as the entity that +generated the barcode. +
++The Verifiable Credentials Data Model v2.0 specification provides a global standard for +expressing credential information, such as those in a driver's license or +travel document. The Verifiable Credential Data Integrity 1.0 specification provides a global +standard for securing credential information. These two specifications, when +combined, provide a means of protecting credentials from tampering, +expressing authorship of the credential, and providing the current status of +a credential in a privacy-protecting manner. These data formats, however, tend +to be too large to express in an optical barcode. +
++The Compact Binary Object Representation for Linked Data v0.7 specification provides a means of compressing secured +verifiable credentials to the point at which it becomes feasible to +express the information as an optical barcode, or embedded within an optical +barcode. +
++This specification describes a mechanism to protect optical barcodes, +such as those found on driver's licenses (PDF417) and travel documents (MRZ), +by using a verifiable credential [VC-DATA-MODEL-2.0] to express +information about the barcode, which is then secured using Data Integrity +[VC-DATA-INTEGRITY], and then compressed using CBOR-LD [CBOR-LD]. The +resulting verifiable credential representations are compact enough such +that they fit in under 140 bytes and can thus be integrated with traditional +two-dimensional barcodes that are printed on physical cards using standard +printing processes. This adds tamper resistance to the barcode while +optionally enhancing the barcode to provide information related to whether or +not the physical document has been revoked or suspended by the issuer. +
+ ++The following sections provide a few introductory examples of the ways this +specification can be used to enhance existing physical credentials with +digital signatures via verifiable credentials. +
+ ++This section provides an example on how the technology in this specification +can be utilized to secure the optical barcode on a driver's license that +uses a PDF417 barcode. We start off with an example driver's license: +
+ +
+ +The back of the driver's license contains a PDF417 barcode: +
+ +
+ +The PDF417 data contains information that is secured using the algorithms +described in this specification. Namely, the PDF417 barcode contains a +verifiable credential of the following form. +
+ +{
+ "@context": [
+ "https://www.w3.org/ns/credentials/v2",
+ "https://w3id.org/vdl/v2",
+ "https://w3id.org/vdl/utopia/v1"
+ ],
+ "type": [
+ "VerifiableCredential",
+ "OpticalBarcodeCredential"
+ ],
+ // the issuer value below is defined as a URL in the 'utopia/v1' context above
+ "issuer": "did:web:dmv.utopia.example",
+ "credentialStatus": {
+ "type": "TerseBitstringStatusListEntry",
+ "terseStatusListBaseUrl": "https://dmv.utopia.gov/statuses/12345/status-lists"
+ "terseStatusListIndex": 123567890
+ },
+ "credentialSubject": {
+ "type": "AamvaDriversLicenseScannableInformation",
+ "protectedComponentIndex": "uP_BA"
+ },
+ "proof": {
+ "type": "DataIntegrity",
+ "cryptosuite": "ecdsa-xi-2023",
+ // the public key below is defined as a URL in the 'utopia/v1' context above
+ "verificationMethod": "did:web:dmv.utopia.example#key-1",
+ "proofPurpose": "assertionMethod",
+ "proofValue": "z4peo48uwK2EF4Fta8P...HzQMDYJ34r9gL"
+ }
+}
+ +The verifiable credential above is then compressed using [CBOR-LD] +to the following output (in CBOR Diagnostic Notation): +
+ +1281{
+ 1 => [ 32768, 32769, 32770], // @context
+ 155 => [ 116, 164 ], // type
+ 192 => 174, // issuer
+ 186 => { 154 => 166, 206 => 178, 208 => 1234567890 }, // credentialStatus
+ 188 => { 154 => 172, 180 => h'753FF040 }, // credentialSubject
+ 194 => { // proof
+ 154 => 108, // type
+ 214 => 4, // cryptosuite
+ 224 => 230 // verificationMethod
+ 228 => 176, // proofPurpose
+ 210 => Uint8Array(65) [ ... ], // proofValue
+ }
+}
+ +This section provides an example on how the technology in this specification +can be utilized to secure the machine-readable zone on an employment +authorization document that uses a machine-readable zone (MRZ) on the back of +the card. We start off with an example employment authorization document: +
+ +
+ +The back of the employment authorization document contains a machine-readable +zone (MRZ) containing information designed to be read through optical character +recognition: +
+ +
+ +The MRZ data contains information that is secured using the algorithms +described in this specification. Namely, the QR Code on the front of the +card contains a verifiable credential of the following form, which secures +the information on the back of the card. +
+ +{
+ "@context": [
+ "https://www.w3.org/ns/credentials/v2",
+ "https://w3id.org/citizenship/v2",
+ "https://w3id.org/citizenship/utopia/v1"
+ ],
+ "type": [
+ "VerifiableCredential",
+ "OpticalBarcodeCredential"
+ ],
+ // the value below is defined as a URL in the 'utopia/v1' context above
+ "issuer": "did:web:immigration.utopia.example",
+ "credentialSubject": {
+ "type": "MachineReadableZone",
+ },
+ "proof": {
+ "type": "DataIntegrity",
+ "cryptosuite": "ecdsa-xi-2023",
+ // the value below is defined as a URL in the 'utopia/v1' context above
+ "verificationMethod": "did:web:immigration.utopia.example#key-4"
+ "proofPurpose": "assertionMethod",
+ "proofValue": "z4peo48uwK2EF4Fta8P...HzQMDYJ34r9gL"
+ }
+}
+
+Readers might note that the credential above does not contain the optional
+credentialStatus property. Not every optical barcode credential issuer will
+have the requirement to have revocable optical barcode credentials.
+
+The verifiable credential above is then compressed using [CBOR-LD] +to the following output (in CBOR Diagnostic Notation): +
+ +{
+ 1 => [ 32768, 32769, 32770], // @context
+ 155 => [ 116, 176 ], // type
+ 208 => 194, // issuer
+ 204 => { 154 => 192 }, // credentialSubject
+ 210 => { // proof
+ 154 => 108, // type
+ 226 => 4, // cryptosuite
+ 236 => 242 // verificationMethod
+ 240 => 196, // proofPurpose
+ 210 => Uint8Array(65) [ ... ], // proofValue
+ }
+}
+ +This section provides an example on how the technology in this specification can +be utilized to secure a birth certificate as a verifiable credential, which +is then expressed as a QR Code on the printed paper document: +
+ +
+ +The QR Code encodes the following verifiable credential. The details of +the encoding are available as separate tabs below: +
+ +{
+ "@context": [
+ "https://www.w3.org/ns/credentials/v2",
+ "https://w3id.org/vital-records/v1rc1"
+ ],
+ "type": [
+ "VerifiableCredential",
+ "BirthCertificateCredential"
+ ],
+ "issuer": "https://hospital.example/issuer",
+ "validFrom": "2023-09-30T11:30:00Z",
+ "credentialSubject": {
+ "type": "BirthCertificate",
+ "certificationDate": "2023-09-30T13:44:52Z",
+ "newborn": {
+ "type": "Newborn",
+ "name": "Tim Doe",
+ "gender": "Male",
+ "birthDate": "2023-10-05T14:29:00Z",
+ "birthPlace": {
+ "type": "PostalAddress",
+ "streetAddress": "123 Hospital Rd",
+ "addressLocality": "Utopia Town",
+ "addressRegion": "Utopolis",
+ "postalCode": "12345",
+ "addressCountry": "Utopia"
+ },
+ "parent": [{
+ "type": "Mother",
+ "name": "Jane Doe",
+ "namePriorToMarriage": "Jane Smith"
+ }, {
+ "type": "Father",
+ "name": "John Doe"
+ }]
+ }
+ }
+}+ d9cb1d8201a60182782468747470733a2f2f7777772e77332e6f72672f6e732f63726564656e7469616c732f7632782468747470733a2f2f773369642e6f72672f766974616c2d7265636f7264732f7631726331189d82187618a4190130a3189c18a218cc74323032332d30392d33305431333a34343a35325a190104a618966754696d20446f65189c18ae18bc74323032332d31302d30355431343a32393a30305a18c4a6189c18b21901446655746f7069611901466b55746f70696120546f776e1901486855746f706f6c697319014a65313233343519014c6f31323320486f73706974616c20526418e2644d616c6519010b82a31896684a616e6520446f65189c18ac1901026a4a616e6520536d697468a21896684a6f686e20446f65189c18aa190134820277686f73706974616c2e6578616d706c652f697373756572190136a6189c186c1901501a69bd70e21901526f65636473612d726466632d3230313919015c19016219015e58417a62c6c14fefb2fc23afe119c1dcd2b6b5f6134ee7eef4663cdf55f2cf54d76a7c2a1733aa57252322031bb6e64d12c84a499b564366ede6bc79a1fe6b38b3652f190160821904015823802403a1c6b2fcde35a7d9860ae3ddef398821e29a99fffd0eb512ea8e328b321efc421901401a651806b8 +
+ JSON-LD size: 1037 bytes
+ CBOR-LD size: 484 bytes
+ Compression : 53%
+
+ application/vc +
{
+ "@context": [
+ "https://www.w3.org/ns/credentials/v2",
+ "https://w3id.org/vital-records/v1rc1"
+ ],
+ "type": [
+ "VerifiableCredential",
+ "BirthCertificateCredential"
+ ],
+ "issuer": "https://hospital.example/issuer",
+ "validFrom": "2023-09-30T11:30:00Z",
+ "credentialSubject": {
+ "type": "BirthCertificate",
+ "certificationDate": "2023-09-30T13:44:52Z",
+ "newborn": {
+ "type": "Newborn",
+ "name": "Tim Doe",
+ "gender": "Male",
+ "birthDate": "2023-10-05T14:29:00Z",
+ "birthPlace": {
+ "type": "PostalAddress",
+ "streetAddress": "123 Hospital Rd",
+ "addressLocality": "Utopia Town",
+ "addressRegion": "Utopolis",
+ "postalCode": "12345",
+ "addressCountry": "Utopia"
+ },
+ "parent": [
+ {
+ "type": "Mother",
+ "name": "Jane Doe",
+ "namePriorToMarriage": "Jane Smith"
+ },
+ {
+ "type": "Father",
+ "name": "John Doe"
+ }
+ ]
+ }
+ },
+ "proof": {
+ "type": "DataIntegrityProof",
+ "created": "2026-03-20T16:08:02Z",
+ "verificationMethod": "did:key:zDnaetYnnaimMdmB1TyMANMpCpEd9RATG5ouS1h9x2ocnqjrH",
+ "cryptosuite": "ecdsa-rdfc-2019",
+ "proofPurpose": "assertionMethod",
+ "proofValue": "z2yYRB4gDkwB9vGm8K6MkcVwbSrPHoYLXZUezh1PnhcxVVtBcdRzu7J7NKRWGT4SFYVQctxuyXUR2iW4r
+eKvnc6mU"
+ }
+}
+
+ + CBOR-LD Diagnostic Mode +
51997(
+ [
+ 1,
+ {
+ 1: [
+ "https://www.w3.org/ns/credentials/v2",
+ "https://w3id.org/vital-records/v1rc1"
+ ],
+ 157: [
+ 118,
+ 164
+ ],
+ 304: {
+ 156: 162,
+ 204: "2023-09-30T13:44:52Z",
+ 260: {
+ 150: "Tim Doe",
+ 156: 174,
+ 188: "2023-10-05T14:29:00Z",
+ 196: {
+ 156: 178,
+ 324: "Utopia",
+ 326: "Utopia Town",
+ 328: "Utopolis",
+ 330: "12345",
+ 332: "123 Hospital Rd"
+ },
+ 226: "Male",
+ 267: [
+ {
+ 150: "Jane Doe",
+ 156: 172,
+ 258: "Jane Smith"
+ },
+ {
+ 150: "John Doe",
+ 156: 170
+ }
+ ]
+ }
+ },
+ 308: [
+ 2,
+ "hospital.example/issuer"
+ ],
+ 310: {
+ 156: 108,
+ 336: 1774022882,
+ 338: "ecdsa-rdfc-2019",
+ 348: 354,
+ 350: h'7a62c6c14fefb2fc23afe119c1dcd2b6b5f6134ee7eef4663cdf55f2cf54d76a7c2a1733aa57252322031
+bb6e64d12c84a499b564366ede6bc79a1fe6b38b3652f',
+ 352: [
+ 1025,
+ h'802403a1c6b2fcde35a7d9860ae3ddef398821e29a99fffd0eb512ea8e328b321efc42'
+ ]
+ },
+ 320: 1696073400
+ }
+ ])}
+ +
+ QR Code version: 15
+ Error correction: Low
+
+ QR Code Content (text) +
VC1-R0OR*W3H90Q80L8FA9DIWENPEJ/5S4F03F53F7*5$KE$:5CPEXPC C1$CBWEAECCPEI.EL8FA9DIWENPEJ/553FPED7*5$K +E006-EDAECOX5Z C04EKVC006DB6DOC1534KG$-EOXKY60$RK0XJ6MK5%PNF6QF63W5CA79L6/SAJL6:Q66G7KG6B73KQ0*43$2D +YEDP34W3E053I53W531VE8466L6$963W5HX6-963G7PA7646OHBW%O053M53B735T86 A/3EMEDB73R+86 A/3EMED-3454EF-DD +70O8DHWES9EXVDZOEF70UZCQF60R6B73$T9*96%K6379WQE-EDAEC*34JTC-RS9Z9TVDB73LK1$RKT0J6I91/DP34W3E053G53B7 +3XD06I91/D+34J$DAWE6MKT0JKI949DP34W3E053E53B73WS61E059DWQE-EDAEC.%5$9FQ$DTVDW:5ZQE%$E4JE+60+:K0XJ/TD +L70BF3V.NBQSN70W3EJPCHQEOX57VC9OCNF61A6B73.SB*70B73W-BMC8MCUVVAI.3TB2V:B3VL:TF7FAKTOBW1W9S 0LP*I1I1Y +KNM/G*S40%63*JNMFNLJPSPBUTLE20OH +19DO/KM0EE0AF30WZ5BB7319CE73T70/L4*O4EKKASM54S*9LO.GD S-AUJ9H5TS3L +JR:V4+MGTTOH65F63+VB73U485ZCA%0 ++
+ JSON-LD Diagnostic Mode +
{
+ "@context": [
+ "https://www.w3.org/ns/credentials/v2",
+ "https://w3id.org/vital-records/v1rc1"
+ ],
+ "type": [
+ "VerifiableCredential",
+ "BirthCertificateCredential"
+ ],
+ "issuer": "https://hospital.example/issuer",
+ "validFrom": "2023-09-30T11:30:00Z",
+ "credentialSubject": {
+ "type": "BirthCertificate",
+ "certificationDate": "2023-09-30T13:44:52Z",
+ "newborn": {
+ "type": "Newborn",
+ "name": "Tim Doe",
+ "gender": "Male",
+ "birthDate": "2023-10-05T14:29:00Z",
+ "birthPlace": {
+ "type": "PostalAddress",
+ "streetAddress": "123 Hospital Rd",
+ "addressLocality": "Utopia Town",
+ "addressRegion": "Utopolis",
+ "postalCode": "12345",
+ "addressCountry": "Utopia"
+ },
+ "parent": [
+ {
+ "type": "Mother",
+ "name": "Jane Doe",
+ "namePriorToMarriage": "Jane Smith"
+ },
+ {
+ "type": "Father",
+ "name": "John Doe"
+ }
+ ]
+ }
+ },
+ "proof": {
+ "type": "DataIntegrityProof",
+ "created": "2026-03-20T16:08:02Z",
+ "verificationMethod": "did:key:zDnaetYnnaimMdmB1TyMANMpCpEd9RATG5ouS1h9x2ocnqjrH",
+ "cryptosuite": "ecdsa-rdfc-2019",
+ "proofPurpose": "assertionMethod",
+ "proofValue": "z5njAu8RweCyTPcbD716hzcGwrQ318zJKByiaPsNaGhH14jGrYGtVTdzauSx4YqomCiaEgk3m6KPZZ8Mw
+EbG2qPXt"
+ }
+}}
+ +The following are the design goals of the technology in this specification: +
+-
+
- +Authenticity: a Verifiable Credential Barcode that successfully verifies is +guaranteed to have originated from the claimed issuing authority. + +
- +Integrity: data on a document with a Verifiable Credential Barcode that +successfully verifies is guaranteed to not have been modified as long as that data +is secured by the barcode. + +
- +Real-time Status: verification of a Verifiable Credential Barcode proves that +the document has not been revoked or suspended, and this is done without a +privacy-invasive "phone home" to a source-of-truth database. + +
- +Simplicity: Verifiable Credential Barcodes reuse existing optical barcodes on +documents (e.g., PDF417s on the back of AAMVA compliant Driver's Licenses) or add a +new barcode in an easily consumable form (e.g., a QR code). + +
- +Conformance: the Verifiable Credential Barcodes technology stack is aligned with +global standards and standards-track technologies. + +
+Terminology used throughout this document is defined in the +Terminology section of the +Verifiable Credentials Data Model v2.0 specification as well as the Verifiable Credential Data Integrity 1.0 +specification. +
+ +- Unicode code point order +
-
+This refers to determining the order of two Unicode strings (
AandB), +using Unicode Codepoint Collation, +as defined in [XPATH-FUNCTIONS], +which defines a +total ordering +of strings comparing code points. +Note that for UTF-8 encoded strings, comparing the byte sequences gives the same result as code point order. +
As well as sections marked as non-normative, all authoring guidelines, diagrams, examples, and notes in this specification are non-normative. Everything else in this specification is normative.
+ The key words MUST, RECOMMENDED, REQUIRED, and SHOULD in this document + are to be interpreted as described in + BCP 14 + [RFC2119] [RFC8174] + when, and only when, they appear in all + capitals, as shown here. +
++A conforming document is any concrete expression of the data model +that complies with the normative statements in this specification. Specifically, +all relevant normative statements in Sections +2. Data Model and 3. Algorithms +of this document MUST be enforced. +
+ ++A conforming processor is any algorithm realized +as software and/or hardware that generates or consumes a +conforming document. Conforming processors MUST produce errors when +non-conforming documents are consumed. +
+ +
+This document contains examples of JSON and JSON-LD data. Some of these examples
+are invalid JSON, as they include features such as inline comments (//)
+explaining certain portions and ellipses (...) indicating the omission of
+information that is irrelevant to the example. Such parts need to be
+removed if implementers want to treat the examples as valid JSON or JSON-LD.
+
+ 
+ 
+ 
+ 
+ 
+