California · New York · ryan.science
Keys Not Included: recovering the signing keys for US driver's license barcodes
Compiled by KHAO Editorial — aggregated from 1 source. See llms.txt for citation guidance.
◌ Single Source
In Insecure by Design the reporter argued that the AAMVA should require states to cryptographically sign the PDF417 barcode on a driver's license and mentioned that two states, New York and Virginia, already sign theirs with something proprietary.
Key facts
- Inside California's ZC subfile is a complete W3C Verifiable Credential Barcode, a credential compressed with CBOR-LD and signed with the ecdsa-xi-2023 cryptosuite 2
- The header carries an Issuer Identification Number that says which jurisdiction printed the card: 636000 is Virginia, 636001 is New York, 636004 is North Carolina, and 636014 is California
- On a New York card the payload is 484 bytes and the ZNB value sits at bytes 393 to 483
- California's cards are made by IDEMIA, under a twelve-year contract awarded in 2022, and IDEMIA began issuing all of California's licenses and IDs in October 2025 5
Summary
Virginia published a calibration sheet that lays out the AAMVA format of the barcode including the state's own subfiles. On the back of any U.S. state ID or DL is a standard AAMVA PDF417 barcode. The interesting part is the jurisdiction-specific subfiles, a section prefixed with Z plus a state letter ( ZV in Virginia, ZN in New York, ZC in California). On October 1st, 2025, the California DMV announced its new license and ID design in a press release.