Security researcher Ryan Castellucci details the recovery of signing keys used in US driver's license barcodes. The AAMVA standard employs ECDSA P-256 signatures to prevent tampering, but the private keys were derived from a SHA-256 hash of a shared secret combined with a jurisdiction identifier. Castellucci discovered that the secret was a static string embedded in publicly distributed PDF417 barcode specification documents.

By extracting this string, he computed the private keys for all 50 US states plus DC, enabling the creation of perfectly valid, cryptographically signed barcode data for any jurisdiction. The vulnerability stems from using a deterministic key derivation function with a non-secret, static input. While the AAMVA has been notified, the long expiration of existing keys means the impact persists.

This research highlights the critical failure of security through obscurity in identity document standards.