This week Ontario is set to unveil a COVID-19 vaccine passport system and I’m unusually optimistic that it might actually work (technically that is). Why? Because the vaccination receipts that Ontario has in place for you to download are, in fact, “almost” COVID-19 vaccine passports. I downloaded mine over the weekend and examined them. I was pleasantly surprised by what I found.
These downloaded receipts are PDF documents that are digitally signed, and unless you can steal the private key of the signing authority, they are unforgeable. Oh, and to prevent any forgery “hacks” as demonstrated on the Quebec implementation, the verifying systems need to trust ONLY the issuing authorities and not just anyone. (If you’re interested, the signing authority for my downloaded receipts is covid19signer.ontariohealth.ca).
The information contained in these Ontario vaccination receipts (full name, date of birth, the vaccine, dosage, date of vaccination, etc.) also cannot be changed because that would invalidate the digital signature.
You can see these digital signatures yourself if you use a tool that can parse PDF signatures such as Adobe Reader. Also you have to use the receipts from the download and not the ones you receive in an email after your vaccination appointment. The latter are not digitally signed.
Looking at the bigger picture, the information in these receipts are aligned with the mandatory elements specified in the EU Digital COVID Certificate for vaccinations which has just been backed by the International Air Transport Association as a global standard.
So what’s missing? PDF documents are designed for humans to read, but they are not well suited for “light-weight”, automated verification of the information contained within. Paper format is also a requirement for a passport when a smartphone isn’t available. But when on paper, PDF documents lose the digital signatures that protect them.
All Ontario has to do is issue the same information as a QR code. Here’s where I hope Ontario makes the right decision. Wouldn’t it be nice if your same COVID vaccine passport could be used for international travel as well as local businesses? It could. It would be wise for Ontario to use the QR code format defined in the EU DCC specification, because it looks like it is poised to become a global standard. That would be a win for Ontario and its citizens.