You can login across different devices, and they all generate their own keypair - the private key never leaves the device. It looks like the keypair is tied to the token provided. This is signed with the private key established earlier. So the construction of the QR code text looks like. The value of this is the same across devices. Included in this JWT is an attribute licenceSnapshot, a base64 encoded value which is important because it’s used later. This response is ~30KB, as it includes a base64 encoded photo. The response is JSON, including a the actual licence information in (you guessed it), a JWT. The app then requests driver licence data, by sending a request to.The request is a POST sent to, and the certificate in the response looks like: The response to this request is a certificate. A JWT is created, with body containing the public key and csr (unclear why this isn’t just in the POST body, there’s already auth. The app generates a 2048-bit RSA public/private keypair and a Certificate Signing Request.Here are the steps the app takes to create a licence QR code: QR Code Generation:įor brevity, I’ll ignore the login process/auth, but obviously it’s required. First I’ll cut to the end and explain how they work, and then I’ll discuss the technical details in reverse engineering this. It seems like a bad idea on every front (for another discussion) except short-term usability on venue check-ins, but the app already does do verification on the Digital Driver Licence, so I wanted to understand how it works, and see if it was possible for me to generate my own valid QR codes (spoiler: yes). There’s been very little information or public discussion on how they will do this.

Fake nsw drivers licence