Process

How Claim 169 Works

A deep dive into the six-step pipeline from raw identity data to a verifiable, tamper-proof QR code — and how it is verified in the field.

From Identity to Trusted Verification

01

Generate QR Code

Secure identity data is encoded and signed into a QR

02

Issue Credential

QR is shared digitally or printed for the individual

03

Present QR Code

User presents QR at verification point

04

Scan & Decode

Verifier scans and extracts identity data

05

Verify Identity

Signature validated + face match confirms presence

06

Access Service

Identity verified → service delivered

The Encoding Pipeline

01

Prepare Identity Data

Convert identity information — demographics, biometrics, and metadata — into a Claim 169 CBOR structure.

CBOR (RFC 8949)
02

Generate CWT Claims

Create the CBOR Web Token (CWT) claim set from the Claim 169 formatted identity data with all required fields.

CWT (RFC 8392)
03

Protect with COSE_Sign1

Sign the CWT claims using COSE_Sign1 with Ed25519 or ECC algorithms. Signing is mandatory to ensure integrity and authenticity.

COSE_Sign1 (RFC 9052, RFC 9053)
04

Compress

Apply zlib or Brotli compression to the signed COSE object. Verifiers detect zlib-compressed payloads using the zlib header.

zlib / Brotli
05

Encode Base45

Convert the compressed payload into a Base45 string optimized for QR code character sets.

Base45 (RFC 9285)
06

Generate QR Code

Render the Base45-encoded string as a machine-readable QR code for digital or printed credentials.

ISO/IEC 18004 QR Code

Verification Process

1

Verify CWT as COSE Sign1 per RFC 8152 §4

2

Extract COSE payload as Message

3

Validate signature authenticity

4

Validate public key against preconfigured keys

Security Architecture

Cryptographic assurance without real-time server dependency

Mandatory Signing

— Claim 169 Specification

  • Plain Text Structure

    The MAP structure remains unencrypted, functioning like printed card details — but the digital signature prevents any tampering.

  • Biometric Encryption

    Sensitive biometric data should be encrypted using COSE_Encrypt/COSE_Encrypt0 mechanisms. If encryption is used, sign first then encrypt the result.

  • Key Discovery

    In v1.2.1, JWKS-based .well-known endpoints are replaced with COSE-based key discovery mechanisms. Public keys must be validated against preconfigured keys.

  • Nested CWT Operations

    Producers normally should sign the message and then encrypt the result when encryption is necessary, following standard CWT nested token procedures.

COSE Header Attributes

32x5bagUnordered list of X.509 certificates
33x5chainOrdered chain of X.509 certificates
34x5tHash of an X.509 certificate
35x5uURI pointing to an X.509 certificate

Signature Algorithms

ED25519Recommended
ECCSupported