Presenting personal information in the form of a QR code has become a daily reality for many during the Covid pandemic. In many jurisdictions across the globe, people showed their immunization information using a SMART Health Card (SHC) credential, a medical standard that gained rapid adoption. The paradigm of presenting information about oneself can easily be generalized beyond this health scenario.
In this presentation, I’ll first give an overview of the SHC framework, focusing on its security features and describing its deployment in the United States and Canada, sharing the lessons learned from such a challenging effort. I’ll then present a generic framework to issue QR codes that can encode attributes of any type. I’ll also introduce a strong privacy feature allowing users to only disclose a subset of the encoded attributes, addressing one privacy critique of SHCs. Finally, I’ll give a demonstration and describe the open-source specification and reference implementation for this generic framework.