Certificat numérique COVID EU : étude de cas QR Code
More than 2.3 billion certificates across over 50 countries make the EU Digital COVID Certificate one of the largest QR deployments ever attempted. Each symbol carries a health record, whether vaccination, test or recovery, in CBOR, signed with a COSE Sign1 structure using ECDSA P-256, compressed with zlib and encoded in Base45, producing a payload prefixed HC1:. Every one of those choices was driven by size. CBOR cuts the payload by 50 to 70 per cent against JSON, which is what allows a signed credential to fit inside a symbol at all, and COSE is the CBOR-native counterpart to JWS.
EU Digital COVID Certificate: QR Code Case Study
The EU Digital COVID Certificate (DCC) was one of the largest QR code deployments in history — over 2.3 billion certificates issued across 50+ countries. Its technical architecture offers lasting lessons for credential systems.
Architecture Overview
The DCC QR code encodes:
- Health data (vaccination, test, or recovery record) in CBOR format
- Digital signature using COSE (Sign1 structure) with ECDSA P-256
- Compression with zlib to reduce QR code size
- Base45 encoding for QR code compatibility
The resulting QR code starts with HC1: followed by the Base45-encoded payload.
Why These Technology Choices
CBOR over JSON: Binary format reduces payload size by 50-70% compared to JSON, critical for fitting data within QR code capacity limits.
COSE over JWS: COSE is the CBOR equivalent of JOSE/JWS. It produces shorter signatures and integrates naturally with CBOR payloads.
Base45 over Base64: Base45 is optimised for QR code Alphanumeric mode (5.5 bits/char vs 8 bits/char for Base64 in Byte mode), reducing the QR code version needed.
Offline Verification
The critical design requirement: verification without internet connectivity. Airport gates, border checkpoints, and event venues needed to verify certificates without a network connection.
This was achieved through: - Pre-distributed signing certificates (public keys downloaded periodically) - Self-contained certificates (all data in the QR code, no server lookup required) - ECDSA P-256 signatures (compact, fast verification)
Security Measures
- Each country had its own signing key pair (Document Signer Certificate)
- Key revocation lists distributed through the EU Gateway
- Certificates had embedded validity periods
- Fraud detection through cross-country verification data sharing
Lessons for Future Credentials
- Compact encoding is essential: CBOR + Base45 was the right choice for QR code capacity
- Offline verification is achievable: With pre-distributed public keys
- Interoperability requires governance: The EU Gateway coordinated 50+ countries
- Privacy by design: Minimal data in the certificate, no central database of scans
- Sunset planning: Clear timeline for deactivation when no longer needed
Key Takeaways
- 2.3 billion DCC certificates demonstrated QR code credentials at global scale
- CBOR + COSE + Base45 optimised payload for QR code capacity
- Offline verification with pre-distributed keys eliminated connectivity requirements
- Multi-country interoperability required centralised governance (EU Gateway)
- The DCC provides a template for future digital credential systems