Solved: Ability to include Photographs in Secure PDC QR codes

Rajesh Soundararajan
Jul 03, 2021
5 min read

The PDC vs EDC debate takes a new turn

One of the crucial decisions to be made while implementing QR code-based security in documents is the PDC vs EDC decision.

Very simply - PDC or Primary Data Code is a self-contained QR code that contains textual data and can be verified offline. EDC or Extended Data Code can have images and files, but since these are bigger, they are not stored inside the QR code itself but stored as encrypted blobs in storage (like AWS) and fetched using the key in the QR code. Hence there is a need for network connectivity to make EDC codes work.

Have you ever wondered why some QR codes have a small footprint, and some are so large?
Why are there still so many ID card frauds despite so many QR codes on ID cards?

Traditionally, a PDC code is used extensively for simplicity in security as all data is inside the QR itself. However, its size is dependent on the amount of data inside and for a manageable size of the code, the data cannot exceed, say, 2 KB. This means images cannot be stored inside it, and they can’t be used for purposes such as an ID card with a photo. So if you have an ID card with PDC code, it would be able to capture only textual data and this is not as foolproof as having a photo of the person as well hence the possibility of ID card fraud may be higher.

On the other hand, the (EDC), as the name suggests, can give access to a much larger amount of data. Since the data is not stored inside the code but is fetched as encrypted blobs from external storage, the size of the QR itself is independent of the amount of information and can therefore be made fixed. This is very useful as the size of the QR code is no longer a constraint in dealing with different amounts of information. However, the verifier needs access to the internet to verify the content in the EDC code.

Since images can be accessed using such codes, a straightforward use case is ID cards. With little real estate for large QR codes, issuers often have EDC QR code on the ID card or have a PDC QR code if there is only text data.

THE PDC VS EDC DEBATE - factors to be considered

Offline Verification: PDC, by definition, does not need online verification or internet connectivity for the verifier.
Size: EDC, however, is prefered due to the fixed size irrespective of data that can be accessed using it. This makes it suitable for use cases such as ID cards - having a photograph embedded in the secure QR code is a great way to improve the security of the ID card manifold.
Revocation: Since PDC codes are self contained, there is no need or ability to make any changes once the code is issued. This may mean lesser flexibility in use cases where some change needs to be made after issuance.

PDC QR Code with Photos - points
THE ABILITY TO INTEGRATE PHOTOGRAPHS INTO PDC
HOW DID WE SOLVE THIS ?
WHAT ARE THE BENEFITS OF HAVING A PDC CODE WITH PHOTO ON AN ID CARD?

THE ABILITY TO INTEGRATE PHOTOGRAPHS INTO PDC

Traditionally, PDC code has only textual data. The addition of any images makes the size of the QR code bigger and becomes a problem for applications such as ID cards where real estate is fixed. . Thus, it was not possible to embed photos into a PDC, and one had to choose EDC codes. But this needed internet connectivity and could be an issue in places without such coverage but where ID cards needed to be verified.

HOW DID WE SOLVE THIS ?

With years of experience in digital signatures and compression technology, Qryptal secure QR codes can now embed photographs at a low resolution, even on PDC code. This innovation opens up the real opportunity to embed significantly higher security into ID cards that could work for verification in areas without internet connectivity.

WHAT ARE THE BENEFITS OF HAVING A PDC CODE WITH PHOTO ON AN ID CARD?

These PDC codes thus are self-contained and do not access from storage (not even as an encrypted blob-like in EDC). Hence they are very secure with no scope for data tampering Since this is not connected to the internet, it avoids privacy concerns, if any.

Is there a trade-off?

Yes, a minor trade-off, though, like with all PDC codes. These cannot be revoked as there is no back-end access.

Bottomline : You can now issue QR codes that have a small footprint with enough security of embedding low-res photographs. This would help in reducing ID card frauds without being intrusive and losing privacy.

Here are some samples which you can try by installing the app available at verify.demo-university.com