EUDCC QR codes vs NHS “Travel” barcodes vs TAC Verify

[diziet]

The EU Digital Covid Certificate scheme is a format for (digitally signed) vaccination status certificates. Not only EU countries participate - the UK is now a participant in this scheme.

I am currently on my way to go skiing in the French Alps. So I needed a certificate that would be accepted in France. AFAICT the official way to do this is to get the “international” certificate from the NHS, and take it to a French pharmacy who will convert it into something suitably French. (AIUI the NHS “international” barcode is the same regardless of whether you get it via the NHS website, the NHS app, or a paper letter. NB that there is one barcode per vaccine dose so you have to get the right one - probably that means your booster since there’s a 9 month rule!)

I read on an forum somewhere that you could use the French TousAntiCovid app to convert the barcode. So I thought I would try that. The TousAntiCovid is Free Softare and on F-Droid, so I was happy to install and use it for this.

I also used the French TAC Verify app to check to see what barcodes were accepted. (I found an official document addressed to French professionals recommending this as an option for verifying the status of visitors to one’s establishment.) Unfortunately this involves a googlified phone, but one could use a burner phone or ask a friend who’s bitten that bullet already.

I discovered that, indeed:

• My own NHS QR code is not accepted by TAC Verify
• My own NHS QR code can be loaded into TousAntiCovid, and added to my “wallet” in the app
• If I get TousAntiCovid to display that certificate, it shows a visually different QR code which TAC Verify accepts

This made me curious.

I used a QR code reader to decode both barcodes. The decodings were identical! A long string of guff starting HC1:. AIUI it is an encoded JWT. But there was a difference in the framing: Binary Eye reported that the NHS barcode used error correction level “M” (medium, aka 15%). The TousAntiCovid barcode used level “L” (low, 7%).

I had my QR code software regenerate a QR code at level “M” for the data from the TousAntiCovid code. The result was a QR code which is identical (pixel-wise) to the one from the NHS.

So the only difference is the error correction level. Curiously, both “L” (low, generated by TousAntiCovid, accepted by TAC Verify) and “M” (medium, generated by NHS, rejected by TAC Verify) are lower than the “Q” (25") recommended by what I think is the specification.

This is all very odd. But the upshot is that I think you can convert the NHS “international” barcode into something that should work in France simply by passing it through any QR code software to re-encode it at error correction level “L” (7%). But if you’re happy to use the TousAntiCovid app it’s probably a good way to store them.

I guess I’ll find out when I get to France if the converted NHS barcodes work in real establishments. Thanks to the folks behind sanipasse.fr for publishing some helpful backround info and operating a Free Software backed public verification service.

Footnote

To compare the QR codes pixelwise, I roughly cropped the NHS PDF image using a GUI tool, and then on each of the two images used pnmcrop (to trim the border), pnmscale (to rescale the one-pixel-per-pixel output from Binary Eye) and pnmarith -difference to compare them (producing a pretty squirgly image showing just the pixel edges due to antialiasing).

Comments

[mtbc]

Thank you for investigating and reporting, interesting and useful, and curious indeed. Good luck with bearing something acceptable! (And enjoy the skiing. (-:)

[diziet]

Thanks :-). (and sorry for the delay unscreening your comment)

I can confirm that the converted QR codes work - both as presented on a phone, and [rinted and laminated copies. Those are great for the ski environment, compared to a phone with a battery and an aversion to water and everything...

Also, yes, the skiing is great :-)