Hacker News Reader

How does the scanner app verify the signature? Does it always have to be online, or does it have a set of trusted public keys included?

How are the codes generated to begin with? Is there some central database that hands them out, or can any clinic generate one (having access to a copy of the private key?)

View on HN

The verification app needs to maintain a set of trusted certificates. More details on the trust model can be found here: https://github.com/ehn-dcc-development/hcert-trust/blob/main...

Infrastructure for code generation and signing is probably country-specific, though I imagine most countries will establish centralized systems dealing with this and integrate with other systems that track vaccination or test records on various levels (some countries delegate vaccination efforts to their states, others handle it nationally, etc.)

Great, thanks for the details!

Reply on news.ycombinator.com