ICAO Creates Global Directory of Public Keys to Authenticate Health Credentials

(02 Feb 2022)  The International Civil Aviation Organization (ICAO) has created a global directory of public keys required for authentication of health credentials.

The directory, called the Health Master List (HML), is expected to make a significant contribution to the global recognition and verification (interoperability) of government issued health credentials.

A public key enables third parties to verify that a QR code displayed on a health credential is authentic and valid.

Malaysia Airlines A359 reg: 9M-MAB. Picture by Steven Howard of TravelNewsAsia.com

The HLM is a compilation of public key certificates signed by ICAO and regularly updated as more health proofs are issued and new public keys are required. Its implementation is designed to ease the global recognition of health credentials outside of the jurisdiction in which they were issued.

“For international travel today, it is critical that COVID19 health passes can be efficiently verified outside of their country of issuance,” said Willie Walsh, IATA’s Director General. “While the keys for verification are available individually, the creation of a directory will significantly cut complexity, simplify operations and improve trust in the verification process. We encourage all states to submit their public health keys to the HLM.”

The sharing of public keys used to perform this verification does not involve any exchange of or access to personal information. The HML is available on the ICAO website and all states can upload their public keys and download those of other governments.

Through a pilot project associated with the HML, private sector providers of solutions for governments to verify health credentials will also be able access the keys. This will help facilitate the broadest coverage of health certificates in their offerings as international travel continues to ramp-up. IATA will participate in this pilot program to support the deployment of the IATA Travel Pass.

One ID and Digital IDs

The air transport industry’s interest in this type of directory goes beyond the COVID19 crisis.

One ID uses digital identity management and biometric technologies to streamline travel by eliminating repetitive checks of paper documents.

The contactless checking of travel health credentials is advancing the experience needed to operationalize One ID. The challenge is the same: universal recognition of verified digital credentials irrespective of the jurisdiction in which they were issued, or the standard used.

The successful sharing of public keys to verify COVID19 health certificates will demonstrate that similar keys for digital identity documents can also be securely and efficiently be collected and shared, including with private sector solution providers.

“COVID19 Health Certificates must be removed as we progress towards overall travel normalization and industry recovery,” said Walsh. “But we must retain and build on the operational experience of verifying certificates globally. That includes securely sharing access to public keys with private sector solution providers. This will help to drive progress for contactless verification of traveler identities for which similar keys are needed. We cannot underestimate how important this will be for the implementation of One ID which has the potential to dramatically simplify travel.”