ICAO VDS – Understanding the Global COVID Certificate Landscape

The ICAO VDS is a specification created, owned and governed by ICAO (International Civil Aviation Organization), the UN funded organization that develops standards for air transport and governs the e-passport system participated by over 100 states and non-state entities. It was originally developed for a visa counterfoil and emergency travel documents, providing these non-chipped documents a similar level of security to e-passports.

ICAO clearly defined the test result and vaccination dataset, which is aligned with the WHO DDCC recommendations. Using the recommended set, the vaccination dataset includes detailed identification information on the holder (name, date of birth, gender, passport number or other ID number). ​​The datasets for test and vaccination certificates are stored in a two-dimensional barcode which can be paper or digital-based. The VDS barcode is digitally signed based on the same two-level PKI infrastructure already used to support ePassport issuance and authentication. ICAO is recommending countries to use the same trust anchor (CSCA) from the ePassport, given this offers the immediate benefit of making the verification process simpler for border systems globally. 

The ICAO VDS may require custom hardware in practice for scanning. It is not clear if it can work on mobile phones or if they have tested it with mobile phones for production outside of border control use cases. If special hardware is indeed needed for verification, there is likely going to be limited adoption of this standard.

So far, Australia is the only country that is implementing ICAO, while Japan seems to be considering this option. We are currently not aware of any open source implementations of the ICAO specification.