PHYSICAL CHANNEL
Why error correction and biometric degradation are separate failure surfaces, and why treating them as one produces the wrong card.
The first part of this series established the byte budget: roughly one kilobyte for a face, once the signature, metadata and serialization have been paid for, and a measured threshold at 960 bytes below which recognition accuracy degrades.
This part concerns everything that happens to that symbol after it leaves the issuing system. It contains one result that reverses a common design instinct.
Reed–Solomon is not graceful degradation
QR codes use Reed–Solomon coding over GF(256). Data is split into blocks; each block of k data codewords is extended with n − k error-correction codewords. The four levels correspond to approximately 7%, 15%, 25% and 30% recovery capacity.
Within a block, the decoder corrects up to ⌊(n − k)/2⌋ errors at unknown positions, or up to (n − k) erasures when positions are known. Below that limit, recovery is exact: every byte is restored perfectly. Above it, the decoder fails.
There is no middle. The payload emerges bit-identical or it does not emerge.
This is what makes a signed QR credential possible at all: a cryptographic signature requires the exact bytes, and a channel that returned “mostly correct” data would break verification entirely. The all-or-nothing property is a feature.
But it has a consequence that is regularly misread.
The instinct that produces the wrong card
Error correction protects the symbol against physical damage. It does not restore biometric detail that was removed before the image entered the symbol through cropping, downsampling or lossy compression.
If the symbol decodes, the verifier receives exactly the image the issuer encoded, including all of its compression artifacts. If the symbol does not decode, the verifier receives nothing. At no point does the error-correction level improve or worsen the biometric result.
What it does affect is capacity. At version 40, moving from level M to level H costs 1,058 bytes, reducing capacity from 2,331 to 1,273. At the smaller versions that actually fit on a card, the proportional loss is similar and the absolute figures are tighter.
Put the two facts together against the budget from part one:
Raising the error-correction level “to be safe” can push the face below 800 bytes, which is the region NIST measured as producing detectably elevated false-negative rates.
The instinct to add robustness can produce a card that decodes more reliably and matches less reliably. These are not the same kind of failure and they are not experienced the same way. A symbol that will not decode is a visible, attributable fault: the holder is sent to a desk, the card is reissued. A face that has been compressed past the accuracy threshold produces a small, diffuse increase in rejections spread across the whole population, often attributed to lighting, the camera or the holder instead of the encoding decision made years earlier.
The correct procedure is the reverse of the instinct. Fix the biometric payload at a size the accuracy data supports. Choose the symbol version that carries it. Then spend whatever remains on error correction. If nothing remains, the answer is a larger symbol or a smaller metadata set, not a smaller face.
What the physical channel actually does
The damage the error correction exists to absorb is well characterised and worth enumerating, because it determines what “whatever remains” needs to cover.
At issuance. Print resolution and dot gain matter because ink spreading on the substrate blurs module edges and shifts the effective threshold between light and dark. Registration error, substrate colour and gloss matter too. ISO/IEC 15415 defines the grading methodology for 2D symbol print quality, and it is the appropriate acceptance criterion at the personalisation line rather than a visual check.
Over the credential’s life. Cards are carried for five to ten years in wallets and pockets. Abrasion, creasing, delamination at the edges, ink transfer, ultraviolet fading, and the accumulation of surface scratches on the laminate. A symbol at level L that verified perfectly at issuance may not verify in year seven, and level selection is a decision about year seven, not day one.
At verification. Specular reflection from card laminate under overhead lighting is the dominant field failure and it produces localised erasures rather than distributed errors. Camera autofocus hunting at close range. Motion blur. Low illumination raising sensor noise. Perspective distortion when the card is not held flat. Rolling-shutter artifacts.
When displayed on a screen instead of printed. Moiré between the display’s pixel grid and the camera’s sensor grid, backlight PWM flicker interacting with the rolling shutter, and brightness set too low by the holder’s power-saving settings.
None of these are exotic. All of them are the reason the level cannot simply be set to L to maximise the face.
The half that is not about bytes
A QR code that carries a face and nothing else is not a credential. It is an assertion that anyone can manufacture with open-source tooling in a few seconds.
The signature is what makes it a credential, and it is worth being precise about what it establishes.
What the signature proves. That the payload was produced by the holder of a specific private key, and that it has not been altered since. If the corresponding public key is trusted as an issuing key, the verifier can attribute the payload to that issuer.
What the biometric match proves. That the person standing in front of the verifier resembles the person in the reference image, to within a threshold. It binds the credential to a holder.
What neither proves. That the enrolment was honest. That the reference image is of the person it names. That the credential has not been revoked since issuance. That the presenter is a live human rather than a photograph, a mask or a screen.
The last two deserve separate treatment, because both are structurally difficult in exactly the setting where these credentials are most attractive.
Offline verification does not include revocation
The value proposition of a signed QR credential is that it verifies without connectivity. The signature check requires only the issuer’s public key.
Revocation does not have this property. A credential reported lost, superseded or fraudulently obtained produces a signature that remains mathematically valid forever. An offline verifier can confirm authenticity and cannot confirm current validity.
This is the same distinction that separates cryptographic validity from business acceptance in any offline system: the primitive answers a narrower question than the operator needs answered. Mitigations include short validity periods forcing reissuance, periodically distributed revocation lists cached at verification points, and online checks where connectivity permits with offline use treated as a documented degraded mode. Each converts an architectural advantage into an operational obligation, and the choice should be made explicitly rather than inherited.
There is a related trap in key lifetime. A credential valid for ten years requires that its verification key remain trusted and available for ten years, across whatever algorithm transitions occur in that window. Post-quantum migration makes this concrete: the signature that fits the byte budget today is the one that a card issued today will still be presenting in 2036.
The finding that constrains the whole architecture
NIST’s report states it directly, and it is the most consequential sentence in the document for anyone designing an issuance process:
Compression to compact sizes effectively removes the possibility of detecting morphing or presentation attacks from the compact image itself.
Morphing, the blending of two subjects’ faces so that the resulting image matches both, is detected by analysing fine spatial structure and compression history. Compact-image preparation deliberately destroys much of that structure because the bit budget requires it.
The consequence is not that morphing is undetectable. It is that detection must happen before compression, in the issuance pipeline, on the parent image. The artefact that ships cannot carry the evidence needed to evaluate itself.
This makes trusted capture a hard requirement rather than a best practice. The parent image must either be collected live in the presence of trusted staff, or passed through capable morphing and presentation-attack detection before the compact image is prepared. A system that accepts subject-supplied photographs and compresses them into signed credentials has placed an attack surface at its own front door, and the signature will attest to the resulting payload with full cryptographic validity.
Human review gets harder, not easier
When automated verification fails, the standard fallback is a person comparing the reference image against the presenter.
Published work on this is not encouraging. White and colleagues measured passport officers’ error rates on face matching; Phillips and colleagues compared forensic examiners, super-recognisers and algorithms. Human accuracy varies enormously even among trained professionals, degrades under time pressure, and is vulnerable to social engineering through deflection, distraction and confident manner.
Compact images make it worse in a specific way. The reviewer sees an image that has been downsampled, compressed, then upsampled by whatever software displays it, and the pipeline introduces artifacts that look like facial features but are not. NIST’s own illustration points to a dark spot on a lower eyelid that exists nowhere on the subject.
A reviewer trained to notice small distinguishing marks is being shown marks the codec invented.
Open questions
These are unresolved and each has a tractable experimental design.
- The level-versus-size trade, measured end to end. Fix a symbol version and card geometry. Sweep error-correction level against the resulting face size, and measure both decode failure rate on artificially aged cards and FNMR on the resulting images. Nobody appears to have published the joint curve, and it is the curve that determines the correct configuration.
- Failure mode of specular reflection. Glare produces contiguous erasures rather than distributed errors. Whether the interleaving in ISO/IEC 18004 handles a realistic glare footprint as well as it handles distributed damage is testable with a lightbox and a stack of cards.
- Accelerated ageing. Abrasion and flex testing against decode rate at each level, on real card stock, would convert level selection from folklore into a specification.
- Screen presentation. Decode rate as a function of display brightness, camera model and ambient light, for credentials shown on a phone rather than printed.
- Morphing detection floor. At what compression level does morph detection stop working? NIST states that compact-image preparation removes the possibility of reliable morphing detection from the compact image itself, but does not locate a precise boundary. Measuring that boundary, if one exists for a given detector, would be useful.
- Human accuracy on compact images. Expensive, confounded by many covariates, and explicitly not attempted by NIST. It remains the largest gap in the operational picture.
Two failures that are not the same failure
A 2D barcode credential contains two independent channels that are easy to conflate because they share one symbol.
The first is digital and binary. Reed–Solomon either recovers the bytes or does not, and the signature verifies or does not. This channel is governed by module size, print quality, wear and error-correction level.
The second is analogue and continuous. The face degrades through cropping, downsampling and lossy compression, and the degradation is permanent at the moment of issuance. This channel is governed by the byte budget and nothing else.
Error correction protects the first channel and is irrelevant to the second. Increasing it takes bytes from the second to strengthen the first. A design that treats robustness as a single dial will turn that dial in the direction that hurts.
The same byte budget can also be widened by changing the symbol itself. A companion note examines what a polychrome barcode gains and what it gives up.
References
- NIST SP 500-343: Preparation of Compact Face Images for 2D Barcodes, Grother, Ngan, Hom (2025)
- ISO/IEC 18004:2024: QR Code bar code symbology specification
- ISO/IEC 15415: Bar code symbol print quality test specification, two-dimensional symbols
- White D, Kemp RI, Jenkins R, Matheson M, Burton AM (2014). Passport officers’ errors in face matching. PLoS ONE 9(8): e103510
- Phillips PJ et al. (2018). Face recognition accuracy of forensic examiners, superrecognizers, and face recognition algorithms. PNAS 115(24)
- ISO/IEC 30107-3: Biometric presentation attack detection, testing and reporting
