Pakistan’s newly announced QR code based Computerized National Identity Card (CNIC) design has sparked discussion among cybersecurity professionals and digital identity experts, with several industry voices questioning the security architecture behind replacing the previously introduced chip based card with a printed QR code. While the redesign has been presented as part of a move toward a simplified and locally sustainable identity system, experts have raised concerns about authentication, privacy, offline verification and the long term security implications of the new approach.
The discussion gained renewed attention after cybersecurity professionals referenced an earlier implementation by Pakistan Software Export Board (PSEB), which embeds a JSON Web Token (JWT) inside the QR code printed on its registration certificates. According to industry experts, PSEB QR code does not simply direct users to a website but instead contains structured certificate information, including registration number, certificate type, issue timestamp and expiry timestamp. The token is cryptographically signed, allowing verification of its integrity. However, experts noted that the current implementation relies on the HS256 symmetric signing algorithm, meaning verification still requires communication with PSEB because only the organization possesses the shared secret needed to validate the token. They suggested that moving to an asymmetric signature algorithm such as EdDSA using Ed25519 or ECDSA with ES256, along with publishing a public key through a standard JSON Web Key Set endpoint, would enable independent verification by banks, financial institutions and other third parties without requiring direct integration with PSEB systems. According to the experts, this approach could significantly reduce manual document reviews and speed up verification processes for freelancers and IT exporters whose registration certificates are frequently required for payment processing, tax treatment and purpose code classification.
Following NADRA announcement of the redesigned chipless QR code based CNIC, cybersecurity professionals questioned why a similar cryptographic approach was not adopted. One expert argued that if the published design represents the final version, the QR code occupies a large portion of the card because it appears to contain a compressed image rather than encrypted identity data. Instead of embedding a photograph, they suggested that a JWT carrying encrypted CNIC information would provide stronger protection while allowing secure verification. They also stated that with NADRA extensive digital infrastructure, server based verification would be technically achievable today, while future versions could incorporate public key infrastructure using asymmetric cryptography to support secure third party verification without requiring users to access NADRA website for every authentication request. The experts also expressed interest in understanding the technical and operational considerations that influenced NADRA decision to adopt its current QR code implementation.
Additional concerns were raised regarding the overall security model of replacing an embedded chip with a printed QR code. Cybersecurity specialists argued that a printed QR code can be photographed, copied and reproduced on counterfeit identity cards because it lacks the cryptographic challenge response capabilities available in chip based credentials. They also warned that verification would become dependent on internet connectivity and access to NADRA servers, limiting authentication capabilities in offline environments where chip enabled identity cards could continue functioning. Privacy was another area of concern, with experts noting that anyone capable of scanning the QR code could potentially access the encoded information. They further pointed out that unlike secure chips, printed QR codes cannot securely store biometric templates or perform protected identity verification, and once copied, the information remains static throughout the validity of the card. While acknowledging that reducing reliance on imported chips may have financial or procurement benefits, cybersecurity professionals emphasized that many countries continue to strengthen electronic identity systems through advanced cryptographic technologies rather than simplifying them. They have invited NADRA and digital identity experts to share the technical rationale behind the new design and participate in further discussion on balancing operational efficiency with identity security.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
