Skip to content


Repository files navigation

Trivial/rudimentary eHN-simplified implementation

Aligned with version 1.00 / 2021-4-14 of the spec:

For round-trip testing of and take some JSON, e.g. { "Foo" : "Bar }, CBOR package, COSE sign, compress and base45 convert it for use in a QR.

  1. COSE sign
    1. compact the JSON into CBOR
    2. wrap it into a payload (Health claim -260, add issuer/dates)
    3. sign and package as a COSE message
    4. ZLIB compress
    5. Base45 encode
  2. COSE verify
    1. Base45 decode
    2. ZLIB decompress
    3. check the signature on the COSE message
    4. unpack the CBOR into JSON
    5. unpack the payload and extract the issuer and dates
    6. unpack the health claim and output as json.

Decoding a barcode from production (i.e. a DCC in the wild)

 qrdecode photo.jpg | python3 ./ -v -U -p


 qrdecode photo.jpg | python3 ./ -v -i -p

The first will check against the Dutch copy of the eHealth trustlist; the second version, with the -i, will not check the actual signature. The typical output will look like:

Correct signature against known key (kid=3lTmAZX19GQ=)
Issuer              : NL
Experation time     : 1626966160
Issued At           : 1624546960
Health payload      : {
    "dob": "XXXX-XX-XX",
    "nam": {
        "fn": "xxx Xxxxx",
        "fnt": "XXX<XXXXX",
        "gn": "Xxxx Xxxxxx",
        "gnt": "XXXX<XXXXXX"
    "v": [
            "ci": "URN:UCI:01:NL:......#:",
            "co": "NL",
            "dn": 1,
            "dt": "2021-06-07",
            "is": "Ministry of Health Welfare and Sport",
            "ma": "ORG-100001417",
            "mp": "EU/1/20/1525",
            "sd": 1,
            "tg": "840539006",
            "vp": "J07BX03"
    "ver": "1.3.0"

Test Steps

  1. Generate the CSCA and DSC with ./
  2. Run the command: echo '{"A": 1234}' | python3.8 | python3.8
  3. You should see the output: {"A": 1234}
echo '{"Foo":1, "Bar":{"Field1":"a value", "integer":1212112121}}' | \
    python3 | \
    python3 --prettyprint-json

Which should output:

    "Foo": 1, 
    "Bar": {
        "Field1": "a value", 
        "integer": 1212112121

Testing COSE from Austrian website

Testing against the AT cases:

  1. Fetch the Base45 from

  2. Remove the first 2 bytes and do

    pbpaste | sed -e 's/^00//' | \
        python3 --base64 --ignore-signature --cbor


Extremely minimal python implementation of the eHN-S protocol.








No releases published


No packages published