GKP1 specification — QR-verifiable credential.

The GKP1 format encodes an offline-verifiable credential in a payload compact enough to fit in a printable QR code. It draws on the European Digital Covid Certificate format and on IETF work on compact cryptographic credentials.

Section 1 — Transformation chain

A GKP1 credential is produced by the following chain:

Structured data
  → canonical CBOR (RFC 8949)
  → COSE_Sign1 ES256 (RFC 8152, NIST P-256 ECDSA key)
  → zlib compression (RFC 1950)
  → Base45 encoding (RFC 9285)
  → prefix with the literal string "GKP1:"
  → QR-code rendering

The prefix GKP1: lets a universal reader identify the format unambiguously.

Section 2 — CBOR payload

The signed CBOR structure is a COSE_Sign1 whose payload carries:

iss: issuer identifier.
sub: subject identifier (person, entity, object).
iat: issuance timestamp.
exp: expiration timestamp (optional).
claims: claims dictionary, following the issuer-defined schema.

Section 3 — Signature algorithm

The signature is a COSE_Sign1 ES256 using an ECDSA key on the NIST P-256 curve. The COSE protected header carries the key identifier (kid) that lets the verifier resolve the matching public key from its local store.

Section 4 — Size and constraints

The size target is to fit in a QR code of version 22 or lower with M error correction, about 1000 alphanumeric characters after Base45. A shorter credential is preferred.

For longer payloads, the specification defines a GKP1-CHAIN mode that allows splitting a payload across several successive QR codes.

Section 5 — Offline verification

The verifier (for example Gankpo Reader) keeps a local store of trusted issuer public keys. It can verify a GKP1 signature with no network call. Updates to the key store are performed during online synchronisation phases.

Section 6 — Revocation

The revocation of a GKP1 credential is carried by a revocation list published by the issuer and periodically synchronised by the verifier. The detailed specification of this mechanism is on the revocation model page.

Section 7 — Interoperability

The GKP1 format is not an international standard. It is designed to coexist with formats such as ISO 18013-5 and W3C Verifiable Credentials, without constituting a compatibility or certification claim.