On this page
Between 16 January 2021 and 17 July 2022, India gave 2,00,00,15,631 COVID-19 vaccine doses by a provisional count, according to the Press Information Bureau release on the 200 crore milestone. Behind the drive was CoWIN, the government's vaccination platform. Underneath sit three ideas from computing class: a database key, a QR code and a digital signature.
How did CoWIN keep track of who got which dose?
The Health Ministry's CoWIN: Myths Vs Facts release of 9 May 2022 says registration needed a mobile number, name, year of birth and gender, with a choice of 9 photo identity proofs. The same release says the platform had handled over 190 crore doses for over 100 crore registered residents.
The ministry wrote that using the same mobile number for the second dose was "the only mechanism" for tagging both doses to one beneficiary. A different number meant the second shot was recognised as a fresh first dose, and the same identity proof could not be used across two mobile numbers.
One way to picture this in database terms: people and doses are two tables, and each dose row points back to its person through a foreign key.
Why couldn't CoWIN just match people by name?
In May 2022, media reports alleged that glitches in CoWIN had left 2.5 lakh people in Pune district with two first-dose certificates. The ministry's reply in the same PIB release put such cases down to manual data-entry errors, not a glitch, and explained why the system would not guess: "With a country of a billion plus, there may be hundreds of thousands of individuals with the same name, age, and gender." Instead, CoWIN prompts a merge when name, age and gender match across two ID proofs on one mobile number. People can also merge two matching first-dose certificates from accounts they know are theirs.
What is inside the QR code on a vaccine certificate?
CoWIN's certificates are produced by DIVOC (Digital Infrastructure for Verifiable Open Credentialing), integrated with CoWIN in January 2021. DIVOC's page on India's certificates says a certificate is generated in real time when a vaccination record is created, and reports over 1.9 billion issued in India, with figures dated April 2022.
A normal QR code usually holds a web link. A signed QR code, as DIVOC's documentation explains, holds the data itself, digitally signed. A 2021 analysis by the Centre for Internet and Society found that all the personal details printed on the certificate are also encoded in its QR code.
According to DIVOC's verification steps, the scanner reads zipped binary data, unzips it into a JSON certificate, checks the signature against the issuer's public key, then checks that the certificate has not been revoked.
How does a digital signature prove a certificate is real?
The issuer holds two linked keys. The private key, kept secret, makes signatures; the public key, given to everyone, checks them. DIVOC supports 2048-bit RSA keys (its default) or Ed25519 keys, according to its key-pair setup guide.
The textbook RSA example uses the public key n = 3233, e = 17 and the private key d = 413. Here is a toy signature with those numbers.
Pretend the certificate's data boils down to the fingerprint 2790. Real systems use a hash function.
The issuer signs with the private key: 2790^413 mod 3233 = 65. The QR code carries the data and the signature 65.
A verifier uses the public key: 65^17 mod 3233 = 2790. The fingerprint recomputed from the data is also 2790: valid.
Someone edits the dose date. The data now gives a different fingerprint, but 65^17 mod 3233 is still 2790. Mismatch: "Certificate Invalid".
A forger needs d to sign. With n = 3233 they could find it, since 3233 = 61 × 53; for a 2048-bit key, no known method can factor n in any practical time. Our explainer on how RSA encryption uses prime numbers shows why.
One caveat: CIS found that the official verifier also ran a revocation check each time a certificate was verified, sending certificate details to the server on every scan.
What can you borrow from CoWIN for your own project?
Building a sign-up form for a school fest or club? Ask five questions:
What is the key? Pick something unique and stable, or generate an ID.
What happens if one person signs up twice? Write the merge rule before launch.
What goes on the shareable proof? Only what the checker needs; CIS suggested removing demographic details such as age and gender.
Can someone check it without trusting your server? A signature beats a link.
How are mistakes fixed or cancelled? Plan corrections and revocation from day one.
For another Indian system built on checked records, read how UPI works technically, and for the rules on young people's data, see the DPDP Act and children's data explained. If modular arithmetic or hashing is the shaky part, the Fermi Concept Library has every concept in physics, chemistry, biology, mathematics and computing, each with its own lesson and its place in the map.
