Mikey Whiston
Editor’s comment: At the RIA Innovation Conference Rail Data Marketplace Hackathon, developers were challenged to create an app helping passengers understand validity of their ticket. The winning entry, Sentinel, was developed by 16-year-old Mikey Whiston. Using RSP-6 barcode standards and Rail Delivery Group fare data specifications, the app determines exactly which trains a ticket can be used on. Here he describes how this was done.
Standing on a rainy platform at Erdington station at 08:00, the barrier between a passenger’s travel intent and the machine’s enforcement logic is invisible but absolute. As the industry navigates the transition towards Great British Railways (GBR), we face a widening contractual gap – the divergence between natural language summaries presented to passengers, and the machine truth – the raw RSPS5045-02 restrictions that govern the gateline. To secure our national infrastructure, we must move beyond probabilistic estimations and into the world of deterministic validation.
I first encountered this complexity while competing in the Rail Data Marketplace challenge. What began as an exploration of rail data quickly revealed a systemic challenge: how do we ensure that a passenger’s ticket (physical or digital) is validated with deterministic accuracy nationally?
The standard behind digital tickets
Most passengers are now familiar with the Aztec code (the square barcode often called a QR code) on their phones. Under the RSP6 standard, this is more than just an image; it is a cryptographically signed envelope. Every accredited ticket issuer submits public keys to a central repository managed by the Rail Delivery Group.
To parse an RSP6 payload, a validation engine must identify the Issuer Key within the bitstream and attempt a PKCS#1 v1.5 RSA validation. If the decrypted block matches the expected pattern, the ticket is mathematically verified. Beyond the signature, the engine must resolve specific bit-ranges for the origin, destination, and route codes. In this world of high-speed logic, even a 1-bit encoding desync can result in a passenger being incorrectly flagged for a penalty fare.
Physical tickets: signal vs. entropy
While digital tickets use clean bitstreams, physical ticket stock introduces significant signal entropy. The high-frequency security watermarks – designed for human anti-forgery – act as background noise for Optical Character Recognition (OCR). To a computer, it can be difficult to distinguish station text from the ‘National Rail’ motifs printed behind it.
To achieve accuracy in my Sentinel ecosystem, I engineered an approach that moves beyond simple image processing. I utilised a homoglyph replacement matrix. By comparing scanned data against the finite dictionary of UK restriction codes and replacing visually similar characters (like a ‘0’ for an ‘O’) based on the known interference pattern of the watermark, the engine reconstructs the original contractual intent from a high-entropy image.
Smartcards: the symmetric boundaries
The transition to smartcard infrastructure (such as the ITSO standard) introduces a different tier of risk: symmetric cryptography. Unlike the asymmetric model of Aztec codes – where a public key can verify a ticket without being able to forge one – symmetric systems often rely on shared secrets.
The keys required to read these cards must remain strictly unavailable to the passenger, as the same secrets used to validate a journey often possess the permissions to alter the data on the card itself.
Conclusion
As the rail industry scales, managing these master keys remains a defining architectural challenge: balancing the demand for ‘offline-first’ validation with the absolute requirement for national network security. As we move towards GBR, we must make an effort to unify all forms of ticketing media to solve the challenges that currently plague universal ticket validation. Only by unifying these validation streams can we provide a cryptographically secure, operationally efficient service to the rail commuter.
Image credit: iStockphoto.com / Raw Pixel