Private keys used to sign EU Digital Covid Certificate might have been leaked

The interesting thing to watch, over the coming days, is this: will the public policy response do the technically correct thing, and make sure that you need all your original documentation (signed records from the doctor's office, etc.) to get your new covpass issued? Or will they do something incorrect (but easy), like let people come in with their now-invalid pass plus a government ID to get a new one issued?

Just to add some additional detail: The article explains that 83% had antibodies as of May 2021, and that number should be expected to have increased based on additional vaccinations and delta wave infections. Their research will continue until December 2021.

I agree with you that the response of many governments to this does not appear to be following the science.

[0] https://www.miamiherald.com/news/coronavirus/article25398704...

Certainly if you have a private key and you want to prove that you know the key, you can trivially make documents that only somebody with the key could make, that aren't documents any system would give people who don't have the key and yet also aren't useful fictitious documents if you're acting as a whistleblower.

That's what was done when a certificate reseller emailed the private keys of their customers to the CA they were reselling - for some reason that's unclear. The CA minted CSRs that showed they now knew the private key, without revealing what it is, and so we could all see that yup, somebody sent this CA the private keys, game over for those certificates.

[ PSA: They're called private keys, not secret keys or shared keys for a reason. Where possible you should choose your own private keys randomly and never reveal them to anybody ]

In case of a leaked private key where the actual PKI wasn't breached, they still have authority over the CA itself and can therefore determine which certs are valid and which are fake.

This retains validity of the known issued certificates, but invalidates fraudulently issued certificates. The downside is that its an optional check and that every client needs an online connection in order to validate the cert.

Anyway, the COVID certificates don't seem to be actual X.509 certificates and are rather just a signed message, so this isn't something that could be utilized right now.

This QR code proves Adolf Hitler has received 2 doses of Pfizer vaccine. At the moment you can still use the Estonian app to verify this (https://kontroll.digilugu.ee). Probably this specific cert will be revoked soon in all the apps.

But the cat is out of the bag. Everyone's grandparents will need to do the certificate retrieval dance again, which is another confusion that we did not need at this critical junction.

Someone out there has a serious problem with ethics. Or someone really screwed up to the point where it was obvious that a responsible disclosure was already a moot point. In my experience, CERT-EU is normally very competent and would have handled it professionally.