Reversing 'France Identité': The New French Digital ID
reversemode.com
Reversing 'France Identité': The New French Digital ID
1–10 of 90 posts
Re: Reversing 'France Identité': The New French Digital ID
#2Didn't notice it at first, but this is Ruben Santamarta's site.
Re: Reversing 'France Identité': The New French Digital ID
#3I am far from understanding the technical details.
But it feels like they severly violated the rule of not running your own cryptography. If they had used TLS the MITM would have been much less likely as long as the app does not accept user-defined cerificates?
Re: Reversing 'France Identité': The New French Digital ID
#4Didn't notice it at first, but this is Ruben Santamarta's site.
Not a name known to me. But he seems to understand his business.
Re: Reversing 'France Identité': The New French Digital ID
#5I wonder why do they need the whole secure channel thing instead of making the card hold a client certificate and use standard mutual TLS with their backend server.
Re: Reversing 'France Identité': The New French Digital ID
#6I wonder why do they need the whole secure channel thing instead of making the card hold a client certificate and use standard mutual TLS with their backend server.
I would not bet on it. But there is pretty low constraints on what you can do and can not with an NFC chip.
Your budget in term of compute and memory is extremely low. I would be surprised a proper RSA/ECDSA signature from an X509 certificate can hold there.
Very likely I would say no. And that's why the home made crypto.
Re: Reversing 'France Identité': The New French Digital ID
#7The idea is terrible even from the first lines, relying on the hardware key attestation means giving up the id card to Google and Apple approved devices which is absolutely not what you want as a country.
Re: Reversing 'France Identité': The New French Digital ID
#8I wonder why do they need the whole secure channel thing instead of making the card hold a client certificate and use standard mutual TLS with their backend server.
It's because the people implementing the solution need to put enough time and complexity on the budget so that they will get paid.
Government work is so much fun.
Re: Reversing 'France Identité': The New French Digital ID
#9I wonder why do they need the whole secure channel thing instead of making the card hold a client certificate and use standard mutual TLS with their backend server.
I would not bet on it. But there is pretty low constraints on what you can do and can not with an NFC chip. Your budget in term of compute and memory is extremely low. I would be surprised a proper RSA/ECDSA signature from an X509 certificate can hold there. Very likely I would say no. And that's why the home made crypto.
Why not do the same thing credit cards or access smartcards do?
There are many electronic ID systems in EU already and none of them have homegrown crypto...
Re: Reversing 'France Identité': The New French Digital ID
#10Does anyone know why a private govtech business like Palantir doesn’t take over all these use cases? Governments are notoriously bad at tech, why isn’t there a massive private corporation catering to all these use cases and ensuring state of the art security? Instead of hiring local clowns that release half baked solutions like this.