So... looks like it's using ES256. How long would it take to factor the private key?
Digging into Quebec's electronic proof of vaccination
11–20 of 42 posts
Re: Digging into Quebec's electronic proof of vaccination
#12There's a nice JavaScript/node version of the decoding code that you can run locally on the shc:/... QR code value here:
https://gist.github.com/remi/e3aa2f78845ee13f706ed83aead5145...
There's also an online version (that works on mobiles and desktops) and decodes everything on the client side:
Re: Digging into Quebec's electronic proof of vaccination
#13Québec's government has historically been incompetent regarding anything digital (a lot of their website are still barely usable), but I want to give credit where credit is due: their vaccine appointment website as well as their proof-of-vaccination has been really well done.
They've made a lot of efforts recently. Their new official website (quebec.ca) is clean, fast and straightforward and the new website for public healthcare (RAMQ) is nice but they still have a lot of improvements to do for administrative procedures. In february I had to renew my health insurance card: I had to call them to send me a paper form to fill and send back by post. Few weeks later they sent me a (paper) mail saying that my new card "will be coming shortly" and few days after I received my card.
Re: Digging into Quebec's electronic proof of vaccination
#14Québec's government has historically been incompetent regarding anything digital (a lot of their website are still barely usable), but I want to give credit where credit is due: their vaccine appointment website as well as their proof-of-vaccination has been really well done.
As an immigrant from the US, I find most of Quebec's government websites to be quite good actually. But maybe that's just my low standards.
I interact the most with AFE (aide financière aux études) and FRQNet (grad school scholarships). These websites look like they weren't updated since about 1999 and are really, really counter-intuitive to use. Admittedly, they're also probably not the most used websites, and not high in their priority list.
Re: Digging into Quebec's electronic proof of vaccination
#15Québec's government has historically been incompetent regarding anything digital (a lot of their website are still barely usable), but I want to give credit where credit is due: their vaccine appointment website as well as their proof-of-vaccination has been really well done.
I get the sense everybody thinks their particular government is specifically bad at IT services.
Re: Digging into Quebec's electronic proof of vaccination
#16So... looks like it's using ES256. How long would it take to factor the private key?
A lot of time... if you're not NSA
Re: Digging into Quebec's electronic proof of vaccination
#17Québec's government has historically been incompetent regarding anything digital (a lot of their website are still barely usable), but I want to give credit where credit is due: their vaccine appointment website as well as their proof-of-vaccination has been really well done.
I get the sense everybody thinks their particular government is specifically bad at IT services.
Quebec actually specifically has a reputation of being slow to adopt technology relative to Canada.
Here’s some results of a longstanding poll. There have also been various official reports to this effect.
https://www.ctvnews.ca/mobile/sci-tech/canada-s-francophones...
Re: Digging into Quebec's electronic proof of vaccination
#18The underlying cryptographic technology here: "Verifiable Credentials" is quite exciting. If you have ever wondered "why aren't bureaucracies using digital signatures?" then VCs are interesting. It's a pretty decent technical spec for signing statements like "This person has this age" or "this person is vaccinated" or "this person is authorized for this bank-account as executor of a will". It is a spec written by cry…
I've worked with VCs and personally I found them unnecessarily complex and over hyped by a certain gang of people/companies. all the hyped benefits causes dependancy on being available to download contexts, access lists/blockchains of public signatures etc etc
Re: Digging into Quebec's electronic proof of vaccination
#19Earlier quoted context omitted.
As an immigrant from the US, I find most of Quebec's government websites to be quite good actually. But maybe that's just my low standards.
Most government or government-adjacent (sépaq, Hydro Québec) websites are pretty decent. There's a few awful exceptions like the SAAQ disabling their online services at 11pm, as if their servers need to go to bed? Or the city of Longueuil's tax portal which looks like it is from the 90s!
Hydro Québec lets me download a CSV of my energy usage for my own analytics if I want. I find that pretty neat.
Re: Digging into Quebec's electronic proof of vaccination
#20So... looks like it's using ES256. How long would it take to factor the private key?
The security of elliptic curve cryptography is based on discrete logarithms; there’s nothing to factor. Until we get very large quantum computers, the best known attacks are brute force searches taking about 2^128 steps for a 256-bit elliptic curve, which is far outside the realm of practical.