31–40 of 55 posts
Earlier quoted context omitted.
Other governments take note his is what putting all your eggs in one basket looks like.
In the U.S. we also put all our eggs in one basket, but instead of that basket being a digital certificate/smartcard, it's a nine-digit number that we use as both userid and password.
Earlier quoted context omitted.
Spain does the same. With you ID card chip, you can: - sign your emails digitally - login to secure websites with your id card (bank, DMV, taxes, …). Sometimes you can only do it with the ID card - they opened many of their tools, so you can design your website to allow login with Spain's ID cards (that was a fun project)
Were these cards affected? Were there any official notices from authorities? Even if not affected, it would be nice to hear an official comment. I was discussing this with someone from Belgium and we agreed that silence from the Belgian government meant only one thing: nobody used the service. (Specifically: Belgian cards are the older Gemalto generation, thus not affected, like the older Estonian IDs.)
Earlier quoted context omitted.
We have a similar system in Austria and I got curious when ROCA was announced. Turns out the cards here generate ECDSA keys and are thus not affected. Naturally, there was no announcement of any kind, so this took quite a bit of sleuthing to figure out. Maybe Spain happens to use ECC keys too.
For those wondering: "upgrading the Estonian ID cards" means switching to ECC (P-384). New certificates are generated on the chip, and the public part is then transmitted to the government public keys directory.
Earlier quoted context omitted.
ID cards have been usable until yesterday and will be again soon. Mine was upgraded and is still useful. You don't need it all the time, only to sign up. Your argument doesn't quite make sense.
If you need another basket to have access to it (even if only initially) then it's not really a separate basket on a national level.
The vulnerability in question: *The Return of Coppersmith’s Attack: Practical Factorization of Widely Used RSA Moduli∗ https://crocs.fi.muni.cz/_media/public/papers/nemec_roca_ccs... Estonian ID card uses 2048 byte keys which means generating a private key from a public key takes 140.8 CPU years which is quite fast/trivial/cheap using a distributed approach (botnet, your already existing HW that you use for mining e…
To clarify, 2048 bit RSA keys are fine. But the smartcard that generates these used a too predictable algorithm for generating the keys.
Earlier quoted context omitted.
For those wondering: "upgrading the Estonian ID cards" means switching to ECC (P-384). New certificates are generated on the chip, and the public part is then transmitted to the government public keys directory.
How do they authenticate the new ECC policy key when the RSA key is already compromised?
Earlier quoted context omitted.
Were these cards affected? Were there any official notices from authorities? Even if not affected, it would be nice to hear an official comment. I was discussing this with someone from Belgium and we agreed that silence from the Belgian government meant only one thing: nobody used the service. (Specifically: Belgian cards are the older Gemalto generation, thus not affected, like the older Estonian IDs.)
Spanish cards (DNIe) generate their keys themselves
Official announcement: https://www.valitsus.ee/en/news/estonia-will-block-certifica... It was claimed that software for cracking the private keys has entered the black market, so they had to block the sertificates earlier than expected.
The Estonian government is legally bound to applying such countermeasures as soon as there is reasonable doubt about the security of the system. It's pretty important that such things are encoded in law and are not up to whim.
Other governments take note: this is what good electronic security looks like.
Spain does the same. With you ID card chip, you can: - sign your emails digitally - login to secure websites with your id card (bank, DMV, taxes, …). Sometimes you can only do it with the ID card - they opened many of their tools, so you can design your website to allow login with Spain's ID cards (that was a fun project)