Live data from Hacker News

Reversing 'France Identité': The New French Digital ID

reversemode.com

71–80 of 90 posts

Re: Reversing 'France Identité': The New French Digital ID

#71
post #49

Noob question: why don't governments issue a private key to every citizen so that they can identify themselves "easily" in web forms and the like? The government would keep the corresponding public key. You could go in person to any government building and request a new private key to override the previous one if needed.

Did you mean "why doesn't the government allow every citizen to register a set of public keys for identification purposes"?

The citizens obviously wouldn't want the government generating their private keys. Because then it wouldn't be a private key any more.

Re: Reversing 'France Identité': The New French Digital ID

#72
post #56

Earlier quoted context omitted.

EMV is a completely different protocol, though! You wouldn't use a vulnerability discovered in TLS (or its implementation in OpenSSL) as an example for why SSH/OpenSSH is an insecure protocol, would you? A smartcard is in the end just a general purpose computer (with some physical hardening and a really weird and poorly layered protocol stack that costs hundreds of CHF to even read; thank you, ISO!) – it can be just…

Security protocols have a short list of moving parts and trade offs and where to attack them. RNGs, key storage, key derivation, counters, and access modes, to name a few. They're only completely different to people who don't understand them. If you are using symmetric secrets in smart cards, you're using something within a degree of EMV because you need compatability with existing reader infrastructure, and alignmen…

> Security protocols have a short list of moving parts and trade offs and where to attack them. RNGs, key storage, key derivation, counters, and access modes, to name a few. They're only completely different to people who don't understand them.

Funny, I would have said that they only look very similar to one another to people who aren't deep enough in the weeds of a particular one.

Yes, they're ultimately all built out of the same building blocks. But just with these few you've mentioned, together with possibly having more than two actors in your system and corresponding privileged keys, the complexity of the aggregate protocol hockey sticks very quickly, and you absolutely can't reduce all problems to one another anymore.

Humans are made of atoms, yet when you're sick you go to a physician, not to a physicist.

> If you are using symmetric secrets in smart cards, you're using something within a degree of EMV

Oh, absolutely not. Sorry, but with this statement you show that you aren't familiar with other protocols in this space. There are so many smartcard (and adjacent, e.g. stored-value cards like MIFARE) protocols that use symmetric keys, yet don't share any of EMVs historical problems. I mean, even GlobalPlatform itself uses symmetric cryptography!

That's like saying that SSH and TLS are very similar protocols, since they both use asymmetric key exchanges to secure and authenticate a symmetrically-encrypted application layer channel.

Re: Reversing 'France Identité': The New French Digital ID

#73
post #28
post #16

Earlier quoted context omitted.

We, French, do actually have seriously competent people in charge of central government IT infrastructure. Local governments not so much and that is an euphemism, but French central government doesn't cut corners about that. Also, ANSSI is among the world's best in security auditing and they take very diligently their public service role of sticking their noses into your information system if you are legally classifi…

Also competent technology companies like Thalès (Gemalto).

Unclear to me whether that comment is sarcastic or not. I'd vote for the former, but many purchasers don't.

Re: Reversing 'France Identité': The New French Digital ID

#74

The idea is terrible even from the first lines, relying on the hardware key attestation means giving up the id card to Google and Apple approved devices which is absolutely not what you want as a country.

Seems like a government-supported activity to violate DMA.

Re: Reversing 'France Identité': The New French Digital ID

#75
post #65

Earlier quoted context omitted.

I don't have the knowledge of those volumes of political science and modern investigation systems where electronic identity can be applied to greater negative effect. That's why I was asking for more concrete examples instead of hand waving.

Really? Seems self evident to me...The entire point of binding an employee or user to a certificate, PIN and an x509 PKI system has always been for authorization and tracking. No hand waiving required. For instance, Militaries around the world use these cards to grant access to internal systems and to track and monitor the activities of the insiders within these sensitive systems. Seeing this creeping into the genera…

I agree that the capability might be present, but you forget how strong a stance the EU countries have for PII. A government that would abuse an identity mechanism would immediately be public knowledge and receive universal opprobrium inside the union and most likely outside of it too.

Re: Reversing 'France Identité': The New French Digital ID

#76

Does anyone know why a private govtech business like Palantir doesn’t take over all these use cases? Governments are notoriously bad at tech, why isn’t there a massive private corporation catering to all these use cases and ensuring state of the art security? Instead of hiring local clowns that release half baked solutions like this.

Palantir is nowhere compared to Thales ( French compagny ): https://www.thalesgroup.com/en/markets/digital-identity-and-...

They even serve cards for the DoD: https://www.thalesgroup.com/en/markets/digital-identity-and-...

Re: Reversing 'France Identité': The New French Digital ID

#77
post #68

Earlier quoted context omitted.

As adev_ mentioned, TLS implicitly requires a lot of things that can be considered expensive for very low power devices (dare I say "bloat"). Examples being things like X509 certificates. Another thing to consider is that TLS supports multiple use cases and has multiple versions, so it has stuff like algorithm negotiation, version negotiation and some other things that are really unnecessary when you just want a secu…

> What I'd like to see is a standardized protocol for this exact use case Does Noise Protocol provide what you're looking for? http://www.noiseprotocol.org/

I've heard about Noise but didn't think to mention it for some reason. Yeah, Noise is basically what I was trying to describe. Such a protocol doesn't necessarily have to use Noise though, however Noise helps avoid some implementation pitfalls that people not very experienced with crypto can make.

Re: Reversing 'France Identité': The New French Digital ID

#78
post #72

Earlier quoted context omitted.

Security protocols have a short list of moving parts and trade offs and where to attack them. RNGs, key storage, key derivation, counters, and access modes, to name a few. They're only completely different to people who don't understand them. If you are using symmetric secrets in smart cards, you're using something within a degree of EMV because you need compatability with existing reader infrastructure, and alignmen…

> Security protocols have a short list of moving parts and trade offs and where to attack them. RNGs, key storage, key derivation, counters, and access modes, to name a few. They're only completely different to people who don't understand them. Funny, I would have said that they only look very similar to one another to people who aren't deep enough in the weeds of a particular one. Yes, they're ultimately all built o…

A two party protocol that involves mutual authentication and key exchange has a short set of essential variations, with some features and even some theatre wrapped around it. Not sure if you're being obtuse or misleading, but yes, GlobalPlatform used symmetric cryptography because that's the literal compatability problem they impose that is a constraint on developing more modern smart card based protocols. There are also only a few main smart card vendors and they have ecosystem constraints that favor compromises like the ones discussed. Yeah, I totally don't know what I'm talking about.

The protocols and proposals I did evaluations for implemented the trade offs I mentioned above. The reason it's important for hackers to focus on these technologies is because this is literally the bar institutions use to make decisions about infrastructure security. What the original post demonstrated was the protocol implemented in these cards had vulnerabilities that were consistent with the limitations of using symmetric keys that incorporate constraints from legacy protocols.

My follow up was that there are some very obvious places to check for futher vulnerabilities, and the research is important to do so because it antagonizes just the sort of authoritarian personalities you want to keep in check in a free society. This is what hackers are for. I've made my contributions to ensuring privacy laws were upheld and that backdoored digital identity schemes could not survive, and I'm very glad a younger generation of hackers is taking up this most important work.

To anyone working on these problems, don't let the personalities discourage you, it means you're over the target.

Re: Reversing 'France Identité': The New French Digital ID

#79
post #69

Earlier quoted context omitted.

As adev_ mentioned, TLS implicitly requires a lot of things that can be considered expensive for very low power devices (dare I say "bloat"). Examples being things like X509 certificates. Another thing to consider is that TLS supports multiple use cases and has multiple versions, so it has stuff like algorithm negotiation, version negotiation and some other things that are really unnecessary when you just want a secu…

I agree that runtime algorithm negotiation makes sense to avoid sometimes. So just make a spec that factors out the algorithm, and make the choice of algorithm a compile-time thing. Then there's no need to hardcode anything in the spec, you can just say you're using the protocol RFC-12345-ChaCha20Poly1305 — with RFC-12345 being the spec that leaves out the algorithm.

Yes, that's pretty much what I meant by "standardized". You'd be able to pick AEAD cipher, KDF, signature algorithm, KEX algorithm etc., while the spec would only describe the protocol itself without enforcing specific algorithms. Noise Protocol pretty much does this already: you provide a string that describes the set of algorithms you will be using, e.g. "Noise_NN_25519_ChaChaPoly_BLAKE2s"

Re: Reversing 'France Identité': The New French Digital ID

#80
post #35
post #22

Earlier quoted context omitted.

Smartcard and NFC are two different beast. The fashion for Smartcard is over, mainly due to the necessity of specialized reader. The wind blows in favor of NFC cards & badge because they are smartphone compatible. But these comes with limitations.

Not at all: NFC (or more accurately ISO 14443) is often used as just another interface for regular ISO 7816 smartcards. There are other contactless standards (storage only, proprietary fixed-function logic etc.) too, but full-fledged Java Card smartcards are actually quite common: It’s what most contactless payment cards are.

Interesting thank you.

I always thought only a subset of the capabilities of Java Cards were available in NFC mode due to power restriction reasons.

Post reply on HN