Estonian Electronic Identity Card and Its Security Challenges [pdf]

https://dspace.ut.ee/bitstream/handle/10062/71481/parsovs_arnis.pdf?sequence=1&isAllowed=y

by IndrekR • 5 years ago

97 30 5 years ago

dspace.ut.ee

Bluestein6• 5 years ago

Proud e-resident here :)

US citizen here trying to champion such a system in the US. Would you be willing to share pros and cons from your experience using the system day to day?

atlasunshrugged2• 5 years ago

Are you working with a specific org or initiative? I'm also an American interested in this (and an e-resident who formerly worked for the Estonian government).

Mediterraneo10• 5 years ago

US policy entangles US citizens and permanent-residency holders in tax and banking nightmares for years. Often even after a person has renounced their citizenship or residency, banks in other countries will treat them as US tax subjects anyway and impose onerous and privacy-violating reporting requirements. I can’t imagine the USA becoming a popular country for e-residency until its tax policies are more similar to other countries.

gumby• 5 years ago

The e-resident system is a great idea though the banking support for e-residents is limited, mainly due to the (anti money laundering) and anti fraud issues. That being said it's still great: you can still open a company, have a local presence, open a bank account and do business as an EU entity, but certain domains are not accepted by every bank (e.g. cryptocurrency), especially for e-residents who are also resident (not necessarily citizens) of the USA.

Friends who are actually resident in Estonia tell me it's pretty handy in their actual life.

A strong counterexample is Germany whose ID card also has a similar SIM and robust encryption support. There the legal implementation was seemingly designed in a way to thwart adoption, by privatising the wrong part of the system such that uptake has been nonexistent.

You can still sign something with a government-guaranteed key by plugging your card into your computer, but that will only help you communicate with other nerds. Fun to do once, but other than that useless.

Bluestein6• 5 years ago

Happy to!

I will probably post something somewhere when I actually get to availing myself of the Residency status for what it was planned for - the pandemic put the brakes on that a bit ...

So far, I can speak for the ease of the sign up process, quality of the documentation, clarity and community behind the effort. Oh, and, the tech. The tech is very well done. Thoughtful integration -everywere-. Deep buy-in from the state itself (this is a must, and - methinks - what makes it all tick).-

To clarify: the tech is not "ground breaking" (yet?). It is very run-of-the-mill cryptography, certificates, etc ...

It's the -degree- to which it has been implemented in the whole "administrative stack", from government to stakeholders (CPAs, SMBs, the self-employed), and how it has been integrated into a coherent effort, that makes it work.-

Edit: To add to the insightful point below. Yes. A modern, innovative and forward-thinking regulatory framework is a sine qua non, and what has actually made any of this possible. That regulatory overhaul (first) and support is the the most important form "government buy-in" takes ...

de6u99er• 5 years ago

Same here.

Bluestein6• 5 years ago

Wish you all success :)

pier25• 5 years ago

Me too!

I mean, almost. I just need to travel to NY to get my kit. :)

I'm planning on opening a remote SaaS company with Xolo and payments with Paddle.

Bluestein6• 5 years ago

Best of luck :)

  PS Worth the trip. I had to travel 500 Km. to perform the (brief) in-person part of the process - biometrics. Did it in-and-out, same day. No hassle ...

motohagiography• 5 years ago

End of section 2.4 contains this gem, "The manufacturing of ID cards has always been a closed, non-transparent activity, not open to scrutiny even to the manufacturer’s contracting partner – the Estonian state. The personalization protocols and procedures have never beenpublicly documented, leaving the security aspects of this process to bedetermined by the competency of the ID card manufacturer. As described inSection 6.8 of this work, this lack of supervision oversight allowed the ID cardmanufacturer to engage in activities that compromised the ID card securitywithout it being detected for years."

Card personalization is the bootstrapping problem, and there is another one with potentially hostile readers creating DoS conditions. I've worked on ID cards and digital identity in a few areas in both private and public sectors, and the threat model basically disappears into a cloud of spooky agencies, and it comes out the other end as a vague consensus to just move forward. If you think voting machines are unreliable you haven't seen anything until you've looked into digital identity, as it's a massive host of unresolved political problems tossed over the fence onto technologists, and then laundered back through opaque entities like the ones in this doc, then presented as a good idea.

My impression of identity is it's not a technology problem, but there are lots of people who will take your money to let you say that it is.

c-linkage• 5 years ago

I can't believe I get to say this: I actually worked on the pre-cursor to this card!

The project was started in 2001 and was to develop ID cards for immigrant workers that regularly crossed the border for work. The purpose was to create an ID card that could not be forged or tampered with.

The cards looked very similar to those in section 3.1 -- identifying information and a picture, with a passport-like encoding. Unlike the picture in section 3.1, all of the information was placed on the front of the card. When a new card was produced, the software created a cryptographic hash of the identifying information and the picture which was stored both on the card's mag-stripe and in a central database.

When users were authenticated at the border, the card was placed face-down on an optical scanner much like you see at airports today. The software then computed a hash of both the personal information and the picture. In offline mode the system would compare the hash only to the hash on the mag-stripe, but in online mode the system would connect to the central database to verify the mag-stripe hash matched and existing entry in the central database.

I think the Estonian government used that system for two or three years.

The best part of this setup was that the system did not in any way create a national registry. Instead, it proved the the ID (token) was not tampered with and that the token had indeed been created by a registered government authority.

Funny story: In early testing, I created an ID using my manager's name and a photo of my co-worker's ass. I still have the card at home somewhere. Who knows... it may still be in the database!

ad404b8a372f2b9• 5 years ago

That's super cool!

What kind of algorithm is used to ensure different scans of the same picture return the same hash? At first glance it seems like a hard problem.

xxpor• 5 years ago

Especially back then!

MaheshC• 5 years ago

Exactly, this looks like a tough problem to solve reliably.

null_deref• 5 years ago

The side story is awesome!

Etheryte• 5 years ago

For context, this is the PhD thesis of Arnis Paršovs [0], a cyber security researcher who has written on topics pertaining to the Estonian electronic ID system since as early as 2013. You would be hard pressed to find many people more familiar with the matter — even the public government reports aren't as detailed as this is.

[0] https://www.etis.ee/CV/Arnis_Parsovs/eng

lstamour• 5 years ago

It’s a long PDF, and gets very technical in parts. If you’re short on time, an overview is on page 16, section 1.4 “Structure of the thesis”. For implementation advice and recommendations, skim section 7 and look for section headings and italic recommendations, then section 7.5 on Other open issues and section 8 for less specific conclusions.

Estonian Electronic Identity Card and Its Security Challenges [pdf]

Related Stories