3 ms·
Were these cards affected? Were there any official notices from authorities? Even if not affected, it would be nice to hear an official comment. I was discuss
by dullgiulio 9y ago
Were these cards affected? Were there any official notices from authorities?
Even if not affected, it would be nice to hear an official comment.
I was discussing this with someone from Belgium and we agreed that silence from the Belgian government meant only one thing: nobody used the service. (Specifically: Belgian cards are the older Gemalto generation, thus not affected, like the older Estonian IDs.)
- pfg 9y agoWe have a similar system in Austria and I got curious when ROCA was announced. Turns out the cards here generate ECDSA keys and are thus not affected. Naturally, there was no announcement of any kind, so this took quite a bit of sleuthing to figure out. Maybe Spain happens to use ECC keys too.
- dullgiulio 9y agoFor those wondering: "upgrading the Estonian ID cards" means switching to ECC (P-384). New certificates are generated on the chip, and the public part is then transmitted to the government public keys directory.
- bdonlan 9y agoHow do they authenticate the new ECC policy key when the RSA key is already compromised?
- dullgiulio 9y agoYou don't. Hence, the upgrade system has been disabled now, which is TFA.
- bragh 9y agoAm Estonian. The remote upgrade system is still working, but only enabled for high-priority users right now because of the high load - medical professionals, social workers, people who used the card more than 100 times over the past 3 months. It will be re-enabled for all users at the start of next week, maybe earlier if the high-priority users have all been serviced.
- Faaak 9y agoSpanish cards (DNIe) generate their keys themselves
- dullgiulio 9y agoThey all do, that's the idea of a HSM.