6 ms·

Estonia sues Gemalto for €152M over ID card flaws

amaccuish 8y ago
This provides some more information [0]. Not only did Gemalto fail to notify Estonia in good time about the ROCA flaw (the discoverers of which noticed that Estonia were still issuing vulnerable cards, so notified them themselves), some cards had their private keys generated outside of the card and then inserted, rather than on-card generation. I think Estonia is to be applaued here for handling all this in a sane manner. [0] https://dan.enigmabridge.com/estonia-hits-gemalto-again-insecure-eid-cards/ https://dan.enigmabridge.com/estonia-hits-gemalto-again-inse...
willsr 8y ago
I suppose the Estonians are partially at fault for trusting Gemalto with anything, post Snowden.
- Xylakant 8y ago
  The article stipulates that the contract dates back until 2002, about 11 years before the Snowden allegations came to light. So while they could have switched afterwards, the contract may have had a longer contract period, locking them in for a while. You also can’t just switch the identity provider for your national ID system, such a move would need at least some lead time.
  - pisipisipisi 8y ago
    The contract has been renewed several times, IIRC 2006 and 2010 Reference: (in Estonian) https://tehnika.postimees.ee/4358415/gemalto-kaebus-politsei-id-kaardi-hanke-vastu-porus-kohtus https://tehnika.postimees.ee/4358415/gemalto-kaebus-politsei...
    - gmueckl 8y ago
      That was all well before the Snowden relevations.
- dullgiulio 8y ago
  Nothing to do with Snowden revelations, but with RSA prime number generation. Because of a bug on the chip, primes were generated starting from numbers divisble by ten, which are way rarer than those divisble by two (pardon the extreme simplification.) That's a hardware design error. The claim is that Gemalto failed to fullfil the contractual clauses about quickly informing the customer (the Estonian state) of the security breach, not the existance of the security breach itself.
  - anemic 8y ago
    Well, there was this revelation that NSA had the 'Gemalto network wide open'. After week long investigation Gemalto denied any breach, leading to situation where you could either believe NSA or Gemalto. https://www.wired.com/2015/02/gemalto-confirms-hacked-insists-nsa-didnt-get-crypto-keys/ https://www.wired.com/2015/02/gemalto-confirms-hacked-insist...
  - IndrekR 8y ago
    I believe it is not a design error. It rahter sounds like an incorrectly implemented manufacturing optimisation. And in that sense close to the Volkswagen diesel-test optimisation -- compromising the reason for the RNG/exhaust test in the first place.
  - kodablah 8y ago
    Seems related if they trusted an untrustworthy company to inform them.
- the_clarence 8y ago
  Gemalto is french.
  - jaclaz 8y ago
    Not Franco-Dutch as stated in the article?
- TazeTSchnitzel 8y ago
  Gemalto issues all of Sweden's forms of state ID right now, the NSA must be laughing.
- pisipisipisi 8y ago
  The problem is mandatory blind trust in single entity, be it Gemalto or Oberthur or NSA^H^HIST. Same issue with CA-s.
- y04nn 8y ago
  Exactly, this crazy to think you can keep you sovereignty while giving to a foreign (French), NSA/CIA infiltrated (In-Q-Tel/Snowden) company the keys to all your citizens ID, moreover with internet voting. While ahead of its time, maximum caution must be taken, and the balance must be made between convenience and independence.
  - dfox 8y ago
    In fact the root cause of the flaw is in the attempt to make the keys inaccessible to any single entity by generating them on the card. This needs the card to have circuitry and software to generate RSA primes and some reliable source of entropy, both of which are somewhat non-trivial problems (as in easy to subtly screw up) in the smartcard environment.
hkai 8y ago
Everyone told them you can't have secure electronic voting.
- bozho 8y ago
  And yet, they do have it ;)
  - TazeTSchnitzel 8y ago
    Not according to experts in electronic voting system security.
    - Avamander 8y ago
      Could you provide sources for your claims?
    - kristerv 8y ago
      source please. So far I've only seen "experts" hack some old 20 US voting stations that are a joke in comparison.
      - mnyary 8y ago
        Independent Report on E-voting in Estonia https://estoniaevoting.org/press-release/ https://estoniaevoting.org/press-release/ This is from 2014.
        rstuart4133 8y ago
        There are too many concepts covered by the term e-voting. I'm sure the OP wasn't claiming the concept discussed in your link is a universally accepted as secure. That's because someone who thinks any voting method that allows a votes to be bought and sold is of course in a state of sin. Internet voting is one of those methods. Who knows, the OP may have also not been claiming purely electronic voting is a solved problem. Opinions may vary on that one, depending on how secure you think end-to-end audited voting is in practice. If all voters took the time to do the 60 second audit procedure it would of course be perfectly secure, but that's an unrealistic assumption. Which leaves a hybrid system - were the voting is done electronically using an end-to-end auditable system and the initial count is done electronically, but each vote is also printed and manually placed in the ballot box by the voter in the normal manner so if something goes wrong they can be manually re-counted. If that is what the OP is talking about then they are right - such a system is faster to use, gets the counting done near instantaneously, easier to use (particularly for voters with disabilities), is more accurate (because it can point out mistakes in the vote), is less wasteful (because how to vote cards and information on candidates can be presented electronically) and of course is more secure than the existing manual system. And yes, on that the experts agree pretty much universally. The sad thing is I only know of one electronic voting system that did it that way, and it was only a trial. All other deployed e-voting systems I've seen were mostly windows desktop's enclosed in an impressive looking box. Some things in this world are very hard to explain.
thisisit 8y ago
This is surprising. Estonia was oft quoted example of digital governance. Any ideas on how this will effect their blockchain projects?
- the_clarence 8y ago
  How is this surprising? Or did you just want to mention cryptocurrencies?
- ivoras 8y ago
  Estonia had excellent digital governance before the blockchain fad so they'll handle it pretty much just fine.
amingilani 8y ago
They made everyone regenerate their private keys on the card recently during a short window, and those who missed it (like me) ended up with a fancy piece of paper with their name on it. Oh joy. Just when I'd decided to use my e-Residency for something, it becomes worthless. They're asking me to reapply for a new ID document and pay the fee all over again. I'd honestly do it, but then they can't hand it over to me in Pakistan and I'm not flying out of the country just to grab an e-Residency card when my previous one hasn't even expired yet. I guess I'm still a bit sour over this.
- Avamander 8y ago
  I agree that they should reimburse because the flaw was not caused by you, but how did you manage to miss the massive publicity and uproar and not update your card?
  - amingilani 8y ago
    I was working 60 hours a week at the time. It had come up on my radar but there wasn't enough time in my day or mental energy left at the end of it to look into it in much detail — I just thought it, like everything else in my life at the time, could wait a few more months. By the time I looked into it, I was a month or two late.
    - SZJX 8y ago
      lol if you're letting yourself so overwhelmed by work probably you'd take a second look at your work-life balance, especially if you're working in Europe, unless you're the founder/executive or something.
      - amingilani 8y ago
        That was then, I'm doing much better now, though. Thank you for your concern :)
- mb_72 8y ago
  That 'short window' was some period of months, I thought. It's not cool the problem happened but sounds like you didn't consider it high enough priority to get onto it.
sccxy 8y ago
Problem was not security flaw. Problem was that Gemalto did not tell Estonia that there is security flaw. That led to rush security fix which could have been worked on for months before not do it in weeks.

This provides some more information [0]. Not only did Gemalto fail to notify Estonia in good time about the ROCA flaw (the discoverers of which noticed that Estonia were still issuing vulnerable cards, so notified them themselves), some cards had their private keys generated outside of the card and then inserted, rather than on-card generation. I think Estonia is to be applaued here for handling all this in a sane manner. [0] https://dan.enigmabridge.com/estonia-hits-gemalto-again-insecure-eid-cards/ https://dan.enigmabridge.com/estonia-hits-gemalto-again-inse...

willsr 8y ago

I suppose the Estonians are partially at fault for trusting Gemalto with anything, post Snowden.

Xylakant 8y ago
The article stipulates that the contract dates back until 2002, about 11 years before the Snowden allegations came to light. So while they could have switched afterwards, the contract may have had a longer contract period, locking them in for a while. You also can’t just switch the identity provider for your national ID system, such a move would need at least some lead time.
- pisipisipisi 8y ago
  The contract has been renewed several times, IIRC 2006 and 2010 Reference: (in Estonian) https://tehnika.postimees.ee/4358415/gemalto-kaebus-politsei-id-kaardi-hanke-vastu-porus-kohtus https://tehnika.postimees.ee/4358415/gemalto-kaebus-politsei...
  - gmueckl 8y ago
    That was all well before the Snowden relevations.
dullgiulio 8y ago
Nothing to do with Snowden revelations, but with RSA prime number generation. Because of a bug on the chip, primes were generated starting from numbers divisble by ten, which are way rarer than those divisble by two (pardon the extreme simplification.) That's a hardware design error. The claim is that Gemalto failed to fullfil the contractual clauses about quickly informing the customer (the Estonian state) of the security breach, not the existance of the security breach itself.
- anemic 8y ago
  Well, there was this revelation that NSA had the 'Gemalto network wide open'. After week long investigation Gemalto denied any breach, leading to situation where you could either believe NSA or Gemalto. https://www.wired.com/2015/02/gemalto-confirms-hacked-insists-nsa-didnt-get-crypto-keys/ https://www.wired.com/2015/02/gemalto-confirms-hacked-insist...
- IndrekR 8y ago
  I believe it is not a design error. It rahter sounds like an incorrectly implemented manufacturing optimisation. And in that sense close to the Volkswagen diesel-test optimisation -- compromising the reason for the RNG/exhaust test in the first place.
- kodablah 8y ago
  Seems related if they trusted an untrustworthy company to inform them.
the_clarence 8y ago
Gemalto is french.
- jaclaz 8y ago
  Not Franco-Dutch as stated in the article?
TazeTSchnitzel 8y ago
Gemalto issues all of Sweden's forms of state ID right now, the NSA must be laughing.
pisipisipisi 8y ago
The problem is mandatory blind trust in single entity, be it Gemalto or Oberthur or NSA^H^HIST. Same issue with CA-s.
y04nn 8y ago
Exactly, this crazy to think you can keep you sovereignty while giving to a foreign (French), NSA/CIA infiltrated (In-Q-Tel/Snowden) company the keys to all your citizens ID, moreover with internet voting. While ahead of its time, maximum caution must be taken, and the balance must be made between convenience and independence.
- dfox 8y ago
  In fact the root cause of the flaw is in the attempt to make the keys inaccessible to any single entity by generating them on the card. This needs the card to have circuitry and software to generate RSA primes and some reliable source of entropy, both of which are somewhat non-trivial problems (as in easy to subtly screw up) in the smartcard environment.

hkai 8y ago

Everyone told them you can't have secure electronic voting.

bozho 8y ago
And yet, they do have it ;)
- TazeTSchnitzel 8y ago
  Not according to experts in electronic voting system security.
  - Avamander 8y ago
    Could you provide sources for your claims?
  - kristerv 8y ago
    source please. So far I've only seen "experts" hack some old 20 US voting stations that are a joke in comparison.
    - mnyary 8y ago
      Independent Report on E-voting in Estonia https://estoniaevoting.org/press-release/ https://estoniaevoting.org/press-release/ This is from 2014.
      - rstuart4133 8y ago
        There are too many concepts covered by the term e-voting. I'm sure the OP wasn't claiming the concept discussed in your link is a universally accepted as secure. That's because someone who thinks any voting method that allows a votes to be bought and sold is of course in a state of sin. Internet voting is one of those methods. Who knows, the OP may have also not been claiming purely electronic voting is a solved problem. Opinions may vary on that one, depending on how secure you think end-to-end audited voting is in practice. If all voters took the time to do the 60 second audit procedure it would of course be perfectly secure, but that's an unrealistic assumption. Which leaves a hybrid system - were the voting is done electronically using an end-to-end auditable system and the initial count is done electronically, but each vote is also printed and manually placed in the ballot box by the voter in the normal manner so if something goes wrong they can be manually re-counted. If that is what the OP is talking about then they are right - such a system is faster to use, gets the counting done near instantaneously, easier to use (particularly for voters with disabilities), is more accurate (because it can point out mistakes in the vote), is less wasteful (because how to vote cards and information on candidates can be presented electronically) and of course is more secure than the existing manual system. And yes, on that the experts agree pretty much universally. The sad thing is I only know of one electronic voting system that did it that way, and it was only a trial. All other deployed e-voting systems I've seen were mostly windows desktop's enclosed in an impressive looking box. Some things in this world are very hard to explain.

thisisit 8y ago

This is surprising. Estonia was oft quoted example of digital governance. Any ideas on how this will effect their blockchain projects?

the_clarence 8y ago
How is this surprising? Or did you just want to mention cryptocurrencies?
ivoras 8y ago
Estonia had excellent digital governance before the blockchain fad so they'll handle it pretty much just fine.

amingilani 8y ago

They made everyone regenerate their private keys on the card recently during a short window, and those who missed it (like me) ended up with a fancy piece of paper with their name on it. Oh joy. Just when I'd decided to use my e-Residency for something, it becomes worthless. They're asking me to reapply for a new ID document and pay the fee all over again. I'd honestly do it, but then they can't hand it over to me in Pakistan and I'm not flying out of the country just to grab an e-Residency card when my previous one hasn't even expired yet. I guess I'm still a bit sour over this.

Avamander 8y ago
I agree that they should reimburse because the flaw was not caused by you, but how did you manage to miss the massive publicity and uproar and not update your card?
- amingilani 8y ago
  I was working 60 hours a week at the time. It had come up on my radar but there wasn't enough time in my day or mental energy left at the end of it to look into it in much detail — I just thought it, like everything else in my life at the time, could wait a few more months. By the time I looked into it, I was a month or two late.
  - SZJX 8y ago
    lol if you're letting yourself so overwhelmed by work probably you'd take a second look at your work-life balance, especially if you're working in Europe, unless you're the founder/executive or something.
    - amingilani 8y ago
      That was then, I'm doing much better now, though. Thank you for your concern :)
mb_72 8y ago
That 'short window' was some period of months, I thought. It's not cool the problem happened but sounds like you didn't consider it high enough priority to get onto it.

sccxy 8y ago

Problem was not security flaw. Problem was that Gemalto did not tell Estonia that there is security flaw. That led to rush security fix which could have been worked on for months before not do it in weeks.