4 ms·

This design looks pretty sound, revocation seems like the big missing piece but I guess that could be done by pushing an updated scanner. Here in The Netherlan

by r1ch 5y ago

This design looks pretty sound, revocation seems like the big missing piece but I guess that could be done by pushing an updated scanner. Here in The Netherlands our app is also used for proof of a negative test. I wonder if giving signing powers to however many hundreds of test locations will backfire at some point. Then again I don't know if our national QR codes are even cryptographically signed to begin with.

cr1895 5y ago
> I wonder if giving signing powers to however many hundreds of test locations will backfire at some point. In Germany the vaccine proof can be generated at (most?) pharmacies. If that would become an issue, I don't think it would only be one in the Netherlands.
- zaarn 5y ago
  Should be most pharmacies but they have to check your vaccination booklet (or proof of vaccination, they give you extra papers at the vaccination location). It seems to work alright considering atleast one person I know is facing charges for falsifying medical documents and falsifying signatures due to them trying to fake their vaccination and bringing that to the pharmacy.
bigiain 5y ago
From the qr generated and qr expiry timestamps, it looks like they are only valid for 2 days, so revocation isn’t that much of a problem.
- r1ch 5y ago
  I was thinking more along the lines of one of the signing keys leaking.
lesquivemeau 5y ago
I don't know how the signing process is for this specific green pass, but the national France one is signed exclusively by the French healthcare system: vaccination centers and test locations can emit a signed pass remotely and print it, but they don't possess the private key locally.
- r1ch 5y ago
  I'm speculating somewhat as I haven't been through the process, but it seems like the test centers give you a string that the app converts into the QR code. The app is supposed to work offline, though perhaps the initial string -> QR code does an online lookup and thus is signed externally to the test centers.
  - ktownsend 5y ago
    The string is a BASE45-encoded payload that has already been signed before encoding as a QR-friendly string. The BASE45 is because QR codes only support 45 characters (versus more common BASE64). But by the time the string -> QR happens, the signing has already taken place from the lab who provides the string.

by r1ch 5y ago

cr1895 5y ago

> I wonder if giving signing powers to however many hundreds of test locations will backfire at some point. In Germany the vaccine proof can be generated at (most?) pharmacies. If that would become an issue, I don't think it would only be one in the Netherlands.

zaarn 5y ago
Should be most pharmacies but they have to check your vaccination booklet (or proof of vaccination, they give you extra papers at the vaccination location). It seems to work alright considering atleast one person I know is facing charges for falsifying medical documents and falsifying signatures due to them trying to fake their vaccination and bringing that to the pharmacy.

bigiain 5y ago

From the qr generated and qr expiry timestamps, it looks like they are only valid for 2 days, so revocation isn’t that much of a problem.

r1ch 5y ago
I was thinking more along the lines of one of the signing keys leaking.

lesquivemeau 5y ago

I don't know how the signing process is for this specific green pass, but the national France one is signed exclusively by the French healthcare system: vaccination centers and test locations can emit a signed pass remotely and print it, but they don't possess the private key locally.

r1ch 5y ago
I'm speculating somewhat as I haven't been through the process, but it seems like the test centers give you a string that the app converts into the QR code. The app is supposed to work offline, though perhaps the initial string -> QR code does an online lookup and thus is signed externally to the test centers.
- ktownsend 5y ago
  The string is a BASE45-encoded payload that has already been signed before encoding as a QR-friendly string. The BASE45 is because QR codes only support 45 characters (versus more common BASE64). But by the time the string -> QR happens, the signing has already taken place from the lab who provides the string.