4 ms·

British Columbia uses the SMART Health Cards as well, as written up in this blog post: https://www.chesterwisniewski.com/post/2021-09-14-nc-covid-19-vaccine-car

British Columbia uses the SMART Health Cards as well, as written up in this blog post: https://www.chesterwisniewski.com/post/2021-09-14-nc-covid-19-vaccine-card-technical-analysis/ https://www.chesterwisniewski.com/post/2021-09-14-nc-covid-1... What do you see as the concern with the signed JWT? It seems to work, in that the freely-available app rejects a payload that I've encoded myself. Really, any of these private companies' proposed solutions won't have the private keys to sign the data, which I see as key to being able to trust it. The BC app does not appear to be making any per-verification web calls, so it must have the appropriate Canadian issuer's public key info built-in. I'd be more curious how it would be able to handle any other jurisdictions' codes, unless it has US keys available as well.

m-p-3 5y ago
> The BC app does not appear to be making any per-verification web calls, so it must have the appropriate Canadian issuer's public key info built-in. Quebec's app does the same thing, it has the public key builtin for validation. The only time the app can connect is to download an updated list of rules that determine if the enclosed information in the QR code related to vaccine status still protects the owner (and label them as adequately protected if they meet those criterias).
- tlavoie 5y ago
  Thanks, I was curious about updates here as well. To that end, I don't know if ours does any such updates directly, or if that would come in the form of an app update.
tlavoie 5y ago
Also, while the details of the vaccination are contained in the payload, the app displays only the bare minimum of data to the user: verified vaccination status, and the holder's name to compare with photo ID (required in BC for adults). I appreciate that the data contained in the code is as minimal as it can be, while the official app is displaying even less. Working off-line should keep it reliable as well, since it does not make or require server calls. This too would be different from Portpass, since it apparently stopped working.
noodlesUK 5y ago
The reason I am not a fan of signed JWTs as a technology is because of their cryptographic agility. There have been too many circumstances where even big players who should have known better have fallen afoul of alg: none or hmac where they weren’t expecting it. See https://auth0.com/blog/a-look-at-the-latest-draft-for-jwt-bcp/ https://auth0.com/blog/a-look-at-the-latest-draft-for-jwt-bc... for a quick overview.

m-p-3 5y ago

> The BC app does not appear to be making any per-verification web calls, so it must have the appropriate Canadian issuer's public key info built-in. Quebec's app does the same thing, it has the public key builtin for validation. The only time the app can connect is to download an updated list of rules that determine if the enclosed information in the QR code related to vaccine status still protects the owner (and label them as adequately protected if they meet those criterias).

tlavoie 5y ago
Thanks, I was curious about updates here as well. To that end, I don't know if ours does any such updates directly, or if that would come in the form of an app update.

tlavoie 5y ago

Also, while the details of the vaccination are contained in the payload, the app displays only the bare minimum of data to the user: verified vaccination status, and the holder's name to compare with photo ID (required in BC for adults). I appreciate that the data contained in the code is as minimal as it can be, while the official app is displaying even less. Working off-line should keep it reliable as well, since it does not make or require server calls. This too would be different from Portpass, since it apparently stopped working.

noodlesUK 5y ago

The reason I am not a fan of signed JWTs as a technology is because of their cryptographic agility. There have been too many circumstances where even big players who should have known better have fallen afoul of alg: none or hmac where they weren’t expecting it. See https://auth0.com/blog/a-look-at-the-latest-draft-for-jwt-bcp/ https://auth0.com/blog/a-look-at-the-latest-draft-for-jwt-bc... for a quick overview.