4 ms·

Anyone knows if this is applicable to Covid passes used in the European Union as well?

jinpa_zangpo 5y ago
The private keys for the European Green Pass have been leaked and fake passes signed with the keys are being sold on the dark web. https://threatpost.com/eus-green-pass-vaccination-id-private-key-leaked/175857/ https://threatpost.com/eus-green-pass-vaccination-id-private...
- stavros 5y ago
  They haven't been revoked yet?
  - acqbu 5y ago
    Some have, but not all... yet.
- CorrectHorseBat 5y ago
  >UPDATE: French & Polish authorities found no sign of cryptographic compromise in the leak of the private key used to sign the vaccine passports and to create fake passes for Mickey Mouse and Adolf Hitler, et al. Afaik it was a leaked login, not a leak of the keys.
  - jokethrowaway 5y ago
    Shouldn't they have a record of all the things they signed? I would expect them to know where and when that Adolf pass was generated
- lucb1e 5y ago
  Ah yes, repeat the evil dark web narrative. As if a VPS in Russia would get you into trouble. Criminals will be criminals, also if tor etc. wouldn't exist and non-criminals wouldn't get to be anonymous, too.
- jeroenhd 5y ago
  The keys were not leaked but the web interfaces that allowed generation of these certificates was left open and accessible. Passes have been sold (through the clear web and the dark web) but many have also been revoked since. As far as I know, the certificates being sold right now are either someone else's certificate (for places that don't check your ID when you walk in) and certificates generated by people working for places that also give out legitimate certificates, such as some pharmacies and hospitals.
- radicalbyte 5y ago
  The private keys were NOT leaked. There have been fraudulently obtained passes sold on the dark web. There have also been numerous arrests throughout the whole of Europe for this. The vast majority of the dark-web suppliers are scammers - many of the adverts include a mix of QRs people have posted to social media and a large number of example QR. Including examples that I have generated in the past and used in presentations / on github.
  - d0gsg0w00f 5y ago
    Why not just charge the unvaccinated with attempted manslaughter or reckless endangerment and put them all in jail? /s
est31 5y ago
From this [0] list it seems there are a bunch of RSA root certificates, but they all use RSA 2048 or 4096, both of which are still secure (with 4096 having diminishing returns compared to RSA 2048 [1]). The article was about RSA 512 which has been known to be weak and crackable for a long time [2]. [0]: https://github.com/eu-digital-green-certificates/dgc-participating-countries/issues/10#issuecomment-874838426 https://github.com/eu-digital-green-certificates/dgc-partici... [1]: https://www.gnupg.org/faq/gnupg-faq.html#no_default_of_rsa4096 https://www.gnupg.org/faq/gnupg-faq.html#no_default_of_rsa40... [2]: https://it.slashdot.org/story/99/08/29/0213230/512-bit-rsa-key-cracked https://it.slashdot.org/story/99/08/29/0213230/512-bit-rsa-k...
threeseed 5y ago
EU is in discussions right now to expire COVID passes unless you have had recent vaccines i.e. booster shots. Which means any security mechanism that is defeated will just be fixed every 9 months. Seems like a lot of hassle for a vaccine that is safe and will save your life.
- dot1x 5y ago
  source....?
  - sofixa 5y ago
    France announced it two days ago, starting in mid January the health pass will only be valid if less than 7 months have passed since your second dose, if it's more than that you need a booster. I don't know how they'll implement this technically.

The private keys for the European Green Pass have been leaked and fake passes signed with the keys are being sold on the dark web. https://threatpost.com/eus-green-pass-vaccination-id-private-key-leaked/175857/ https://threatpost.com/eus-green-pass-vaccination-id-private...

stavros 5y ago
They haven't been revoked yet?
- acqbu 5y ago
  Some have, but not all... yet.
CorrectHorseBat 5y ago
>UPDATE: French & Polish authorities found no sign of cryptographic compromise in the leak of the private key used to sign the vaccine passports and to create fake passes for Mickey Mouse and Adolf Hitler, et al. Afaik it was a leaked login, not a leak of the keys.
- jokethrowaway 5y ago
  Shouldn't they have a record of all the things they signed? I would expect them to know where and when that Adolf pass was generated
lucb1e 5y ago
Ah yes, repeat the evil dark web narrative. As if a VPS in Russia would get you into trouble. Criminals will be criminals, also if tor etc. wouldn't exist and non-criminals wouldn't get to be anonymous, too.
jeroenhd 5y ago
The keys were not leaked but the web interfaces that allowed generation of these certificates was left open and accessible. Passes have been sold (through the clear web and the dark web) but many have also been revoked since. As far as I know, the certificates being sold right now are either someone else's certificate (for places that don't check your ID when you walk in) and certificates generated by people working for places that also give out legitimate certificates, such as some pharmacies and hospitals.
radicalbyte 5y ago
The private keys were NOT leaked. There have been fraudulently obtained passes sold on the dark web. There have also been numerous arrests throughout the whole of Europe for this. The vast majority of the dark-web suppliers are scammers - many of the adverts include a mix of QRs people have posted to social media and a large number of example QR. Including examples that I have generated in the past and used in presentations / on github.
- d0gsg0w00f 5y ago
  Why not just charge the unvaccinated with attempted manslaughter or reckless endangerment and put them all in jail? /s

est31 5y ago

From this [0] list it seems there are a bunch of RSA root certificates, but they all use RSA 2048 or 4096, both of which are still secure (with 4096 having diminishing returns compared to RSA 2048 [1]). The article was about RSA 512 which has been known to be weak and crackable for a long time [2]. [0]: https://github.com/eu-digital-green-certificates/dgc-participating-countries/issues/10#issuecomment-874838426 https://github.com/eu-digital-green-certificates/dgc-partici... [1]: https://www.gnupg.org/faq/gnupg-faq.html#no_default_of_rsa4096 https://www.gnupg.org/faq/gnupg-faq.html#no_default_of_rsa40... [2]: https://it.slashdot.org/story/99/08/29/0213230/512-bit-rsa-key-cracked https://it.slashdot.org/story/99/08/29/0213230/512-bit-rsa-k...

threeseed 5y ago

EU is in discussions right now to expire COVID passes unless you have had recent vaccines i.e. booster shots. Which means any security mechanism that is defeated will just be fixed every 9 months. Seems like a lot of hassle for a vaccine that is safe and will save your life.

dot1x 5y ago
source....?
- sofixa 5y ago
  France announced it two days ago, starting in mid January the health pass will only be valid if less than 7 months have passed since your second dose, if it's more than that you need a booster. I don't know how they'll implement this technically.