4 ms·

This is so good and important to show that these identity schemes are more about surveillance than security, as the security guarantees are limited and insuffic

This is so good and important to show that these identity schemes are more about surveillance than security, as the security guarantees are limited and insufficient for any long period of time. An additional approach I might recommend for exploration would be to find the "offline mode," where it would have to re-use IVs and challenges over a short window when the app can't validate against the back end service. Other similar schemes I have seen implemented a single-use-key as a re-used limited-use-key to enable that use case. The card he tested was apparently live in production, but one of the main vulnerabilities in protocols like these is in the 'personalization' stage of the setup, where each card gets a set of default 'provisioning keys,' which are used to register the card and get unique user keys for it. A sample of unpersonalized blanks would yield that, and the costs associated with mitigating this with batch specific keys for provisioning is typically too much complexity. There may be a DoS vulnerability in some card schemes where you can use 'torn' NFC connections to get the key and transaction counter on the card applet to increment and desynchronize from the counter recorded on the server, bricking the card - or potentially many en masse with some SDR equipment. Given the physical user enrollment costs, there are some basic impossibilities in these protocols that will always reduce their security to a set of trade-offs that depend on economics and obscurity. Security research like this acts as a check on the efficacy of totalitarian controls like digital id, and it is important work to continually demonstrate that there are risks and costs to the regimes that impose them. I am very grateful this researcher has done work to discredit this scheme.

mariusor 3y ago
Could you please expand how any of the findings, or any attempts at digital ID are about surveillance and totalitarianism? Your post, as it is now, is brandishing big and scary words based on flimsy assumptions and without any real backup.
- motohagiography 3y ago
  I worked on digital identity schemes that used similar protocols to these a decade ago, and they were technologies in search of a use case because the vendors and project sponsors just wanted a mandate to implement controls nobody wanted. They're called domestic passports and a gesundheitpasses and the 20th century was defined by the regimes who implemented them. Identity and cryptography are areas where technologists cannot avoid moral culpability for their design and implementation decisions. This area is as real as it gets. Those big scary words are technical terms of art in political science (defined by Arendt), and people who actually work in privacy and identity to ensure these technologies are not exploited by governments to abuse citizens, are engaged in the real work of governance. Part of that is demonstrating how even governments are bound by the laws of math and accountable to reason. I also understand how smaller words could be more broadly persuasive.
  - uxp8u61q 3y ago
    Still no explanations, and now you're belittling people who want an explanation and relying on your supposed authority on the matter.
  - mariusor 3y ago
    Digital identity is the key for scaling democracy up, decreasing bureaucracy and integrating the act of being a citizen in day to day life, instead of being a chore that everyone complains about. It could allow for abuse for sure, but what technology doesn't. Assuming bad faith ab-initio and using those exact "terms of art" give out very strong vibes of conspiracy theories and sovereign citizen fetishes.
    - mistrial9 3y ago
      > Digital identity is the key for scaling democracy up unintended consequences are the topic at hand right? In all the world's countries, which shows "democracy scaling up" ? The single largest country is called China, they use Digital ID for scaling.
      - mariusor 3y ago
        No, the topic at hand is a cryptographer finding vulnerabilities in a communication protocol and the originating body incorporating the findings (hopefully) in their fixes. And since it's about France, what does that have to do with China? Good technology can be used badly by bad people, I don't know if China does that, but I imagine that's what you mean to imply. Vague assertions like yours are not exactly supporting evidence.
      - lxgr 3y ago
        Many EU countries, and the EU itself (with eIDAS) are rolling out digital identity schemes as well. I'm able to communicate with most government agencies of one European country digitally, as a result – definitely beats having to take a 10-hour flight or to at least find a printer and mail envelopes back and forth across the Atlantic, containing "physical signatures" that no company or government can realistically validate anyway.
- mistrial9 3y ago
  > flimsy assumptions and without any real backup saying this does not make it true -- volumes of political science are written on the topic of public identity. The perfect world where every instrument is applied fairly and in no other way, does not exist. A quick knowledge of modern investigation systems by law and tax authorities will be evidence of the alternate uses of this tech. Details on these topics could easily fill a book.
  - mariusor 3y ago
    I don't have the knowledge of those volumes of political science and modern investigation systems where electronic identity can be applied to greater negative effect. That's why I was asking for more concrete examples instead of hand waving.
    - pookha 3y ago
      Really? Seems self evident to me...The entire point of binding an employee or user to a certificate, PIN and an x509 PKI system has always been for authorization and tracking. No hand waiving required. For instance, Militaries around the world use these cards to grant access to internal systems and to track and monitor the activities of the insiders within these sensitive systems. Seeing this creeping into the general public is creeptastic.
      - mariusor 3y ago
        I agree that the capability might be present, but you forget how strong a stance the EU countries have for PII. A government that would abuse an identity mechanism would immediately be public knowledge and receive universal opprobrium inside the union and most likely outside of it too.
  - lxgr 3y ago
    The parent comment is does not talk about the political desirability of public identity, but rather makes (largely baseless as far as I can tell, unlike the article) claims about the technical security of one particular scheme. > The perfect world where every instrument is applied fairly and in no other way, does not exist. True – yet the absence of a government-provided system often means that inferior means of identity verification will have to be used by people and businesses. (Have you ever opened a bank account or credit card in the US?) That's why we get absurd private initiatives like Worldcoin that seem every bit as dystopian as some of the more poorly implemented government-based ID schemes.
lxgr 3y ago
> [...] one of the main vulnerabilities in protocols like these is in the 'personalization' stage of the setup, where each card gets a set of default 'provisioning keys,' which are used to register the card and get unique user keys for it. A sample of unpersonalized blanks would yield that, and the costs associated with mitigating this with batch specific keys for provisioning is typically too much complexity. Is your point "some smartcard schemes don't use key diversification, so this one probably doesn't either", and more generally "some smartcard schemes are implemented insecurely, so surely this one must be too"? > There may be a DoS vulnerability in some card schemes where you can use 'torn' NFC connections to get the key and transaction counter on the card applet to increment and desynchronize from the counter recorded on the server, bricking the card Speculation again, or do you have concrete evidence for this protocol being susceptible to torn transactions? Some are, some aren't. Also, you know what else you can do to a card when you have physical access to it? You can take a pair of scissors and cut it in half! A remote bricking capability would be concerning, but requiring an intentional and repeated transaction tear hardly seems noteworthy. > Given the physical user enrollment costs, there are some basic impossibilities in these protocols [...] I am very grateful this researcher has done work to discredit this scheme. It seems like you are generalizing from one concrete project to all smartcard systems, for what seem to be somewhat irrational motives.
- motohagiography 3y ago
  These were presented areas for further research, as there are precedents for these vulns, and the economics of card distribution haven't changed much. This is a technical discussion about vulns in protocols, and given I've worked on them in the past, these were how I broke previous proposed protocols that were reimplementations of a variation on the EMV protocols. What's changed in the protocols is they have been simplified to use ECC keys (they couldn't support PKI previously because RSA keys were too long to fit in the SE key slots), but the main issue of effectively tokenizing authentication transactions (using those AES-GCM keys) has the same limitations as the original protocol - albeit with an ECC keypair to do app/device attestation. Is this scheme vulnerable to that? Unknown. Are these attacks paths for additional vuln research that is exceptionally valuable and has significant policy consequences? Absolutely.

mariusor 3y ago

Could you please expand how any of the findings, or any attempts at digital ID are about surveillance and totalitarianism? Your post, as it is now, is brandishing big and scary words based on flimsy assumptions and without any real backup.

motohagiography 3y ago
I worked on digital identity schemes that used similar protocols to these a decade ago, and they were technologies in search of a use case because the vendors and project sponsors just wanted a mandate to implement controls nobody wanted. They're called domestic passports and a gesundheitpasses and the 20th century was defined by the regimes who implemented them. Identity and cryptography are areas where technologists cannot avoid moral culpability for their design and implementation decisions. This area is as real as it gets. Those big scary words are technical terms of art in political science (defined by Arendt), and people who actually work in privacy and identity to ensure these technologies are not exploited by governments to abuse citizens, are engaged in the real work of governance. Part of that is demonstrating how even governments are bound by the laws of math and accountable to reason. I also understand how smaller words could be more broadly persuasive.
- uxp8u61q 3y ago
  Still no explanations, and now you're belittling people who want an explanation and relying on your supposed authority on the matter.
- mariusor 3y ago
  Digital identity is the key for scaling democracy up, decreasing bureaucracy and integrating the act of being a citizen in day to day life, instead of being a chore that everyone complains about. It could allow for abuse for sure, but what technology doesn't. Assuming bad faith ab-initio and using those exact "terms of art" give out very strong vibes of conspiracy theories and sovereign citizen fetishes.
  - mistrial9 3y ago
    > Digital identity is the key for scaling democracy up unintended consequences are the topic at hand right? In all the world's countries, which shows "democracy scaling up" ? The single largest country is called China, they use Digital ID for scaling.
    - mariusor 3y ago
      No, the topic at hand is a cryptographer finding vulnerabilities in a communication protocol and the originating body incorporating the findings (hopefully) in their fixes. And since it's about France, what does that have to do with China? Good technology can be used badly by bad people, I don't know if China does that, but I imagine that's what you mean to imply. Vague assertions like yours are not exactly supporting evidence.
    - lxgr 3y ago
      Many EU countries, and the EU itself (with eIDAS) are rolling out digital identity schemes as well. I'm able to communicate with most government agencies of one European country digitally, as a result – definitely beats having to take a 10-hour flight or to at least find a printer and mail envelopes back and forth across the Atlantic, containing "physical signatures" that no company or government can realistically validate anyway.
mistrial9 3y ago
> flimsy assumptions and without any real backup saying this does not make it true -- volumes of political science are written on the topic of public identity. The perfect world where every instrument is applied fairly and in no other way, does not exist. A quick knowledge of modern investigation systems by law and tax authorities will be evidence of the alternate uses of this tech. Details on these topics could easily fill a book.
- mariusor 3y ago
  I don't have the knowledge of those volumes of political science and modern investigation systems where electronic identity can be applied to greater negative effect. That's why I was asking for more concrete examples instead of hand waving.
  - pookha 3y ago
    Really? Seems self evident to me...The entire point of binding an employee or user to a certificate, PIN and an x509 PKI system has always been for authorization and tracking. No hand waiving required. For instance, Militaries around the world use these cards to grant access to internal systems and to track and monitor the activities of the insiders within these sensitive systems. Seeing this creeping into the general public is creeptastic.
    - mariusor 3y ago
      I agree that the capability might be present, but you forget how strong a stance the EU countries have for PII. A government that would abuse an identity mechanism would immediately be public knowledge and receive universal opprobrium inside the union and most likely outside of it too.
- lxgr 3y ago
  The parent comment is does not talk about the political desirability of public identity, but rather makes (largely baseless as far as I can tell, unlike the article) claims about the technical security of one particular scheme. > The perfect world where every instrument is applied fairly and in no other way, does not exist. True – yet the absence of a government-provided system often means that inferior means of identity verification will have to be used by people and businesses. (Have you ever opened a bank account or credit card in the US?) That's why we get absurd private initiatives like Worldcoin that seem every bit as dystopian as some of the more poorly implemented government-based ID schemes.

lxgr 3y ago

> [...] one of the main vulnerabilities in protocols like these is in the 'personalization' stage of the setup, where each card gets a set of default 'provisioning keys,' which are used to register the card and get unique user keys for it. A sample of unpersonalized blanks would yield that, and the costs associated with mitigating this with batch specific keys for provisioning is typically too much complexity. Is your point "some smartcard schemes don't use key diversification, so this one probably doesn't either", and more generally "some smartcard schemes are implemented insecurely, so surely this one must be too"? > There may be a DoS vulnerability in some card schemes where you can use 'torn' NFC connections to get the key and transaction counter on the card applet to increment and desynchronize from the counter recorded on the server, bricking the card Speculation again, or do you have concrete evidence for this protocol being susceptible to torn transactions? Some are, some aren't. Also, you know what else you can do to a card when you have physical access to it? You can take a pair of scissors and cut it in half! A remote bricking capability would be concerning, but requiring an intentional and repeated transaction tear hardly seems noteworthy. > Given the physical user enrollment costs, there are some basic impossibilities in these protocols [...] I am very grateful this researcher has done work to discredit this scheme. It seems like you are generalizing from one concrete project to all smartcard systems, for what seem to be somewhat irrational motives.

motohagiography 3y ago
These were presented areas for further research, as there are precedents for these vulns, and the economics of card distribution haven't changed much. This is a technical discussion about vulns in protocols, and given I've worked on them in the past, these were how I broke previous proposed protocols that were reimplementations of a variation on the EMV protocols. What's changed in the protocols is they have been simplified to use ECC keys (they couldn't support PKI previously because RSA keys were too long to fit in the SE key slots), but the main issue of effectively tokenizing authentication transactions (using those AES-GCM keys) has the same limitations as the original protocol - albeit with an ECC keypair to do app/device attestation. Is this scheme vulnerable to that? Unknown. Are these attacks paths for additional vuln research that is exceptionally valuable and has significant policy consequences? Absolutely.