3 ms·

Not exactly. The government does not have your private keys which are only on your PIN-protected smartcards, so they can't impersonate you. And giving public-pr

Not exactly. The government does not have your private keys which are only on your PIN-protected smartcards, so they can't impersonate you. And giving public-private certificate pairs does not mean the government knows anything about using them. I sign a bank transaction, the bank knows it. I sign an electronic agreement with my card with me friend, only us know about it. Government just handles revocation lists and expiry. More about it at http://id.ee/?lang=en&id= http://id.ee/?lang=en&id= The id card being issued to citizens is quite common in Europe. The thing is that the id card allows you for visa-free travel across Europe and that has pan-European regulations attached. But foreigners can get a similar electronic authentication and signature id card in Estonia still as well. Some technical stuff also at http://www.id.ee/?lang=en&id=35755 http://www.id.ee/?lang=en&id=35755 The e-voting code for elections is made public at http://arstechnica.com/tech-policy/2013/07/estonia-publishes-its-e-voting-source-code-on-github/ http://arstechnica.com/tech-policy/2013/07/estonia-publishes...

iwwr 13y ago
The problem is there is no way to know for sure the government isn't keeping all the data needed to generate keys. To make the process secure, you'd need a protocol where people get to generate their own keys (open source implementations) based on some entropy under their own control.
- jkaljundi 13y ago
  Well the government does not generate the keys, or access the signed data. The smartcard does, inside the chip. The spec is here: http://www.id.ee/public/TB-SPEC-EstEID-Chip-App-v3.4.pdf http://www.id.ee/public/TB-SPEC-EstEID-Chip-App-v3.4.pdf Forgotten who the chip manufacturer is, but basically what you'd describe would be an attach against the chip manufacturer and their key generation algorithms and randomness. Estonian ID cards are made by Trüb AG, which does id cards also for Switzerland, Germany, Dubai and countless other countries. And the Estonian card personalization if I remember correctly is also outsourced to a private party.

iwwr 13y ago

The problem is there is no way to know for sure the government isn't keeping all the data needed to generate keys. To make the process secure, you'd need a protocol where people get to generate their own keys (open source implementations) based on some entropy under their own control.

jkaljundi 13y ago
Well the government does not generate the keys, or access the signed data. The smartcard does, inside the chip. The spec is here: http://www.id.ee/public/TB-SPEC-EstEID-Chip-App-v3.4.pdf http://www.id.ee/public/TB-SPEC-EstEID-Chip-App-v3.4.pdf Forgotten who the chip manufacturer is, but basically what you'd describe would be an attach against the chip manufacturer and their key generation algorithms and randomness. Estonian ID cards are made by Trüb AG, which does id cards also for Switzerland, Germany, Dubai and countless other countries. And the Estonian card personalization if I remember correctly is also outsourced to a private party.