4 ms·
The problem is there is no way to know for sure the government isn't keeping all the data needed to generate keys. To make the process secure, you'd need a prot
by iwwr 13y ago
The problem is there is no way to know for sure the government isn't keeping all the data needed to generate keys. To make the process secure, you'd need a protocol where people get to generate their own keys (open source implementations) based on some entropy under their own control.
- jkaljundi 13y agoWell the government does not generate the keys, or access the signed data. The smartcard does, inside the chip. The spec is here: http://www.id.ee/public/TB-SPEC-EstEID-Chip-App-v3.4.pdf http://www.id.ee/public/TB-SPEC-EstEID-Chip-App-v3.4.pdf Forgotten who the chip manufacturer is, but basically what you'd describe would be an attach against the chip manufacturer and their key generation algorithms and randomness. Estonian ID cards are made by Trüb AG, which does id cards also for Switzerland, Germany, Dubai and countless other countries. And the Estonian card personalization if I remember correctly is also outsourced to a private party.