Subject: [CFRG] Question over COVID-19 'passport' standardization?

From: Harry Halpin <[email-masked]>
Date: Fri, 30 Jul 2021 19:47:13 +0200

Everyone,

While the research community and industry was very quick to work on
privacy-enhanced contact tracing, I've seen very few people taking the much
more pressing issue of COVID-19 passports.

I've earlier seen some very badly done academic work using W3C "Verified
Credentials" and W3C Decentralized Identifier (DID) standards [1]. However,
while a bunch of sketchy blockchain technology has not been adopted (so
far, although I believe IATA and WHO are still being heavily lobbied in
this direction), there has been the release of the EU "Green" Digital
Credentials that actually uses digital signatures.

However, there's a number of problems:

* No revocation in case of compromise
* Privacy issues, i.e. leaking metadata
* No key management (booster shots might require)
* No use of standards for cross-app interoperability

Furthermore, there appears to be differences between countries, and some
countries do not use cryptography at all (the US). Therefore, as an
American in France who flew home ASAP to get vaccinated in the US, as a
consequence of this lack of interoperability I can't travel on trains or
eat at restaurants easily, despite being vaccinated. I imagine this will
become a larger problem.

I have a report I'm willing to share, but I'd first like to know if there's
any interest in standardization on this front at the IETF despite this
topic being, I suspect, a bit of  astretch of our remit. However, we live
in interesting times.

I don't think the W3C (or the ITU, etc.) has the security expertise, and
while the crypto and security/privacy here is pretty simple, I think it
should happen somewhere. So I thought polling it by CFRG IRTF would be a
good idea to see what would happen, as the CFRG has probably the largest
security/privacy expertise in the wider IETF circles.

          yours,
             harry

[1] https://arxiv.org/abs/2012.00136

---

From: Eric Rescorla <[email-masked]>
Date: Fri, 30 Jul 2021 11:01:56 -0700

> * No use of standards for cross-app interoperability

In case people are interested, here are my comments on the EU proposal
https://educatedguesswork.org/posts/vaccine-passport-eu/

And a link to my comments on other proposals as well:
https://educatedguesswork.org/tags/vaccine%20passports/

Re the EU: I'm not sure I entirely agree with your assessment. For
instance, the DGC does seem to have key management.

> countries do not use cryptography at all (the US).
>

Well, there is no national system at all in the US, but there are systems
based on digital signatures in several states. For instance, California and
NY.

> security/privacy expertise in the wider IETF circles.

As you say, this is pretty straightforward technically, so if there were to
be an I*TF effort, it should probably be an IETF WG rather than in the
CFRG. With that said, while I think standardization would be valuable, ISTM
that the problem here is a bunch of independent standards proceeding, so
I'd want to see some evidence that the various players (EU, VCI, etc.) were
interested before starting off, lest we fall into XKCD 927.

-Ekr

---

From: Benjamin Kaduk <[email-masked]>
Date: Fri, 30 Jul 2021 11:03:22 -0700

Hi Harry,

Some arguably-pedantic process-adjacent notes: CFRG is a group of the
Internet Research Task Force, which does not produce standards.  (It does
have a bunch of smart people who know a lot about crypto, security, and
privacy, of course.)
There's also various fora at the Internet Engineering Task Force that cover
security and privacy, often by way of cryptography, and the IETF does
produce standards.  So, if the goal is to "produce a standard", starting at
the IETF SECDISPATCH or SAAG groups might be appropriate.  If the goal is
just to produce the right technology regardless of what it's called, then
I'm not really sure what objections there would be to covering it here.

-Ben

> _______________________________________________
> CFRG mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg

---

From: Harry Halpin <[email-masked]>
Date: Fri, 30 Jul 2021 20:32:02 +0200

Benjamin,

Thanks for the procedural note - just gauging interest (as this is the main
list I follow in the I*TF circles), but I just sent the message to gauge
interest in SAAG and SECDISPATCH.

Vaccine passports are obviously an international issue, and while I see
some major players in the "Vaccine Certificates Initiative" (VCI) like
Microsoft, Google, and Apple, I would also be worried as I seem
blockchain-pushers like Consensys Health that have backed the rather
insecure and privacy-invasive W3C "Verified Credential" approach (which
doesn't even have a normalization algorithm, and so risks repeating all the
mistakes of XML-DSIG on RDF data) rather than use something sane like
JOSE/COSE. Likewise, VCI features the Commons Project, whose "CommonPass"
was the first vaccine passport to be beta-tested between the UK and US, but
this rather mysterious group doesn't even have an open source
implementation or design doc. Thus, as a private member-only group without
open docs or an open github/mailing list, I'm not so sure I trust VCI to
pull off something that works well in terms of security or privacy as a
'real' standard should have.

So while I'd prefer not to have vaccine passports due to ethical concerns,
and yet at this point they seem likely to happen as some sort of
international standard whether I like it or not, and it seems like (at
least in France) the roll-out has been rather rushed from a privacy and
security standpoint.

I can't honestly think of another venue than the IETF, although the venue
selection seems odd.

   yours,
     harry