Re: [CFRG] Question over COVID-19 'passport' standardization?

Hi Harry,

Some arguably-pedantic process-adjacent notes: CFRG is a group of the
Internet Research Task Force, which does not produce standards.  (It does
have a bunch of smart people who know a lot about crypto, security, and
privacy, of course.)
There's also various fora at the Internet Engineering Task Force that cover
security and privacy, often by way of cryptography, and the IETF does
produce standards.  So, if the goal is to "produce a standard", starting at
the IETF SECDISPATCH or SAAG groups might be appropriate.  If the goal is
just to produce the right technology regardless of what it's called, then
I'm not really sure what objections there would be to covering it here.

-Ben

On Fri, Jul 30, 2021 at 07:47:13PM +0200, Harry Halpin wrote:
> Everyone,
> 
> While the research community and industry was very quick to work on
> privacy-enhanced contact tracing, I've seen very few people taking the much
> more pressing issue of COVID-19 passports.
> 
> I've earlier seen some very badly done academic work using W3C "Verified
> Credentials" and W3C Decentralized Identifier (DID) standards [1]. However,
> while a bunch of sketchy blockchain technology has not been adopted (so
> far, although I believe IATA and WHO are still being heavily lobbied in
> this direction), there has been the release of the EU "Green" Digital
> Credentials that actually uses digital signatures.
> 
> However, there's a number of problems:
> 
> * No revocation in case of compromise
> * Privacy issues, i.e. leaking metadata
> * No key management (booster shots might require)
> * No use of standards for cross-app interoperability
> 
> Furthermore, there appears to be differences between countries, and some
> countries do not use cryptography at all (the US). Therefore, as an
> American in France who flew home ASAP to get vaccinated in the US, as a
> consequence of this lack of interoperability I can't travel on trains or
> eat at restaurants easily, despite being vaccinated. I imagine this will
> become a larger problem.
> 
> I have a report I'm willing to share, but I'd first like to know if there's
> any interest in standardization on this front at the IETF despite this
> topic being, I suspect, a bit of  astretch of our remit. However, we live
> in interesting times.
> 
> I don't think the W3C (or the ITU, etc.) has the security expertise, and
> while the crypto and security/privacy here is pretty simple, I think it
> should happen somewhere. So I thought polling it by CFRG IRTF would be a
> good idea to see what would happen, as the CFRG has probably the largest
> security/privacy expertise in the wider IETF circles.
> 
>           yours,
>              harry
> 
> [1] https://arxiv.org/abs/2012.00136

> _______________________________________________
> CFRG mailing list
> CFRG@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg