Re: [CFRG] Question over COVID-19 'passport' standardization?

[Harry Halpin <[e-mail]>]

Benjamin,

Thanks for the procedural note - just gauging interest (as this is the main
list I follow in the I*TF circles), but I just sent the message to gauge
interest in SAAG and SECDISPATCH.

Vaccine passports are obviously an international issue, and while I see
some major players in the "Vaccine Certificates Initiative" (VCI) like
Microsoft, Google, and Apple, I would also be worried as I seem
blockchain-pushers like Consensys Health that have backed the rather
insecure and privacy-invasive W3C "Verified Credential" approach (which
doesn't even have a normalization algorithm, and so risks repeating all the
mistakes of XML-DSIG on RDF data) rather than use something sane like
JOSE/COSE. Likewise, VCI features the Commons Project, whose "CommonPass"
was the first vaccine passport to be beta-tested between the UK and US, but
this rather mysterious group doesn't even have an open source
implementation or design doc. Thus, as a private member-only group without
open docs or an open github/mailing list, I'm not so sure I trust VCI to
pull off something that works well in terms of security or privacy as a
'real' standard should have.

So while I'd prefer not to have vaccine passports due to ethical concerns,
and yet at this point they seem likely to happen as some sort of
international standard whether I like it or not, and it seems like (at
least in France) the roll-out has been rather rushed from a privacy and
security standpoint.

I can't honestly think of another venue than the IETF, although the venue
selection seems odd.

   yours,
     harry




On Fri, Jul 30, 2021 at 8:03 PM Benjamin Kaduk <[e-mail]> wrote:

> Hi Harry,
>
> Some arguably-pedantic process-adjacent notes: CFRG is a group of the
> Internet Research Task Force, which does not produce standards.  (It does
> have a bunch of smart people who know a lot about crypto, security, and
> privacy, of course.)
> There's also various fora at the Internet Engineering Task Force that cover
> security and privacy, often by way of cryptography, and the IETF does
> produce standards.  So, if the goal is to "produce a standard", starting at
> the IETF SECDISPATCH or SAAG groups might be appropriate.  If the goal is
> just to produce the right technology regardless of what it's called, then
> I'm not really sure what objections there would be to covering it here.
>
> -Ben
>
> On Fri, Jul 30, 2021 at 07:47:13PM +0200, Harry Halpin wrote:
> > Everyone,
> >
> > While the research community and industry was very quick to work on
> > privacy-enhanced contact tracing, I've seen very few people taking the
> much
> > more pressing issue of COVID-19 passports.
> >
> > I've earlier seen some very badly done academic work using W3C "Verified
> > Credentials" and W3C Decentralized Identifier (DID) standards [1].
> However,
> > while a bunch of sketchy blockchain technology has not been adopted (so
> > far, although I believe IATA and WHO are still being heavily lobbied in
> > this direction), there has been the release of the EU "Green" Digital
> > Credentials that actually uses digital signatures.
> >
> > However, there's a number of problems:
> >
> > * No revocation in case of compromise
> > * Privacy issues, i.e. leaking metadata
> > * No key management (booster shots might require)
> > * No use of standards for cross-app interoperability
> >
> > Furthermore, there appears to be differences between countries, and some
> > countries do not use cryptography at all (the US). Therefore, as an
> > American in France who flew home ASAP to get vaccinated in the US, as a
> > consequence of this lack of interoperability I can't travel on trains or
> > eat at restaurants easily, despite being vaccinated. I imagine this will
> > become a larger problem.
> >
> > I have a report I'm willing to share, but I'd first like to know if
> there's
> > any interest in standardization on this front at the IETF despite this
> > topic being, I suspect, a bit of  astretch of our remit. However, we live
> > in interesting times.
> >
> > I don't think the W3C (or the ITU, etc.) has the security expertise, and
> > while the crypto and security/privacy here is pretty simple, I think it
> > should happen somewhere. So I thought polling it by CFRG IRTF would be a
> > good idea to see what would happen, as the CFRG has probably the largest
> > security/privacy expertise in the wider IETF circles.
> >
> >           yours,
> >              harry
> >
> > [1] https://arxiv.org/abs/2012.00136
>
> > _______________________________________________
> > CFRG mailing list
> > [e-mail]
> > https://www.irtf.org/mailman/listinfo/cfrg
>
>