Re: [saag] Interest COVID-19 'passport' standardization?

[Stephen Farrell <[e-mail]>]

I don't believe the IETF ought be active in this space.

For their originally designed purpose (cross border travel),
these systems seem mostly ok as traditional passports will
also be shown at the same time. I don't see that the travel
authorities need help from the IETF for that.

We are seeing significant feature-creep e.g. these QR codes
are now being required for indoor dining here in Ireland at
the moment. The scanning technology offered to venues by the
Irish govt at the moment is an awful online web page [1] to
which all the QR code data is sent (so govt servers get to
see who enters where, when, even though they say they don't
store any of that). That system is likely (IMO) to be widely
ignored within weeks of it's unwise introduction. We'd be far
better to stay uninvolved there too IMO.

Cheers,
S.

[1] https://app.digitalcovidcertchecker.gov.ie



On 30/07/2021 19:17, Harry Halpin wrote:
> Everyone [and apologies if you already got this message on CFRG or
> SECDISPATCH],
> 
> While the research community and industry was very quick to work on
> privacy-enhanced contact tracing, I've seen very few people taking the much
> more pressing issue of COVID-19 passports.
> 
> If this IETF111 was in person, we could have done an informal BoF, but as
> its' not, I'm sending out an email to gauge interest.
> 
> I've earlier seen some very badly done academic work using W3C "Verified
> Credentials" and W3C Decentralized Identifier (DID) standards [1]. However,
> while a bunch of sketchy blockchain technology has not been adopted (so
> far, although I believe IATA and WHO are still being heavily lobbied in
> this direction), there has been the release of the EU "Green" Digital
> Credentials that actually uses digital signatures.
> 
> However, there's a number of problems:
> 
> * No revocation in case of compromise
> * Privacy issues, i.e. leaking metadata
> * Limited key management (booster shots might require)
> * No use of standards for cross-app interoperability
> 
> Furthermore, there appears to be differences between countries, and some
> countries do not use cryptography at all (the US). Therefore, as an
> American in France who flew home ASAP to get vaccinated in the US, as a
> consequence of this lack of interoperability I can't travel on trains or
> eat at restaurants easily, despite being vaccinated. I imagine this will
> become a larger problem.
> 
> I have a report I'm willing to share, but I'd first like to know if there's
> any interest in standardization on this front at the IETF despite this
> topic being, I suspect, a bit of  astretch of our remit. However, we live
> in interesting times.
> 
> I don't think the W3C (or the ITU, etc.) has the security expertise, and
> while the crypto and security/privacy here is pretty simple, I think it
> should happen somewhere.
> 
> While I originally polled it by CFRG IRTF to see if there was any interest
> whatsoever, Benjamin Kaduk pointed out SAAG and SECDISPATCH would be better
> places to start. I'd like to know what others think.
> 
>            yours,
>               harry
> 
> [1] https://arxiv.org/abs/2012.00136
> 
> 
> _______________________________________________
> saag mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/saag
>