IETF Logo Mail Archive

Re: [saag] Interest COVID-19 'passport' standardization?

Thomas Hardjono <hardjono@mit.edu> Mon, 02 August 2021 14:25 UTC

Return-Path: <hardjono@mit.edu>
X-Original-To: saag@ietfa.amsl.com
Delivered-To: saag@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 732773A20A6 for <saag@ietfa.amsl.com>; Mon, 2 Aug 2021 07:25:44 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.896
X-Spam-Level:
X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RR7uDz49l5Nl for <saag@ietfa.amsl.com>; Mon, 2 Aug 2021 07:25:42 -0700 (PDT)
Received: from outgoing-exchange-5.mit.edu (outgoing-exchange-5.mit.edu [18.9.28.59]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E33B83A20A9 for <saag@ietf.org>; Mon, 2 Aug 2021 07:25:41 -0700 (PDT)
Received: from w92exedge4.exchange.mit.edu (W92EXEDGE4.EXCHANGE.MIT.EDU [18.7.73.16]) by outgoing-exchange-5.mit.edu (8.14.7/8.12.4) with ESMTP id 172EPN9m015695; Mon, 2 Aug 2021 10:25:39 -0400
Received: from oc11expo23.exchange.mit.edu (18.9.4.88) by w92exedge4.exchange.mit.edu (18.7.73.16) with Microsoft SMTP Server (TLS) id 15.0.1497.23; Mon, 2 Aug 2021 10:24:44 -0400
Received: from oc11expo23.exchange.mit.edu (18.9.4.88) by oc11expo23.exchange.mit.edu (18.9.4.88) with Microsoft SMTP Server (TLS) id 15.0.1497.23; Mon, 2 Aug 2021 10:24:48 -0400
Received: from oc11expo23.exchange.mit.edu ([18.9.4.88]) by oc11expo23.exchange.mit.edu ([18.9.4.88]) with mapi id 15.00.1497.023; Mon, 2 Aug 2021 10:24:48 -0400
From: Thomas Hardjono <hardjono@mit.edu>
To: "hhalpin@ibiblio.org" <hhalpin@ibiblio.org>
CC: IETF SAAG <saag@ietf.org>
Thread-Topic: [saag] Interest COVID-19 'passport' standardization?
Thread-Index: AQHXhW8igGA7Ry5mr0yZcTfi4qbYZqtgUOwAgAAN1ICAAB1RgIAABgKA///G+Hw=
Date: Mon, 2 Aug 2021 14:24:48 +0000
Message-ID: <ecf66a91bb15452cb8e35266ad4f3513@oc11expo23.exchange.mit.edu>
References: <CAE1ny+4QdmSJS-spV6Do5yDs1x3iAwyHdSx=Oa+cRXU+ESZ2nA@mail.gmail.com> <CADPMZDBu2cbtWk7Y4YMKXOWXQoKsBkAD9D1AuC_Rp+9xHawX7w@mail.gmail.com> <E0FDB1EE-256D-4925-9EE7-49DE212BFF02@gmail.com> <360C07DB-2B3A-4CDF-9747-31D2FCBABFC4@tzi.org>, <8C67B77C-A2EB-4203-8713-E10CF8A12EEA@webweaving.org>
In-Reply-To: <8C67B77C-A2EB-4203-8713-E10CF8A12EEA@webweaving.org>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [73.100.88.16]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/saag/JWqUaRubDJb8rzxv5gsrEixWcc4>
Subject: Re: [saag] Interest COVID-19 'passport' standardization?
X-BeenThere: saag@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Security Area Advisory Group <saag.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/saag>, <mailto:saag-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/saag/>
List-Post: <mailto:saag@ietf.org>
List-Help: <mailto:saag-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/saag>, <mailto:saag-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 02 Aug 2021 14:25:45 -0000

Back to Harry's original question, I think there are already several standard formats and protocols that can be used for a "Covid-19 Passport" .

If the "basic" passport is simply  a signed assertion by a legal authority in a jurisdiction (e.g. government, health dept.) that a person has received a vaccine shot(s), then there are lots of options to build from:

-- X.509 certs and attribute certs (RFC5280 and related RFCs).

-- SAML2.0 core spec (which has a basic XML signed assertions data structure). 

-- JWTs and signed JSON tokens (RFC7519 and related RFCs).

-- ID_tokens from the OpenID core spec 1.3.

-- "Simplified" DID, where the issuer/signer is the gov and the URL points to a Method owned/operated by the Gov.

-- GNAP (which is still under development).



Not to throw a wrench into the mix, but will the IETF require me to show a "Covid-19 Passport" to attend the next F2F meeting?

Best


-- thomas --

v2.8.7 | Report a Bug | By Email