IETF Logo Mail Archive

Re: [saag] Interest COVID-19 'passport' standardization?

Henry Story <henry.story@gmail.com> Mon, 02 August 2021 12:55 UTC

Return-Path: <henry.story@gmail.com>
X-Original-To: saag@ietfa.amsl.com
Delivered-To: saag@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 452073A1C5C for <saag@ietfa.amsl.com>; Mon, 2 Aug 2021 05:55:50 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Wj34TiXS2mF3 for <saag@ietfa.amsl.com>; Mon, 2 Aug 2021 05:55:45 -0700 (PDT)
Received: from mail-wr1-x432.google.com (mail-wr1-x432.google.com [IPv6:2a00:1450:4864:20::432]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 00FED3A1C5A for <saag@ietf.org>; Mon, 2 Aug 2021 05:55:44 -0700 (PDT)
Received: by mail-wr1-x432.google.com with SMTP id z4so21400821wrv.11 for <saag@ietf.org>; Mon, 02 Aug 2021 05:55:44 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=P/T9ZXZeMHS8FmLsg5pEaKTntzRIh29H5id0jIFkb2U=; b=Kx0eQsq5vryKbR1VvunzilpZLceXZugrnQu+hOUtzES9pzPn+YbGZCV9DXY6kN7zMM ySHvQxKrKSfoXZ281xFfuUJTxiXACTEvdAC0XULm+qpeEFqPFTke/UDBKE6M21hADBai TP+d+h31GBn+gLSiI965VQScXqadhN8lv//F9Puq/NhVvPLshhWpvg+11xs8AEJ+fK1E bdZg78ErP2KVQtf/w/dzNqy9q0Zl67VgO8ZWA3L1+749Insn0fTnaw+biq8OuHSUD7hM Er2NiU3cwu/aKOgYFbWqLM2KTiTZYvdSioea+0MvUKSIXG1p5jEL4bOXgo7C4f0tcbf8 xHOw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=P/T9ZXZeMHS8FmLsg5pEaKTntzRIh29H5id0jIFkb2U=; b=AVJ4JUoy8PW2kEjFeDYr6FtybpywU/Ko4c6HhoLk2eMaflvcIDMMy6m/fKgUoXc2HC PPApUBCk1mHhn6mtI1m4B9E4XOS+MG4R/cy58hnX2Yn9SYjAYzWKOXqRVOeILmfDTH5h F5czWVHpw8AKkiOnYnhTvaJxcl82+8Ceqi1vk5fr4faPsRyuA+IEphJH1YvYDg6e4mZJ XAtPtZp27nulCFTd+H49oTjSNvopWr2OPxiUmFlk2/gqJn3PZfJf3Z2EO/Jz4jR/ERzh 33u/0rZN7AmvAvpN5qElsnGgya8eDDcCwJqscVQlgFyOadgkha3MHkIC88Y3eK26HP8p N+Nw==
X-Gm-Message-State: AOAM530YjQgLqpcVqHZBo/RyzBY69rcO4t6u2vyQrPzXcEuzH3nGrLef VO95afQmksgVqZrgIzIyNJ0=
X-Google-Smtp-Source: ABdhPJzDYlSDbs0mFGDOXSyP364CPoC2jA1PrOMOIX12dGc9Q8FVcM8A4rvKFDwVGA16HON9gFlqOA==
X-Received: by 2002:adf:e90e:: with SMTP id f14mr17277665wrm.191.1627908942001; Mon, 02 Aug 2021 05:55:42 -0700 (PDT)
Received: from smtpclient.apple (p200300cf1704c50015322da6acbe54f8.dip0.t-ipconnect.de. [2003:cf:1704:c500:1532:2da6:acbe:54f8]) by smtp.gmail.com with ESMTPSA id r129sm1419280wmr.7.2021.08.02.05.55.41 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 02 Aug 2021 05:55:41 -0700 (PDT)
Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 15.0 \(3686.0.1.2.1\))
From: Henry Story <henry.story@gmail.com>
In-Reply-To: <28C00F14-D1D5-429A-9D79-B67BBFC8A614@webweaving.org>
Date: Mon, 2 Aug 2021 14:55:39 +0200
Cc: IETF SAAG <saag@ietf.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <7337FAE2-8D60-429E-8290-34D25CFDBE59@gmail.com>
References: <CAE1ny+4QdmSJS-spV6Do5yDs1x3iAwyHdSx=Oa+cRXU+ESZ2nA@mail.gmail.com> <CADPMZDBu2cbtWk7Y4YMKXOWXQoKsBkAD9D1AuC_Rp+9xHawX7w@mail.gmail.com> <E0FDB1EE-256D-4925-9EE7-49DE212BFF02@gmail.com> <28C00F14-D1D5-429A-9D79-B67BBFC8A614@webweaving.org>
To: Dirk Willem van Gulik <dirkx@webweaving.org>
X-Mailer: Apple Mail (2.3686.0.1.2.1)
Archived-At: <https://mailarchive.ietf.org/arch/msg/saag/_0aUrhXxL6E7cB-wRbhDtr2ofeE>
Subject: Re: [saag] Interest COVID-19 'passport' standardization?
X-BeenThere: saag@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Security Area Advisory Group <saag.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/saag>, <mailto:saag-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/saag/>
List-Post: <mailto:saag@ietf.org>
List-Help: <mailto:saag-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/saag>, <mailto:saag-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 02 Aug 2021 12:55:50 -0000


> On 2. Aug 2021, at 14:36, Dirk-Willem van Gulik <dirkx@webweaving.org> wrote:
> 
>> 
>> In the end we are all going to get it: vaccines rollouts are indeed aiming 
>> at doing just that. So that is why I would not be that worried about privacy 
>> with such Credentials. 
> 
> While I would Agee in theory - I think we have quite a while to go to create VC’s that are sufficiently resistant against surveillance; including surveillance by the issuing entity.

Ah yes, one would like to be able to use the credential without the issuer knowing
that one has presented it. 

The Self Sovereign Identity book [1] - which really helps give a good overview of 
the area - has quite a lot to say on how the architecture they 
have built up to stop the issuer needing to know about the use of the credential.
There is talk of zero knowledge proof, etc…

Note there are also other scenarios, e.g. self issues certificates for creating
decentralised social networks using a Tor WebID [2], where having a dereferenceable 
ID would not be a privacy problem, since then you would be hosting your own key.

Henry

[1] https://www.manning.com/books/self-sovereign-identity
[2] https://www.w3.org/2005/Incubator/webid/spec/identity/

v2.8.7 | Report a Bug | By Email