Re: [saag] Interest COVID-19 'passport' standardization?

[Dirk-Willem van Gulik <[e-mail]>]

On 2 Aug 2021, at 13:41, Henry Story <[e-mail]> wrote:

> But Verifiable Credentials could also be used to hold a ”proof of not
> having the virus at time T” if needed, or even a proof of having had it, 
> which should be as good as having had a vaccine. 

 Note that the initial vaccination cases are relatively easy - the technical complexity is quite high when it comes to things such as ‘recovery certificates’ (it is considered the equivalent if you are sure in had covid - and are thus are the ‘equivalent’ of having been vaccinated; and the various test statements (all of which are considered equivalent (with a lot of complexity interoperable internet engineering behind it https://github.com/ehn-dcc-development/dgc-business-rules).

> In the end we are all going to get it: vaccines rollouts are indeed aiming 
> at doing just that. So that is why I would not be that worried about privacy 
> with such Credentials. 

While I would Agee in theory - I think we have quite a while to go to create VC’s that are sufficiently resistant against surveillance; including surveillance by the issuing entity.

For the Netherlands domestic solution (where the certificate does not contain the persons full name or DoB) - we could not easily find anything ‘off the shelf’ that would allow offline verification and was resistant against surveillance / recognising a repeat customer (or having too little entropy - e.g. due to the time of the test being too granular in seconds due to the size of our (small) country / small commercial test providers)

In particular not leaking the vaccination status – test and vaccination must be indistinguishable — was hard.

Attached is a short presentation by one of my colleagues with the highlights and links to the actual code/design.

Dw.