Re: [Secdispatch] [saag] Interest COVID-19 'passport' standardization?

I doubt that the problem with Covid credentials has to do with the 
format of the credentials, or even the signature technology used to 
sign them.

The knowledge about the virus and the responses to it are evolving
very quickly, and so the flexibility of W3C Verifiable Credentials 
comes in very handy here, as it is built on semantic web standards
built on top of first order logic, hypergraphs, and designed for 
decentralisation, and evolvability. 

This flexibility is particularly important in a geo-political reality 
that covers many nations, with many different languages, different laws 
and no center of control. 

The verifiable Credentials standards do provide one important element
of the puzzle, but it does not solve help to tell which institutions 
are authorized  by a country to give out such credentials. That is something each 
country can only decide for itself, each differently as each country 
has different health systems, regulations, policing, etc… 

So what is needed is a way to link these countries together so that 
a verifying software can tell at any time if the institution that signed
a credential is entitled to make such claims by its country, and a way
to allow different vocabularies to evolve in a way that makes convergence
possible.

This requires a Web of Nations (WoN), which I wrote up here:
https://co-operating.systems/2020/06/01/

Technologically we have all the pieces to build such a system.
But it requires many different parties to come together to get it to work.

Henry Story

> On 30. Jul 2021, at 20:29, Eric Rescorla <ekr@rtfm.com> wrote:
> 
> To recap my comments on CFRG:
> There seems to be a lot of enthusiasm for this in various forums, and it's largely not well coordinated, with each group (the EU, VCI, etc.) doing their own thing, and producing work of various levels of quality. Before the IETF got involved, I'd want to see some evidence that the various players are interested in a common standard and want to do one here, lest we end up with XKCD 927.
> 
> FWIW, I've spent a bunch of time looking at the various proposals. If people are interested they can find it at:
> https://educatedguesswork.org/tags/vaccine%20passports/
> 
> -Ekr
> 
> 
> 
> 
> On Fri, Jul 30, 2021 at 11:18 AM Harry Halpin <hhalpin@ibiblio.org> wrote:
> Everyone [and apologies if you already got this message on CFRG or SECDISPATCH],
> 
> While the research community and industry was very quick to work on privacy-enhanced contact tracing, I've seen very few people taking the much more pressing issue of COVID-19 passports.
> 
> If this IETF111 was in person, we could have done an informal BoF, but as its' not, I'm sending out an email to gauge interest. 
> 
> I've earlier seen some very badly done academic work using W3C "Verified Credentials" and W3C Decentralized Identifier (DID) standards [1]. However, while a bunch of sketchy blockchain technology has not been adopted (so far, although I believe IATA and WHO are still being heavily lobbied in this direction), there has been the release of the EU "Green" Digital Credentials that actually uses digital signatures.
> 
> However, there's a number of problems: 
> 
> * No revocation in case of compromise
> * Privacy issues, i.e. leaking metadata
> * Limited key management (booster shots might require)
> * No use of standards for cross-app interoperability
> 
> Furthermore, there appears to be differences between countries, and some countries do not use cryptography at all (the US). Therefore, as an American in France who flew home ASAP to get vaccinated in the US, as a consequence of this lack of interoperability I can't travel on trains or eat at restaurants easily, despite being vaccinated. I imagine this will become a larger problem. 
> 
> I have a report I'm willing to share, but I'd first like to know if there's any interest in standardization on this front at the IETF despite this topic being, I suspect, a bit of  astretch of our remit. However, we live in interesting times. 
> 
> I don't think the W3C (or the ITU, etc.) has the security expertise, and while the crypto and security/privacy here is pretty simple, I think it should happen somewhere. 
> 
> While I originally polled it by CFRG IRTF to see if there was any interest whatsoever, Benjamin Kaduk pointed out SAAG and SECDISPATCH would be better places to start. I'd like to know what others think.
> 
>           yours,
>              harry
> 
> [1] https://arxiv.org/abs/2012.00136
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag