Re: [Secdispatch] Interest COVID-19 'passport' standardization?

[Henk Birkholz <[e-mail]>]

Maybe getting some of the individuals involved that use IETF 
technologies to do [1] something like that [2] currently could be a good 
starting point.

Viele Grüße,

Henk

[1] https://github.com/ehn-dcc-development/hcert-spec
[2] https://github.com/eu-digital-green-certificates/dgc-overview



On 30.07.21 20:18, Harry Halpin wrote:
> Everyone [and apologies if you already got this message on CFRG or SAAG],
> 
> While the research community and industry was very quick to work on 
> privacy-enhanced contact tracing, I've seen very few people taking the 
> much more pressing issue of COVID-19 passports.
> 
> If this IETF111 was in person, we could have done an informal BoF, but 
> as its' not, I'm sending out an email to gauge interest.
> 
> I've earlier seen some very badly done academic work using W3C "Verified 
> Credentials" and W3C Decentralized Identifier (DID) standards [1]. 
> However, while a bunch of sketchy blockchain technology has not been 
> adopted (so far, although I believe IATA and WHO are still being heavily 
> lobbied in this direction), there has been the release of the EU "Green" 
> Digital Credentials that actually uses digital signatures.
> 
> However, there's a number of problems:
> 
> * No revocation in case of compromise
> * Privacy issues, i.e. leaking metadata
> * Limited key management (booster shots might require)
> * No use of standards for cross-app interoperability
> 
> Furthermore, there appears to be differences between countries, and some 
> countries do not use cryptography at all (the US). Therefore, as an 
> American in France who flew home ASAP to get vaccinated in the US, as a 
> consequence of this lack of interoperability I can't travel on trains or 
> eat at restaurants easily, despite being vaccinated. I imagine this will 
> become a larger problem.
> 
> I have a report I'm willing to share, but I'd first like to know if 
> there's any interest in standardization on this front at the IETF 
> despite this topic being, I suspect, a bit of  astretch of our remit. 
> However, we live in interesting times.
> 
> I don't think the W3C (or the ITU, etc.) has the security expertise, and 
> while the crypto and security/privacy here is pretty simple, I think it 
> should happen somewhere.
> 
> While I originally polled it by CFRG IRTF to see if there was any 
> interest whatsoever, Benjamin Kaduk pointed out SAAG and SECDISPATCH 
> would be better places to start. I'd like to know what others think.
> 
>            yours,
>               harry
> 
> [1] https://arxiv.org/abs/2012.00136 <https://arxiv.org/abs/2012.00136>
> 
> _______________________________________________
> Secdispatch mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/secdispatch
>