[Secdispatch] Interest COVID-19 'passport' standardization?

[Harry Halpin <[e-mail]>]

Everyone [and apologies if you already got this message on CFRG or SAAG],

While the research community and industry was very quick to work on
privacy-enhanced contact tracing, I've seen very few people taking the much
more pressing issue of COVID-19 passports.

If this IETF111 was in person, we could have done an informal BoF, but as
its' not, I'm sending out an email to gauge interest.

I've earlier seen some very badly done academic work using W3C "Verified
Credentials" and W3C Decentralized Identifier (DID) standards [1]. However,
while a bunch of sketchy blockchain technology has not been adopted (so
far, although I believe IATA and WHO are still being heavily lobbied in
this direction), there has been the release of the EU "Green" Digital
Credentials that actually uses digital signatures.

However, there's a number of problems:

* No revocation in case of compromise
* Privacy issues, i.e. leaking metadata
* Limited key management (booster shots might require)
* No use of standards for cross-app interoperability

Furthermore, there appears to be differences between countries, and some
countries do not use cryptography at all (the US). Therefore, as an
American in France who flew home ASAP to get vaccinated in the US, as a
consequence of this lack of interoperability I can't travel on trains or
eat at restaurants easily, despite being vaccinated. I imagine this will
become a larger problem.

I have a report I'm willing to share, but I'd first like to know if there's
any interest in standardization on this front at the IETF despite this
topic being, I suspect, a bit of  astretch of our remit. However, we live
in interesting times.

I don't think the W3C (or the ITU, etc.) has the security expertise, and
while the crypto and security/privacy here is pretty simple, I think it
should happen somewhere.

While I originally polled it by CFRG IRTF to see if there was any interest
whatsoever, Benjamin Kaduk pointed out SAAG and SECDISPATCH would be better
places to start. I'd like to know what others think.

          yours,
             harry

[1] https://arxiv.org/abs/2012.00136