35

When you apply for a passport, driver's license, home mortgage, bank account, credit card, etc., the issuing organization must verify your identity. In the course of doing so, would it be feasible for them to issue an x.509 certificate? These could then be used by individuals for S/MIME, quick-and-easy identification on government websites, digital signatures on electronic tax filing, etc.

Specifically, I want to know:

  • Is there any reason (from a security standpoint) that a government, bank, or credit card company should not be part of PKI?
  • Does it make sense to issue x.509 certificates that are associated with "offline" entities, the way PGP keys are (supposed to be) associated with real people?
  • 2
    Is there a national government that does not have a CA? As for banks, there are some. a simple google search shows several. – Mindwin Jan 20 '17 at 16:20
  • 2
    @Mindwin I'm asking about a CA for issuing certificates to individual bank customers. My bank sure as heck didn't give me a cert. – shadowtalker Jan 20 '17 at 16:27
  • I think that @Mindwin gave you an example of a bank that issues certificates to individuals, although it is a central bank, not a retail bank. – Ellie Kesselman Jan 22 '17 at 8:10
  • e-Estonia is the best example of an open system like this. Most banks do issue their customers a certificate; it is embedded within the chip on your bank card. However, this is a closed system - third-party developers can't (easily) integrate with it. – paj28 Jan 22 '17 at 13:39
  • 1
    @ssdecontrol - Roughly, yes. There's a much better explanation in this answer – paj28 Jan 22 '17 at 14:17
10

Case study: Italy

Italy provides a well-known root CA list. The list is made mainly by banks or official professional associations.

The official list is maintained at this address (no English version found), official requirements in English listed here.

What the OP legitimately asks is if the government itself, or a trusted agency may release X.509 certificates for everyone for public use, e.g. sign your own email.

Talking about Italy and mainly other EU countries, this is mainly a cost/benefit choice. Central governments do not normally have large budgets.

Issuing a passport is something different than maintaining digital certificates. A passport is something governments are issuing to the majority of their people to allow international travels, considering modern passenger flows, email-signing certificates are used by a definitely small niche of the market.

Commercial companies as the ones listes above require money by people applying for a digital ID in order to support their complex and critical infrastructure. They will check your government-issue ID to bind a specific digital identity (public key) to a government-issued identity, which in simple words is you but then leads us in the field of philosophy: "Who are we? What is the relationship between an individual and his identity? Is it illegal to use a legal name?"

In Italy, again, something more specific for some kind of unified digital ID has been done and is called SPID (pron. speed, acronym Sistema Pubblico per l'Identità Digitale, Public System for Digital Identity) and is implemented using X.509 certificates and SAML tokens exchange. Those certificates can be used only to authenticate. Unfortunately the entire expensive project will have a hard life.

Shattered Italian digital IDs (pre-SPID era)

So far all government offices tried to implement their own digital ID system to allow people to use a lot of online services, but the absence of a single government-pushed digital ID standard let do fragmentation in the market.

The 20 regions implemented the "CRS" (Carta Regionale Servizi, Regional Health Card), which is basically your Health Card enhanced with a smart card token, of which Wikipedia shows no photo (but really, think about a chip on the same plastic tag you find now). It contains an SSL Client certificate valid only (gasp!) within your Region, so if you relocate you need to replace your card despite your Tax Code does not change during your entire life.

Another implementation of officially-recognized IDs was digital signature. Yea, that's right! X.509-powered non-repudiation certificates stored in... uhm... that's the point! Those signatures were originally developed to give legal value to PDF/TXT documents, such as notary or government acts, but also private contracts. They needed to be deployed to smart cards or USB/SIM tokens, but their difficulty of utilization (need a workstation with reader, drivers and software, with the OSS community angry) forced the powers-that-be to approve HSMs. Long story short they are used only within specific regulated environments where hand signature is now forbidden or non-practical.

And then certified email. Third disaster in the country under examination. What the OP asked is a digital certificate for his emails, right? Riiiiiiiight? Italian people are smart, so smart that they have reinvented their own SMTP with PEC (Posta Elettronica Certificata, Electronic Certified Mail). Quick lesson on PEC:

  • PEC address space is separated from internet-mail (RFC822) spaces. They comply to the RFC but basically a PEC address, in the original form, did not accept mail from internet host and could send only to PEC address spaces. This has changed, as now the exception is that a PEC-to-email message is not fully certified
  • ISPs provide proof of delivery that can is required to be accepted in official acts and courts
  • ISPs also provide binding of addresses to identities with a public registry
  • Private keys are held by ISPs. You do not sign your message, they do with your signature. Scary!!!!

For example, if you want to officially inquire Mr. President Gentiloni, drop a message to presidenza@pec.governo.it they can't deny to have received.

Now to SPID. Under President Renzi government, Italy finally tried to define an "ID system that rules them all". SPID was meant to allow citizens to access all online public systems with a single ID. SPID is currently a username/password/OTP authentication issued by 4 companies only. Government agencies are mandated to support SPIDfor public-oriented services. In the near future, we expect SPID to be used for schooling, as you already sign up for your children's school offline or online with or without a SPID.

All the digital ID systems suffer one thing: people don't need them in their daily life and that is the reason they don't sign up for them even when they are free. Digital alphabetization in this country is quite low compared to other countries, and all services/offices except one, with obviously no English localization are available without a SPID digital ID.

International trust

Attempts in the EU are being made to make digital signatures and digital IDs interoperable across countries. However, until a single list of trusted CAs will be made across all Europe, certificates issued in a certain country are not necessarily trusted in another.

This is being mitigated by the eIDAS directive. A lot of time will take for digital IDs to be usable across all EU countries, but the goal is to make a unique "trust market" along the current "unique [currency] market".

Offline vs online trust

Digital IDs has little to do with Microsoft and Mozilla trusted certificates. If you see a certain CA in your browser's trust list it does not mean that the CA has power to issue a certificate valid for signing Revenue Agency documents. No, it means that the CA can issue a certificate stating the machine can "officially" respond for requests directed to "https://www.example.org".

The strenght and at the same time complexity of the PKI system itself is the lack of a single, central, trust list. Such lack is the only means of democracy in Internet, but here we are again: a CA must be enlisted in all lists to become "operational".

As an example, I'd like to ask users from America, East Asia and Oceania if their computers trust the following certificate:

  • Serial: ‎35 d9 75 94 d1 b6 75 4d b6 36 42 cb b5 ea cf cf
  • Subject DN: SERIALNUMBER = 97103420580,SN = Sicurezza,G = Ufficio,O = ,DigitPA,C = IT
  • Issued by DN: CN = Ufficio Sicurezza,O = DigitPA,C = IT
  • Valid until: 2020-05-17

Hint: my Windows 10 says "no"

But that certificate is an official government-related certificate.

Conclusion

I provided an example in which a central government or a bank trusted by the government issues X.509 certificates to people. There is to me no real good reason for a government not to be a CA.

The OP should not confuse the legal validity of a "paper" ID with the commercial added-value of an interoperable "digital ID", which effectively is a commercial good worth money.

Disclosure: my company actively works in fiscal environment, where our customers (financial operators) are mandated by law to obtain and properly use digital signatures. I work daily with digital IDs so I claim to be an "expert" in the subject.

  • A passport is something governments are required to issue to their people to allow international travels, may want to re-word this. In China, if the government has reason to believe you will embarrass them or speak out against them, they will deny or cancel your passport. In the United States, the government can also deny or cancel your passport if they suspect you of X, or if you're guilty of Y. Neither government is required to give you a passport if they don't want to. – Mark Buffalo Oct 24 '17 at 18:48
  • Yes Mark, my intent was speaking in terms of numbers. Let the numbers speak then – usr-local-ΕΨΗΕΛΩΝ Oct 24 '17 at 18:56
31

I know of at least one government that has a root CA:

Staat der Nederlanden Root CA

The state of the Netherlands. As far as I know they don't use it to identify people when they come pick up their driver license.

I think Estonia has a system in which all residents have a card containing a certificate.

  • 11
    Multiple European governments (I know of France and Germany) don't operate their own public CA directly but they have (formerly and now at least partially) state-owned telecommunication companies who operate a public CA each. – David Foerster Jan 19 '17 at 18:21
  • 1
    As an interesting aside, the Dutch Government was heavily affected by the DigiNotar breach and then took over operations of that CA. – Boris the Spider Jan 20 '17 at 8:27
  • 4
    @user1 if a CA is trusted by browsers, the owner of that CA can perform MITM attacks against anyone using the browser! Certificate pinning is designed to prevent such attacks. – Boris the Spider Jan 20 '17 at 10:16
  • 4
    @user1 Most national CAs aren't actually trusted by browsers (they don't need this, since they do not issue TLS server certificates). – grawity Jan 20 '17 at 12:28
  • 3
    @user1 Theoretically yes, but note that any CA being found performing a MITM attack (which would be easy to prove) would lead to their immediate revocation and a lot of public shaming. – Ángel Jan 21 '17 at 1:08
20

To complement Sjoerd's answer: some countries even give every single citizen and resident their own certificates, stored inside an ICC that is also the primary identity document. For illustration, here are mine (and the two CAs from the trust store of my macOS computer).

Belgium Root CA3, Citizen CA, and two citizen certificates

They're used in government agencies, post offices, pharmacies, and even companies. Many also use them online (using a smartcard reader and a browser extension) to file their taxes, access official correspondence, or request/check on social benefits.

  • 3
    Wow, this is damn close to what I had in mind. It makes a ton of sense. Can you also use those certificates as encryption keys? – shadowtalker Jan 19 '17 at 23:44
  • 4
    @ssdecontrol The private key is stored in government records. It's strictly an authentication and signing key for official affairs. Non-governmental entities still use state-provided APIs and websites, passing tokens (or something like that; I'm not an expert in that field) around generated by the ICC (the chip is PIN-protected). Although it would've been handy to add more keys to the card, e.g., for building access or for banking, it's not possible as far as I know. ;-) – Constantino Tsarouhas Jan 20 '17 at 0:23
  • Yep, many European countries do this (although usually not nearly as well-developed as Estonia's) – my ID card in 2009 already had a certificate as well. Operators here even issue special SIM cards capable of holding X.509 certs. (Although they have no public API, so they're mainly for accessing banks and gov't sites...) – grawity Jan 20 '17 at 12:27
  • 2
    @RandyMarsh: Are you sure the government records actually store the private key? They don't need this for your mentioned purposes, and at least here the rules for "qualified" certificates require the private key to be generated within the card itself, making it impossible to export even by the issuer. – grawity Jan 20 '17 at 12:32
  • 2
    @ssdecontrol Whilst signing keys can't be used directly as encryption keys, you can use them to authenticate a key exchange (using Diffie-Hellman or similar), bootstrapping integrity into confidentiality. – James_pic Jan 21 '17 at 20:47
13

•Is there any reason (from a security standpoiny) that a government, bank, or credit card company should not be part of PKI?

Mixing business and worldwide government interests isn't something most security professionals are keen on and the damage that can be caused by a rogue CA (whoever the owner was/is) is very real, so that is the main security risk.

There are a few (like CNNIC) but the community isn't overly keen on them and some have been revoked from the popular certificate stores (which is as pretty good as killing them off) because of proven abuse.

That said the reason there's not many is probably mostly non technical, the barrier to entry is they would have to maintain its security and probably have to have regular audits to remain eligible to be on some lists (which I would imagine most wouldn't want to bother with unless they're charging an amount that makes it commercially viable) such as the Mozilla Firefox default list of trusted CAs and also be trusted not to sign other certificates that they are not entitled to. Certificate pinning helps (it's tricky to fake google.com with modern browsers now) but that's not to stop them from pretending to be my bank etc. if they get comprmised. Plus there's the added reputation risk if they get compromised which makes it less appealing.

See also Are there other roots of trust on my computer aside from these 46 root certificates? which references the Hong Kong Post Office root certificate.

This page listing the main stores and the principles and criteria to be included they must follow may also help.

  • 2
    I don't know that the OP is asking about governments taking a role similar to Verisign - i.e., taking a primary role in authenticating non-government websites. I think OP is asking about using it to allow individuals to authenticate to the government websites (or in person even) when performing governmental functions. – Joe Jan 19 '17 at 17:37
  • @Joe I'm asking about something in the middle. You're correct that I'm definitely not thinking about using these certificates for websites. But I am thinking about using them for non-governmental functions like payments authorization, as well as being available for light-duty file encryption. – shadowtalker Jan 19 '17 at 18:51
  • 2
    +1, this appears to be the only answer that attempts to answer the question as asked. The answer is: Yes. – James Reinstate Monica Polk Jan 21 '17 at 12:49
  • @JamesKPolk do you think it's better than the one I accepted? – shadowtalker Jan 21 '17 at 14:28
  • @ssdecontrol: That is entirely up to you. The answer you accepted and the all the others I've read attempt to show that there are already government CAs that do exactly what you suggest, but they avoid answering the question of whether there are potential negative security consequences of such a model. – James Reinstate Monica Polk Jan 21 '17 at 16:21
8

Many governments do have CA for their internal usages, that are used both for their employees and internal servers.. And correctly delivering a personal certificate is not much different from delivering an identity card or a passport.

Now suppose that every identity card delivered in one country includes a smartcard and standard certificates with the same validity of the id card itself. The added cost comparing to a simple identity card will be about tens euros or dollars. Compared to the cost of employees processing the delivery chain, it is not really expensive.

But if every citizen now have a strong certificate store (smartcard) with a delivery process guaranteed by the government, and certificates that he could use for any authentication, digital signature or even encryption question, do you think that it will have no impact on companies delivering payed certificates? IMHO it could be seen as unfair competition by all those companies. And that alone is largely enough for governments to not come towards that path...

That being said, some banks already have subsidiary companies specialized in delivering strong certificates on smartcards with face to face delivery. But as they do not use public resources for that, there is no unfair competition.

8

Estonia is the poster child in this regard.

For about 15 years our government has operated a PKI system, where every citizen and legal permanent resident is issued a smart card containing two certificates - one for authentication and one for signing documents. Now basically anybody can apply for a similar card tied to the PKI through the Estonian e-residency program.

The authentication certificate is used for secure online auhentication for numerous services

  • All kinds of e-government services, both personal and for managing one's company
  • Online banking
  • Accessing your health records
  • Accessing any private online service, which implements ID-card authentication

The signature certificate can be used to give legally binding signatures to any kind of digital document. This greatly simplifies doing business without moving loads and loads of paper around or meeting face-to-face just to sign something.

The same system can also be used to encrypt documents for transmission. All public certificates are accessible in a central LDAP repository, if You know the citizen ID of the recipient. Decryption of course is only possible with the smart card containing the corresponding private key.

In a similar fashiong the so-called "digital seals" are issued to legal entities to sign digital documents on behalf of a company (for example a digital proof of a bank transaction that I might download from an online bank portal is signed by the bank as a legal entity not a specific person working for the bank).

Operating this infrastructure has been contracted out to a private company actually owned by two of the biggest commercial banks and the biggest telco.

As a side-business this same company also has a public CA included in major browsers that they use to sell server certificates commercially.

1

In Spain you can request a certificate like this enter image description here

which is needed to perform some online administration actions. For example, to buy public debt in the Bank of Spain website or getting a birth certificate online. FNMT is the organization that emits them, but in fact its an organization with lots of years of history, printing money. The certificate can also be used to sign documents and many other things but you can't use it for software signing pourposes (only documents).

In order to get the certificate you can:

  • Use the DNI-e, the electronic ID card which everybody have, but you'll need a smart card reader, which very few people have. Or...
  • Go to a National Treasury offices (Agencia Tributaria) to verify identity.

Once you had the certificate you can renew it as many times as you want.

The FNMT root certificate is included in Windows and works with Internet Explorer and Google Chrome out of the box. There's a bug report for Mozilla in order to include it in their distribution, but there have been some problems and it's not yet included.

  • Note that it has been added to NSS bundle, and it is going to be included in Firefox 53 – Ángel Jan 21 '17 at 1:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.