What attack vector is prevented by using the 'coupling code'?

Question

In The Netherlands, one can access government services using a login platform called DigID. Some services require a two factor authentication, for which one can use a mobile app.

This requires the following steps

1. Enter on the website the four-letter 'coupling code' displayed on the app (changes at each use)
2. Scan QR code displayed on the website using the app
3. Confirm login and enter five-digit pin code (known only to the user) on the app

The first step is a recent addition to this process, but I can't figure out what purpose it serves. What possible security threat is mitigated with this first step?

Answer 1

A lot of QR Two Factor Authentication codes contain data that an attacker could use to compromise you. There is a good write up about it here if you are interested. I have never used this app, and don't speak Dutch, but what I gather from the Digid website is this:

When you type the koppelcode (coupling code) into the website, it is used to encrypt the QR Code, before creating and rendering it to you. As the app knows the koppelcode, it can decrypt the QR Code, while someone who has the QR Code but not the koppelcode, can not use the QR Code.

This means that if an attacker can read the QR code sent by Digid (by means of computer compromise, Van Eck phreaking, shoulder surfing, etc.), they will still not be able to use it, as it is encrypted with the koppelcode.

Of particular note, the Dutch Government seems to be paranoid about Van Eck Phreaking; as it banned electronic voting in the 2006 National Elections due to fears of votes not remaining secret, you can read about this here.