2

Background:

Germany has decided to implement the proof of vacination for Corona based on 5 Blockchains. It's supposed to be anonymus and safe and the verification could hapen with a QR-Code.

My Idea:

Use X509 (SSL) certificates to verify that someone is vacinated, by including additional information and making the Countries CA's.

The Explanation:

We reuse the existing and proven code for issuing and checking SSL certificates like OpenSSL and expand the issued certificate with a field for with information with which it's possible to uniquely identify a person, like birthplace and date, while the CN field can be the name itself.

Every Country which is part of the system becomes a CA, or if you have a group of states like the EU they become the CA. Then create the chain of trust for example : EU -> Germany -> Bavaria -> Vacination Center -> Anton (Person). The certificate Anton gets issued can't sign other. Anyone who knows the root certificate can then verify that Anton has recieved his jab. The personal information is safe, only Anton has the certificate. No one, except for the other party, even knows that Anton showed his proof.

The only problem would be how to safe and show the certificat. QR-Codes wouldn't work, the cert. is to big, however one could use NFC. The people with a device where you can easily access the NFC Antena, like Android, could use their phone. Everyone else could use a boring old NFC Tag with sufficient Storage, 8KB should be enough, which I could find for 1,10€. (That's kind of expensive and maybe a deal breaker.) It would be easy to use (just tap your card on the reader), safe (only allowed people can issue cards and the underlying infrastructure is tested) and protects personal data (only you carry your information).

If the EU wants to honour the cert issued in the USA, they could add them as a root CA. If it turns out a someone has issued wrong certificates for whatever reason: revoke the cert which is highest in the chain, which was compromised.

Could this scheme work or did I overlook something, (other than countries not agreeing on one method, because what they are doing is best)?

Improve this question
4
  • "Then create the chain of trust for example : EU -> Germany -> Bavaria -> Vacination Center -> Anton (Person)." If that chain of trust does not exist yet, why do you think it would be easy/fast to set it up now? Also do you imagine the number of CAs that this model creates? And hence the number of potential problems? The Web PKI has only a few hundreds of CA and it is already far too much based on past "events".
    – Patrick Mevzek
    Mar 31, 2021 at 18:01
  • Good point. If every country joined we would have 195 CA's give or take. Yes, that many CA's could lead to Problems, but I also see that 195 different Solutions are a much bigger problem and if you find out, someone messed up you can revoke or distrust them. Both creating and signing a cert are, from what I understand, for OpenSSL just two commands. At least in Germany the vacin distribution is centralized. You could ship a USB-Stick inside one of the containers with the software and cert installed. Of course they shouldn't be used for anything beside signing the information.
    – Steven
    Mar 31, 2021 at 18:44
  • You may want to just take a step back and see that, on purely technical grounds, what you describe is easy to do, but unfortunately (or not) in the world of security and specially when touching things related to governments there are a lot of non technical points that come into play. And you describe far more than 195 CAs if you include the middle steps that need to be secured as well, so you immediately have a system with more than 10000 CAs certificates, all to be closely monitored, audited, potentially revoked, etc. Who would control and oversee that? EU?
    – Patrick Mevzek
    Mar 31, 2021 at 19:27
  • So it could work in theory, but fails on the real life implication of having to trust this many people and governments being involved. Sadly, in the end every solution has to fight with this problem. Thank you for your time.
    – Steven
    Mar 31, 2021 at 20:00

1 Answer 1

Reset to default
1

Anton does not need a certificate. The vaccination center needs one. It then generates a record like:

Anton Klaus:19990318:BAVARIA134:202104011200:COV19
20fdf778e435d6402811155500348a26ccb0dafa

The first line contains the needed data: name, birth date, vaccination center, vaccination date and vaccine type. Next one is the signature. One can get the BAVARIA134 certificate online, and check if the signature checks.

This record is small enough to fit on a QR-Code, and it's trivial to use a web page to read the code, grab the vaccination center certificate, and check the signature.

Improve this answer
3
  • Yes, that'd be even better, I didn't think of that. I'm going to accept yours unless an even better answer comes along tomorow.
    – Steven
    Mar 31, 2021 at 18:50
  • This is roughly the idea between the French attestations. But the the certificates are not issued for each vaccination center.
    – ysdx
    Jun 29, 2021 at 12:23
  • Actually, the signing authorities don't use certificates but only public keys.
    – ysdx
    Jun 29, 2021 at 12:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .