
Estonia blocks electronic ID cards over identity-theft risk - temp
https://sg.news.yahoo.com/estonia-blocks-electronic-id-cards-over-identity-theft-010319754.html
======
tauntz
The vulnerability in question: *The Return of Coppersmith’s Attack: Practical
Factorization of Widely Used RSA Moduli∗
[https://crocs.fi.muni.cz/_media/public/papers/nemec_roca_ccs...](https://crocs.fi.muni.cz/_media/public/papers/nemec_roca_ccs17_preprint.pdf)

Estonian ID card uses 2048 byte keys which means generating a private key from
a public key takes 140.8 CPU years which is quite fast/trivial/cheap using a
distributed approach (botnet, your already existing HW that you use for mining
etc).. considering the implications.

[https://www.schneier.com/blog/archives/2017/09/security_flaw...](https://www.schneier.com/blog/archives/2017/09/security_flaw_i.html)

~~~
ProblemFactory
> Estonian ID card uses 2048 byte keys which means generating a private key
> from a public key takes 140.8 CPU years

To clarify, 2048 bit RSA keys are fine. But the smartcard that generates these
used a too predictable algorithm for generating the keys.

------
emerongi
Official announcement: [https://www.valitsus.ee/en/news/estonia-will-block-
certifica...](https://www.valitsus.ee/en/news/estonia-will-block-
certificates-760-000-id-cards-evening-3-november)

It was claimed that software for cracking the private keys has entered the
black market, so they had to block the sertificates earlier than expected.

~~~
dullgiulio
Who claimed there is cracking software in the black market? I don't find it
hard to believe, of course.

The Estonian government is legally bound to applying such countermeasures as
soon as there is reasonable doubt about the security of the system. It's
pretty important that such things are encoded in law and are not up to whim.

~~~
s14ve
Full paper is out:
[https://crocs.fi.muni.cz/_media/public/papers/nemec_roca_ccs...](https://crocs.fi.muni.cz/_media/public/papers/nemec_roca_ccs17_preprint.pdf)

Anyone with good programming skill can make the exploit in matter of hours =>
it surely is somewhere on black market.

------
jackvalentine
> As of October 31, all users of faulty ID cards can update their security
> certificates remotely and at Estonian police and border guard service
> points.

I have been trying every day to do so but constantly getting “server is
overloaded” errors.

------
paulajohnson
Other governments take note: this is what good electronic security looks like.

~~~
walshemj
Other governments take note his is what putting all your eggs in one basket
looks like.

~~~
martinraag
More like 3 baskets. Estonians can also use a Mobile ID, where private keys,
authentication and signature functions are stored on a special SIM card. More
recently, an app based Smart ID was also introduced. If you're on one of those
services, the certificate revocation doesn't really affect you.

~~~
dekrg
There is only one basket that is made to look that there are three baskets. To
get a Mobile-ID need to have an ID-card with valid certificates. If the certs
are revoked you can't activate your Mobile-ID. Also you have to pay a monthly
fee for Mobil-ID service. Smart-ID requires that you have an ID-Card or
Mobile-ID and more importantly it's practically useless as you can't use it
for any government services.

~~~
dullgiulio
ID cards have been usable until yesterday and will be again soon. Mine was
upgraded and is still useful.

You don't need it all the time, only to sign up. Your argument doesn't quite
make sense.

~~~
dekrg
If you need another basket to have access to it (even if only initially) then
it's not really a separate basket on a national level.

~~~
vertex-four
So what's your actual threat model here? The Government decides to ban people
from accessing Government services? Err... Or that some person might not be
able to activate their Mobile ID for a short period of time while they sort
out their ID cards?

~~~
dekrg
The threat model is exactly people getting locked out of government services.
If this seems silly or not important to you then you aren't aware just how
widespread the usage of digital government services are in Estonia.

As one example most government procurements over a certain amount od money
happen as e-procurements with strict time limits that can't be changed and
bids need to be digitally signed. If you can't access digital government
services you can neither access e-procurment site nor digitally sign you bid.

~~~
vertex-four
Right, but point is, you can quite easily have Mobile-ID and your ID card, and
if something happens to your ID card you can still use Mobile-ID. I think.

If there's no redundancy measure for the ID card system failing - for example,
automatically extending deadlines - that's a problem, and an easily solvable
one at that, since it's mostly policy. It's not something against the ID card
system.

~~~
dullgiulio
And again, what the parent says in untrue. You can sign documents with your
phone and still take part of the expiring public tender he describes.

~~~
dekrg
Yes, but you need to already have Mobile-ID for that. To get a Mobile-ID you
need ID-Card with valid certs.

So if a person doesn't already have Mobile-ID and their ID-Card certs are
blocked they can't get a Mobile-ID and thus they can't access any digital
government services.

It's not like this is purely theoretical - large number of Estonian Id-Card
will have their certs blocked and not everyone has Mobile-ID.

------
DocG
>ID Card is compulsory

>760,000 ID cards will be blocked

>in country of 1.3 million

>I have no idea how I can declare monthly VAT numbers

It is bad but could be worse. People are signing up for MobileID and there is
still possible to update ID cards via going to the office.

But poor people abroad. Basically they will be cut off from all the services.

~~~
dvfjsdhgfv
Other nations can watch and learn on Estonia's mistakes. The big question is:
can such a scenario (a faulty chip) be completely eliminated?

~~~
DocG
As I understand, not really. Only prepare.

Although people are unhappy and annoyed, I think it is right decision to close
the ID cards. This can be recovered from. If they were compromised, the trust
would be gone.

------
baccredited
estonia id card question: can ANYONE create a website that uses the card to
authenticate? Or is it a estonia whitelist of services only?

~~~
daeroth
You can request your service to be whitelisted:
[https://www.sk.ee/en/services/validity-confirmation-
services...](https://www.sk.ee/en/services/validity-confirmation-
services/?service/validity_confirmation)

Pricing is here: [https://www.sk.ee/en/services/pricelist/certificate-
validati...](https://www.sk.ee/en/services/pricelist/certificate-validation-
services)

So it's not quite as simple as Google or Facebook oAuth. But the government
does support the idea that if you want then add this as a login option to your
forum for dogs or an e-store for sweaters.

The main value is still in the fact that the authentication gives you the
ability to create legally binding contracts that get signed online.

~~~
j_s
This is paying for revoke checking, right?

Validating the certificate the same way servers validate client certificates
should be enough to verify it as a date/time-valid Estonian ID.

~~~
AndresAlla
Yes, this is to use OCSP. You do not have to pay if you download revocation
lists manually. Ofcourse lists become stale rather quickly.

Very basic - hello world level - implementation is as simple as enabling
client certificate authentication in Apache config.

------
smcl
Been trying with little luck to arrange my appointment to pick up my card from
the local embassy - I guess this is why

------
askz
And then, we'll discover that ecdsa is also vulnerable on these chips?

------
pjc50
This is fallout from the Infineon private key weakness, isn't it?

~~~
kristjankalm
[http://news.err.ee/640385/government-to-close-id-card-
certif...](http://news.err.ee/640385/government-to-close-id-card-certificates-
with-security-risk-at-midnight)

"Information System Authority (RIA) Director General Taimar Peterkop likewise
confirmed that the threat assessment had changed after the research published
by the Czech researchers on Monday revealed that the security flaw affecting
Estonian ID cards is easier to exploit than previously believed."

is what you are reffering to "the research published by the Czech
researchers"?

~~~
pjc50
[https://arstechnica.co.uk/information-
technology/2017/10/cry...](https://arstechnica.co.uk/information-
technology/2017/10/crypto-failure-cripples-millions-of-high-security-
keys-750k-estonian-ids/)

