Flip side: why are all these countries/users panicking *now*? The vuln was disclosed to Infineon in *February*. This means 6 months of "responsible" disclosure have been utterly worthless. You'd think Infineon would've notified, you know, government clients? WTF? @CRoCS_MUNI
The whole point of using smartcards is that you generate the keys internally (and they never leave the card), then the govt signs the public key (presumably with some channel attestation involved so the card can prove it's a real card issued originally by govt).
-
-
hm, looks like it. Here's how it works (worked?) for Belgian IDs, which also has (had?) Infineon chip: https://homes.esat.kuleuven.be/~decockd/slides/2006.10.09.belgian.eid.card.technical.overview.presentation.pdf …pic.twitter.com/iqupy8Qgzx
-
@doegox do you know if current eID cards still use Infineon chips? - Show replies
New conversation -
-
-
Makes me wonder if there's some way to tell if a cert was generated on card, or imported from elsewhere.
-
There is; public keys can be trivially checked for the ROCA fingerprint in microseconds. If you mean in a more general case, usually what happens is cards are provisioned with a private key at manufacture time that signs things to prove they're card-generated.
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.