Hector Martin

My guess wold be that Infineon notified smartcard *chip makers* but they didn't bother informing their customers in turn. Maybe we can ask @e_estonia when and how they got warned.

You mean smartcard manufacturers, as in the physical bits of plastic and some gold pads? Infineon makes the ICs.

hm really? I thought it's guys like NXP, Gemalto etc.

NXP and Infineon make ICs (and software libs). Gemalto makes cards that use those ICs (and more software).

Interesting, thanks. However, I wonder why ID cards are affected at all. Aren't the private keys/certificates usually generated centrally on dedicated govt hardware and only the public keys are programmed into the cards? Do the cards still generate some keys on their own?

The whole point of using smartcards is that you generate the keys internally (and they never leave the card), then the govt signs the public key (presumably with some channel attestation involved so the card can prove it's a real card issued originally by govt).

@doegox do you know if current eID cards still use Infineon chips?