Subject: Re: [saag] Interest COVID-19 'passport' standardization?

From: Eliot Lear <[email-masked]>
Date: Sun, 1 Aug 2021 10:29:27 +0200

Hi

On 31.07.21 18:28, Carsten Bormann wrote:
>> WRT feature creep: we shouldn't help.
> Maybe unless the features actually are about areas where the tech also needs features, e.g., for privacy.

I agree, and furthermore, Stephen, what you are describing as feature 
creep is really new uses and no new features.  This having been said, I 
do wonder if places like Kantara would be better for such work, as they 
may harbor more expertise.

I also wonder if a second look at online approaches should be 
considered.  Don't laugh too loudly, but this might be an interesting 
application of ohttp ;-)

Eliot

---

From: Michael Richardson <[email-masked]>
Date: Sun, 01 Aug 2021 08:47:51 -0400

Dirk-Willem van Gulik <[email-masked]> wrote:
    > So I think we have some useful lessons learned w.r.t. the importance of
    > off-line / totally local validation.

A quickly organized (rather open, live, virtual) IAB workshop (maybe combined with
W3C people) on lessons learned would be the best result in the short-term
(3 months) to me.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: Michael Richardson <[email-masked]>
Date: Sun, 01 Aug 2021 08:57:58 -0400

>> needs features, e.g., for privacy.

There are many countries which have no tech as yet (like mine), and who will
adopt whatever is "cheap", so if we have analysis/critique which might be
shared, then we should do that.

    > I agree, and furthermore, Stephen, what you are describing as feature creep
    > is really new uses and no new features.  This having been said, I do wonder
    > if places like Kantara would be better for such work, as they may harbor more
    > expertise.

What is Kantara?  I guess you mean: https://kantarainitiative.org/ ?

    > I also wonder if a second look at online approaches should be considered. 
    > Don't laugh too loudly, but this might be an interesting application of ohttp
    > ;-)

In my best George Takai accent: "oh my."
You might be right.

---

From: Stephen Farrell <[email-masked]>
Date: Sun, 1 Aug 2021 14:14:21 +0100

Hiya,

On 01/08/2021 09:29, Eliot Lear wrote:
> Stephen, what you are describing as feature creep is really new uses and 
> no new features.

That's true - I should've said "scope creep" or similar.

In this case the scope creep is IMO astoundingly unwise -
taking a system (reasonably) designed for a very constrained
and fairly high security environment (passport control) and
redeploying it at the doors of bars when the least likely to
be vaccinated have a rich history of fake IDs and all for
just a few weeks...

That's the kind of stupidity with which we ought not want to
be associated.

S.

---

From: denis bider <[email-masked]>
Date: Mon, 2 Aug 2021 05:51:38 -0500

Covid-19 vaccine passports are the stupidest, most oppressive shit
that needs to be resisted at all levels.

Given information we have now, I cannot respect anyone who still
accepts any of the Covid-19 vaccines.

The vaccines do NOT stop transmission. They do NOT reduce deaths. They
just redistribute deaths from average age 80+ with comorbidities, to
younger people by giving myocardial infarctions to children and young
adults.

There is no medical justification to force these vaccines on anyone.
Individually, there is no benefit given the information we already
know, for nearly anyone, in nearly any risk group.

For a healthy individual to accept these vaccines is stupid. For
governments and businesses to force them on people is monstrous and a
crime against humanity.

Long-term, we do not know anyone who survived 2 years or more after
taking these vaccines. Please try to refute that statement.

Anyone who conducts work that enables the forcing of these vaccines,
and the arrival of mandatory vaccine passports, is a Dr. Mengele and
should expect a trial before a tribunal with penalties up to and
including death.

I am serious. Do not do these fucking things.

On Fri, Jul 30, 2021 at 1:17 PM Harry Halpin <[email-masked]> wrote:
>
> Everyone [and apologies if you already got this message on CFRG or SECDISPATCH],
>
> While the research community and industry was very quick to work on privacy-enhanced contact tracing, I've seen very few people taking the much more pressing issue of COVID-19 passports.
>
> If this IETF111 was in person, we could have done an informal BoF, but as its' not, I'm sending out an email to gauge interest.
>
> I've earlier seen some very badly done academic work using W3C "Verified Credentials" and W3C Decentralized Identifier (DID) standards [1]. However, while a bunch of sketchy blockchain technology has not been adopted (so far, although I believe IATA and WHO are still being heavily lobbied in this direction), there has been the release of the EU "Green" Digital Credentials that actually uses digital signatures.
>
> However, there's a number of problems:
>
> * No revocation in case of compromise
> * Privacy issues, i.e. leaking metadata
> * Limited key management (booster shots might require)
> * No use of standards for cross-app interoperability
>
> Furthermore, there appears to be differences between countries, and some countries do not use cryptography at all (the US). Therefore, as an American in France who flew home ASAP to get vaccinated in the US, as a consequence of this lack of interoperability I can't travel on trains or eat at restaurants easily, despite being vaccinated. I imagine this will become a larger problem.
>
> I have a report I'm willing to share, but I'd first like to know if there's any interest in standardization on this front at the IETF despite this topic being, I suspect, a bit of  astretch of our remit. However, we live in interesting times.
>
> I don't think the W3C (or the ITU, etc.) has the security expertise, and while the crypto and security/privacy here is pretty simple, I think it should happen somewhere.
>
> While I originally polled it by CFRG IRTF to see if there was any interest whatsoever, Benjamin Kaduk pointed out SAAG and SECDISPATCH would be better places to start. I'd like to know what others think.
>
>           yours,
>              harry
>
> [1] https://arxiv.org/abs/2012.00136
> _______________________________________________
> saag mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/saag

---

From: Henry Story <[email-masked]>
Date: Mon, 2 Aug 2021 13:41:07 +0200

> On 2. Aug 2021, at 12:51, denis bider <[email-masked]> wrote:
> 

Heh. Nice to have a strong position like that. :-)

Of course all tools are double edged, right since Prometheus stole the
fire from the Gods to give it to us mortals, for which it is well known
Zeus punished him to eternally be tied to a rock, and every day have
an eagle eat out his liver. 

  https://en.wikipedia.org/wiki/Prometheus

Cars kill people, medicaments too, and so does sugar and food when
eaten in unhealthy quantities, a problem in many countries ever
since industrialization made foods cheap and available. 

Societies counter such problems by creating cultural antibodies through
education: one has to learn to eat less in a society such as ours, one
has to learn to drive carefully to not kill people (and for that we have
developed tests such as drivers licenses), and it is not advisable to
get drugs prescribed by some dude on the corner of the street: we have 
certified doctors and apothecary’s for that.

I agree also that one should not force people to be vaccinated. Some people
react very badly to them: I heard a story this week in our town here.

But Verifiable Credentials could also be used to hold a ”proof of not
having the virus at time T” if needed, or even a proof of having had it, 
which should be as good as having had a vaccine. 

In the end we are all going to get it: vaccines rollouts are indeed aiming 
at doing just that. So that is why I would not be that worried about privacy 
with such Credentials. Furthermore, not everything in a credential needs to be private:
certainly not the id of the signing authority as they are making the claim,
and need to be known as capable of making them. 

Note that privacy *is* really important criterion for any tracing app, which 
have already been rolled out, btw independently of certificates.

So just as with the virus, it’s all very complicated. 
A year ago, I spent way too long studying this. Some of my thoughts
then were collected in ”Co-immunology and the web”

https://blog.usejournal.com/co-immunology-and-the-web-43379b46688e

Hope that helps,

Henry

---

From: Dirk-Willem van Gulik <[email-masked]>
Date: Mon, 2 Aug 2021 14:36:29 +0200

> which should be as good as having had a vaccine. 

 Note that the initial vaccination cases are relatively easy - the technical complexity is quite high when it comes to things such as ‘recovery certificates’ (it is considered the equivalent if you are sure in had covid - and are thus are the ‘equivalent’ of having been vaccinated; and the various test statements (all of which are considered equivalent (with a lot of complexity interoperable internet engineering behind it https://github.com/ehn-dcc-development/dgc-business-rules).

> with such Credentials. 

While I would Agee in theory - I think we have quite a while to go to create VC’s that are sufficiently resistant against surveillance; including surveillance by the issuing entity.

For the Netherlands domestic solution (where the certificate does not contain the persons full name or DoB) - we could not easily find anything ‘off the shelf’ that would allow offline verification and was resistant against surveillance / recognising a repeat customer (or having too little entropy - e.g. due to the time of the test being too granular in seconds due to the size of our (small) country / small commercial test providers)

In particular not leaking the vaccination status – test and vaccination must be indistinguishable — was hard.

Attached is a short presentation by one of my colleagues with the highlights and links to the actual code/design.

Dw.

---

From: Henry Story <[email-masked]>
Date: Mon, 2 Aug 2021 14:55:39 +0200

> On 2. Aug 2021, at 14:36, Dirk-Willem van Gulik <[email-masked]> wrote:
> 
>> 

Ah yes, one would like to be able to use the credential without the issuer knowing
that one has presented it. 

The Self Sovereign Identity book [1] - which really helps give a good overview of 
the area - has quite a lot to say on how the architecture they 
have built up to stop the issuer needing to know about the use of the credential.
There is talk of zero knowledge proof, etc…

Note there are also other scenarios, e.g. self issues certificates for creating
decentralised social networks using a Tor WebID [2], where having a dereferenceable 
ID would not be a privacy problem, since then you would be hosting your own key.

Henry

[1] https://www.manning.com/books/self-sovereign-identity
[2] https://www.w3.org/2005/Incubator/webid/spec/identity/

---

From: Dirk-Willem van Gulik <[email-masked]>
Date: Mon, 2 Aug 2021 15:21:12 +0200

> There is talk of zero knowledge proof, etc…

Which is what the Netherlands has opted to doo - based on the excellent work by Idemix and the IRMA implementation*.

Dw.

*: which we could not use ‘as is’ - as it needed to be fully offline too.

---

From: Carsten Bormann <[email-masked]>
Date: Mon, 2 Aug 2021 15:26:03 +0200

> at doing just that. So that is why I would not be that worried about privacy 

I’m not sure that I understand what you are saying.

Clearly, the DGC is a privacy disaster: To enable checking that it actually pertains to me, I need to present some government ID, which reveals my wallet name (and often much more information).

Since we don’t have any other way to link the DGC to a physical person except via (the tenuous link of) a government ID, there was no other way to get the DGC out quickly.

But I sure hope there will be a 2.0 process at some point that doesn’t automatically reveal all the information on my government ID.

This is not a theoretical concern, as I may need to use my DGC to get access to a place where I’d definitely want to use directed identity.

Grüße, Carsten

---

From: Henry Story <[email-masked]>
Date: Mon, 2 Aug 2021 15:48:43 +0200

> On 2. Aug 2021, at 15:26, Carsten Bormann <[email-masked]> wrote:
> 

yes, as I mentioned in my previous answer to Dirk in the last hour, I meant
that long term, data about who had the virus is not going to be that valuable, 
as most people will end up contracting it, and at some point the interest in
it will also we hope fade.

But I agree that one does not want the issuer to be able to track where you
present it. 

At the same time the person looking at it (say in a restaurant
or gym) wants to know that you did not borrow your friends phone. 
So that is makes for quite a tricky set of requirements.

Note, there are even crazier things going on. In Germany - or at least Bavaria -
there has been a requirement to wear an FFP2 mask in public spaces (though not on
the street). Professionals in the film industry (such as those who worked on making 
the film on Snowden) used to be limited to wearing those to at most 90minutes or so, 
for health reasons: I guess breathing in your own air is not such a good idea.
Now children have been having to wear these all day in school, as well as people in
the service industry. So you’d think that there would be an explosion of 
research in how to build better healthier masks. 

That reminds me of Dali’s 1936 exhibition stunt ”Authentic Paranoid Fantasies” 
where Dali went to his exhibition dressed in a deep sea diving suite. He later wrote:

> I had determined to give a talk during the exhibition in a diving suite as a representation of the subconscious. I was placed in the armor and even fitted with heavy lead shoes, making it completely impossible for me to move my legs. I had to be carried onto the stage. Then they placed the helmet on my head and screwed it tightly shut. I started my talk behind the thick glass in front of a microphone that clearly could not record anything. Nevertheless my mimicry fascinated the public. Soon though I ran out of air, my face turned red, then blue, and my eyes turned upwards. Clearly they had forgotten to provide me with access to air, and I was close to asphyxiation. I signaled to my friends through desperate gestures that my situation was becoming critical. One of them ran for some scissors and tried without success to puncture the costume; another one tried to unscrew the helmet, and as that did not succeed he started banging on the screws with a hammer… Two men tried to tear off the helmet and a third one continued whacking the metal so hard that I nearly lost consciousness. 
> On the stage one could only see a mass of wildly moving hands, from which I emerged now and again like a dismembered puppet, and my helmet sounded like a gong. The public applauded heavily to this successful Daliesque melodrama, which in their eyes clearly represented how consciousness was trying to communicate with the unconscious. I though nearly died during this triumph. As they finally ripped off my helmet I was as white as Jesus as he returned after his forty days of fasting from the desert.

There is a picture to go with that that story which I put up on the blog on co-immunology which I wrote up last year
https://blog.usejournal.com/co-immunology-and-the-web-43379b46688e

---

From: Dirk-Willem van Gulik <[email-masked]>
Date: Mon, 2 Aug 2021 15:47:33 +0200

> Clearly, the DGC is a privacy disaster: To enable checking that it actually pertains to me, I need to present some government ID, which reveals my wallet name (and often much more information).

You may need to present (there are very sharp limits at what checks can be done within the area that the Regulation applies - routine/systematic checks is not in the cards). Secondly - the Regulation goes beyond the GDPR - storing/transferring the information is not permitted (even though one could image a proportional need/gool allowing such).

So the check is literally one for the eyeballs (only) of the person doing it.

With kid regards,

Dw.

---

From: Thomas Hardjono <[email-masked]>
Date: Mon, 2 Aug 2021 14:24:48 +0000

Back to Harry's original question, I think there are already several standard formats and protocols that can be used for a "Covid-19 Passport" .

If the "basic" passport is simply  a signed assertion by a legal authority in a jurisdiction (e.g. government, health dept.) that a person has received a vaccine shot(s), then there are lots of options to build from:

-- X.509 certs and attribute certs (RFC5280 and related RFCs).

-- SAML2.0 core spec (which has a basic XML signed assertions data structure). 

-- JWTs and signed JSON tokens (RFC7519 and related RFCs).

-- ID_tokens from the OpenID core spec 1.3.

-- "Simplified" DID, where the issuer/signer is the gov and the URL points to a Method owned/operated by the Gov.

-- GNAP (which is still under development).

Not to throw a wrench into the mix, but will the IETF require me to show a "Covid-19 Passport" to attend the next F2F meeting?

Best

-- thomas --

---

From: Carsten Bormann <[email-masked]>
Date: Mon, 2 Aug 2021 16:43:50 +0200

> -- JWTs and signed JSON tokens (RFC7519 and related RFCs).

There were also non-functional requirements on DGC (should fit into a QR-Code), so the actual choice was CWTs with CBOR (no JSON(*)).

Grüße, Carsten

(*) Although it was made to look like JSON to the casual observer :-)

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 2 Aug 2021 07:50:21 -0700

On Mon, Aug 2, 2021 at 7:44 AM Carsten Bormann <[email-masked]> wrote:

> There were also non-functional requirements on DGC (should fit into a
> QR-Code), so the actual choice was CWTs with CBOR (no JSON(*)).
>

As I understand it, the payload is JSON but the wrapper is a CWT.

it's actually quite possible to fit JSON (JWT) in  a QR code however. This
is what the VCI certs look like.

-Ekr

---

From: Carsten Bormann <[email-masked]>
Date: Mon, 2 Aug 2021 16:54:57 +0200

> As I understand it, the payload is JSON but the wrapper is a CWT.

The payload is described as being created by converting JSON to CBOR, so that’s the appearance of JSON I talked about.

> it's actually quite possible to fit JSON (JWT) in  a QR code however. This is what the VCI certs look like.

Of course, as with BER or XML.
But if you want to have some things in there, it may get tight.
(Tight enough that DGC also does a step of zlib/deflate, which is actually expanding most DGCs :-)

Grüße, Carsten

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 2 Aug 2021 08:00:26 -0700

On Mon, Aug 2, 2021 at 7:55 AM Carsten Bormann <[email-masked]> wrote:

> The payload is described as being created by converting JSON to CBOR, so
> that’s the appearance of JSON I talked about.
>

I haven't studied the DGCs closely, but the VCI certificates are JWTs with
the inner payload being straight deflated JSON without any intermediate
encoding.

-Ekr

---

From: Tim Bray <[email-masked]>
Date: Mon, 2 Aug 2021 08:09:46 -0700

I found this description of how the Quebec vacc passport works to be
interesting:
https://mikkel.ca/blog/digging-into-quebecs-proof-of-vaccination/

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 2 Aug 2021 08:11:48 -0700

Yeah, this is the same as the VCI ones.

On Mon, Aug 2, 2021 at 8:09 AM Tim Bray <[email-masked]> wrote:

>> I haven't studied the DGCs closely, but the VCI certificates are JWTs
>> with the inner payload being straight deflated JSON without any
>> intermediate encoding.
>>
>> -Ekr

---

From: Tim Bray <[email-masked]>
Date: Mon, 2 Aug 2021 08:33:25 -0700

… and I should have said, I thought the Quebec approach looked pretty
sensible..

I acknowledge that there are some who think that vaccinations are terrible
(they're just wrong) and others who disapprove of vacc passports. But if
there going to be such things, this looks like an ok way to implement them.

On Mon., Aug. 2, 2021, 8:12 a.m. Eric Rescorla, <[email-masked]> wrote:

>>>> The payload is described as being created by converting JSON to CBOR,
>>>> so that’s the appearance of JSON I talked about.
>>>>

---

From: Jon Callas <[email-masked]>
Date: Mon, 2 Aug 2021 11:28:49 -0700

The Quebec system is coded just like the California one. It's a SMART Health Card coded into a URI and then into a QR code, as others have mentioned.

We at EFF have an article on it decoding it and commenting on it. The work Mikkel Paulson did on the Quebec one made our work easier.

<https://www.eff.org/deeplinks/2021/06/decoding-californias-new-digital-vaccine-records-and-potential-dangers>

Despite one's opinion on how good or bad such things are, there is zero need for the IETF to do a new standard.

	Jon

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 2 Aug 2021 20:25:18 +0100

On 02/08/2021 19:28, Jon Callas wrote:
> Despite one's opinion on how good or bad such things are, there is
> zero need for the IETF to do a new standard.
+1

S.

---

From: Tim Bray <[email-masked]>
Date: Mon, 2 Aug 2021 13:11:12 -0700

> need for the IETF to do a new standard.

Yep.