Estonian Electronic Identity Card: Security Flaws in Key Management

栏目: IT技术 · 发布时间: 4年前

内容简介:Authors:Arnis Parsovs,

Authors: 

Arnis Parsovs, University of Tartu

Abstract: 

The Estonian electronic identity card (ID card) is considered to be one of the most successful deployments of smart card-based national ID card systems in the world. The public-key cryptography and private keys stored on the card enable Estonian ID card holders to access e-services, give legally binding digital signatures and even cast an i-vote in national elections.

In this paper, we describe several security flaws found in the ID card manufacturing process. The flaws have been discovered by analyzing public-key certificates that have been collected from the public ID card certificate repository. In particular, we find that in some cases, contrary to the security requirements, the ID card manufacturer has generated private keys outside the chip. In several cases, copies of the same private key have been imported in the ID cards of different cardholders, allowing them to impersonate each other. In addition, as a result of a separate flaw in the manufacturing process, corrupted RSA public key moduli have been included in the certificates, which in one case led to the full recovery of the corresponding private key. This paper describes the discovery process of these findings and the incident response taken by the authorities.

Open Access Media

USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone.Support USENIX and our commitment to Open Access.

BibTeX

@inproceedings {247686,

title = {Estonian Electronic Identity Card: Security Flaws in Key Management},

booktitle = {29th {USENIX} Security Symposium ({USENIX} Security 20)},

year = {2020},

address = {Boston, MA},

url = {https://www.usenix.org/conference/usenixsecurity20/presentation/parsovs},

publisher = {{USENIX} Association},

month = aug,

}

Download

Estonian Electronic Identity Card: Security Flaws in Key Management Parsovs Paper (Prepublication) PDF


以上就是本文的全部内容,希望本文的内容对大家的学习或者工作能带来一定的帮助,也希望大家多多支持 码农网

查看所有标签

猜你喜欢:

本站部分资源来源于网络,本站转载出于传递更多信息之目的,版权归原作者或者来源机构所有,如转载稿涉及版权问题,请联系我们

计算机操作系统

计算机操作系统

/ 西安电子科技大学出版 / 1984-11 / 19.60元

一起来看看 《计算机操作系统》 这本书的介绍吧!

随机密码生成器
随机密码生成器

多种字符组合密码

URL 编码/解码
URL 编码/解码

URL 编码/解码

MD5 加密
MD5 加密

MD5 加密工具