Updated: Never — Philip's Blog

Christophe would like me to clarify why I feel you should distrust your Belgian eID card. Is "blogging" the new Usenet? This interaction feels a bit like "letters to the editor".

That aside, however.

I have no particular problem with the eID being a smartcard. The fact that most "variable" data about my identity is stored on a chip rather than printed on the card is probably even an improvement. No need to get a new card issued when moving, for instance. Unlike the old card, it's also a standard size and it fits in my wallet.

My problem is that the certificates can't be trusted.

It is unacceptable that the keys have been generated by someone other than me. This basically cripples the foundations of PKI from the get-go. But this is only the tip of the iceberg.

Of particular interest in Christophe's post is this:

Knowing that the government can create their own certificates (you do thrust [sic] them as a CA) they can easily generate new certificates that contain 'valid' data. There is no need to keep the private keys of the population to perform identity hijacking.

Why on earth would I trust the government's CA? Even if I happen to trust the CA, why would I trust the certificates signed by it?

Aside: I don't consider the fact that the government has innumerable ways of impersonating me to be a valid excuse for handing them yet another way.

The key point is "trust": a certificate does not automatically become "trusted" just because a CA has signed it.

Remember the role of a CA in the PKI model: the CA verifies that the entity controlling the private key of a certificate matches the owner of that certificate. Control over the private key is the critical point. In addition to verifying the ownership of the certificate, the CA should really also verify the owner's crypto-hygiene. Since that is not possible, a CA signature alone does not make a certificate trusted.

When you "trust" a CA, you trust it to verify the owner. Unless you also trust the private key to only be under the control of the owner, you still can't trust the certificate.

What then is the point of a CA? It saves you from the tedious and potentially time-consuming task of verifying the identity of the certificate owner. You should still verify that the owner can be trusted. If the owner prints his private key in the morning paper, can you trust his certificate?

You might trust the Belgian government to verify ownership of the certificate, but you know you can't trust it to verify control over the keys. This makes the certificates worthless.

The authentication key can't be trusted to authenticate against a system because you did not generate it and you don't know how many copies of the private key are in circulation. Anyone with control over the private key can authenticate as you on any system you configure to trust the public key.

The signature key is even worse because the law requires people to trust it. Think about that for a moment. Anyone with control over the private key you didn't generate can enter into legally binding contracts pretending to be you and legally, the people they are entering into these contracts with have to accept that they are you, even if they know that the certificate cannot be trusted because the private key is suspect.

The fact that nobody ever checks CRLs makes these "third-party generated keys" even more problematic. If the machines which generate the keys are compromised, someone can generate and sign a certificate purporting to be me of which I'm not even aware and use it to sign legally-binding contracts as me. And even people who know better than to trust a certificate only on the say-so of a CA signature are legally required to accept this signature as being made by me.

That is why it is not enough to simply get your key revoked -- you should keep proof that you have revoked your keys. It will still be a serious pain in the ass to prove that the signature was not made by you, but your empty smart card and the piece of paper at least allow you to retain some form of control over your identity.

PKI systems only work if the private key is secure. Certification authorities don't tell you that a certificate can be trusted, they only tell you that the certification authority believes that the certificate is owned by entity named on it.

I find it incredibly scary that the law equates the presence of a CA signature with a trustworthy certificate. Which brings me rather neatly to another rant-worthy subject "EV certificates" being "trusted" by webbrowsers.

When a website presents you with an "EV certificate", it will turn the address bar green and claim the certificate can really be trusted. This is total madness. The only difference between an "EV certificate" and a "normal" one is the price and the level of identify verification undertaken by the CA. I have yet to encounter the first CA which verifies the private key hygiene of applicants.

Users are sheep. They will see the green bar and say "ah, trusted"! The fact that they may be trusting someone who had an unencrypted copy of his private key on a USB stick he forgot on the train yesterday is a minor irrelevant detail. Nothing to worry about.

Generate your own keys. And don't trust certificates whose keys you don't trust. Actually, just trust nobody.