Covpass - Vaccination status App?

poetaster · 3 June 2021 21:25

The certificates signatures and exchange themselves you seem to be right about:

eu-digital-green-certificates/dgc-overview/blob/main/guides/certificate-governance.md

# Digital Green Certificate – Public Key Certificate Governance

## 1.1 Context

The secure and trusted exchange of signature keys for digital green certificates (DGCs) between European Countries is realized by the Digital Green Certificate Gateway (DGCG) which acts as a central repository for the public keys. With the DGCG, member states are empowered to publish the public keys that they use to sign digital green certificates. Relying member states can use the DGCG to fetch up-to-date public key material on a timely basis. Later, the DGCG can be extended to exchange trustworthy supplementary information that the member states provide, like validation rules for digital green certificates.
The trust model of the European DGC framework is a Public Key Infrastructures (PKI). Each member state maintains one or more Country Signing Certificate Authority (CSCA), certificates of which are relatively long lived. The CSCA issues public key certificates for the national, short lived, Document Signers (i.e. signers for digital green certificates), which are called Document Signer Certificates (DSCs). The CSCA acts as a trust anchor such that relying member states can use the CSCA certificate to validate the authenticity and integrity of the regularly changing DSC certificates. Once validated, the memberstates can provide these certificates (or just the public keys contained therein) to their DGC validation applications. <br>

Besides CSCAs and DSCs, the DGCG *also* relies on PKI to authenticate transactions, sign data, as the basis for authentication and as a means to ensure integrity of the communication channels between the memberstates and the DGCG.<br>

The following picture presents a high-level overview of the system.

![Trust Model](./images/Overview.PNG)

##	1.2 Scope of Document
Digital signatures can be used to achieve data integrity and authenticity. Public Key Infrastructures establish trust by binding public keys to verified identities (or issuers). This is necessary to allow other participants to verify the data origin and the identity of the communication partner and decide about trust. In the DGCG, multiple public key certificates are used for authenticity. This document defines which public key certificates are used and how they should be designed in order to allow broad interoperability between the different member states. This document is based on [1] and [2]. It provides more details on the necessary public key certificates and it gives guidance on certificate templates and validity periods for countries that want to operate their own CSCA. 
Since DGCs shall be verifiable for a defined timeframe (starting from the issuing, expire after a given time), it is necessary to define a verification model for all signatures applied on the public key certificates and the digital green certificate. 
Legal and administrative procedures are not in the scope of this document, they must be defined separately.  

## 1.3	Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 ([RFC2119](https://tools.ietf.org/html/rfc2119), [RFC8174](https://tools.ietf.org/html/rfc8174)) when, and only when, they appear in all capitals, as shown here.

This file has been truncated. show original

But getting the cert in the first place requires another flow, it seems. Still unclear.

s_mario · 3 June 2021 21:38

I got a first response from the RKI.
The original Version in German:

Sehr geehrte Frau , / Sehr geehrter Herr ,

vielen Dank für Ihre Anfrage zum Digitalen Impfnachweis.

Die CovPass-App wird unterstützt ab iOS-Version 12.0 und Android-Version 6.0. Um die CovPass-App vollumfänglich nutzen können, benötigt Ihr Smartphone eine Kamera.

Die Entwicklung der Apps orientiert sich an der in der Bevölkerung mehrheitlich genutzten Systeme. Eine Weiterentwicklung für ältere Versionen wird anschließend geplant.

Wir hoffen, Ihnen mit diesen Informationen weitergeholfen zu haben.

Bleiben Sie gesund!

Wir empfehlen, sich an die allgemein geltenden Abstands- und Hygieneregeln (AHA+A+L-Regeln) zu halten, um das Ansteckungsrisiko generell zu minimieren: Coronavirus - infektionsschutz.de.

Freundliche Grüße aus dem Robert Koch-Institut,
Im Auftrag
xxxxxxx yyyyyyyyy

And the same translated by Google:

Dear Madam, dear Sir ,

Thank you for your inquiry about the digital vaccination certificate.

The CovPass app is supported from iOS version 12.0 and Android version 6.0. In order to be able to use the CovPass app fully, your smartphone needs a camera.

The development of the apps is based on the systems used by the majority of the population. Further development for older versions is planned afterwards.

We hope that this information was helpful to you.

Stay healthy!

We recommend adhering to the generally applicable distance and hygiene rules (AHA + A + L rules) in order to generally minimize the risk of infection: Coronavirus - infektionsschutz.de.

Kind regards from the Robert Koch Institute,
On behalf
xxxxxxx yyyyyyyyy

4carlos · 4 June 2021 04:18

A vaccination without a sticker in an official vaccination center? Incredible in Germany. You have to bring your vaccination pass with you, that is a condition. If you don’t have one, you’ll get a new one. You also have to bring a lot of explanations, a lot of paper …

My experience in Lower Saxony: If the first vaccination was made in the vaccination center, no family doctor will vaccinate you the second time. You will then automatically have the second appointment 12 weeks later in the same vaccination center. It follows a rule. Both vaccinations in the same place.

By the way, the digital covpass is completely overrated. Why does everything always have to be in the smartphone? What is so unreasonable about a paper certificate. Not cool enough? I don’t care, only if something like this has to be digital, then it should be done right. In any case, my paper vaccination pass cannot be hacked LOL

poetaster · 4 June 2021 06:06

The Doctor at the vaccination center had said the sticker would only be put in the certificate booklet when the second dose had been administered. I was a bit shocked. Then, bad luck, the Astra vaccine was suspended just as the second dose (at 9 weeks, not 12) was due. It may be the chaos was more so in Berlin?

And yeah, I don’t want to have anything to do with the further centralization of personal Data in the EU. So no covpass for me, thanks. The borders are open down to Istria as far as I can tell?

4carlos · 4 June 2021 09:40

It’s Berlin, poor but sexy

But back to the topic …

s_mario · 4 June 2021 10:26

I thought so too, but they had no new vaccination certificates in stock in the center … (maybe because they are all traded on the black market ). Now the sticker has just landed in my old GDR vaccination card.
In addition, you get the form “reserve documentation on vaccination”

Kea · 4 June 2021 11:22

Our health service released this yellow pass after parliament asked for it. In a few days 50.000 booklets are ordered by citizens. They cost E7,50 each. People are aware of the fact that corona apps weren’t that effective in European countries and they want to have a say over their own data, so this booklet isn’t such a bad idea. Germany has acknowledged it too.

DaveRo · 4 June 2021 15:29

In case it’s of interest…

Here in the UK (no longer in the EU) the National Health Service (NHS) has created an app (the ‘NHS App’) which will display a 2D barcode showing you have been vaccinated. (It requires Android >4 so it won’t run on my Jolla C.) You can also download a pdf with the vaccination details and the barcode, either from the app or a browser. The intended use is travel.

The app screen and the pdf print makes clear that the identity of the bearer should be checked - using a passport or whatever.

The pdf print has an expiry date: it seems to be 21st June for everybody, or was when this was discussed on a forum a couple of weeks ago. If you have the app it will presumably display the latest barcode, but if you print the barcode then you have to remember to reprint it if it’s expired.

The barcode starts ‘HC1:’ and appears to be as specified here:

I’ve decoded mine and it contains (in json-ish format) my name (twice), date of birth, and details of my two vaccine doses (type, date, batch number.) It doesn’t appear to contain any unique identifier to me; we have an NHS Number but I don’t think it’s there - though it could be encrypted, encoded, or obfuscated.

Since I investigated my barcode the EU has launched its green certificate. I’ve read that /does/ include a unique person identifier. (And one of the specs I read mentioned the NHS Number as used in the UK.)

It’s possible - indeed I expect - that the format or content NHS barcode will be updated to match the EU one - if it doesn’t already. I think that’s why it expires in a few weeks.

WT.Sane · 4 June 2021 18:53

In the Germany I live in… …
things differ. I had an old WHO vaccination document which was stamped and got the sticker at the first shot.
My wife had no vaccination document at all and instantly got a new one. No problems, no discussions.
We visited our local doctor.

apozaf · 5 June 2021 18:58

I hope the hackaz will do a good job to get a positive feedback from the survailance dictators when they scan a QR.
100% sure that all data will leak from everyone. That’s always the case when official authorities code someething.

Vaccination is a great thing, but vaccinating against corona viruses is almost as ridiculous as against influenca viruses. There is less genshifting and gendrifting in comparison, still far too much.

Sorry for OT, but this really triggers myself and is war against everything I’ve learned and practiced for centuries.

4carlos · 6 June 2021 05:00

Sorry not accepted. Why so negative? You also believe that politicians drink blood from children and that vaccination should genetically change you? This is ridiculous and can be fixed by education outside the bubbles.

I wish everyone who played down or denies Corona, a visit to each family of a dead person and 1 month 24/7 of work on a Corona emergency ward in the hospital. You have to be pretty ignorant not to want to see all of this. If everything is harmless, let ICU patients kiss you and fate will decide. Then you are my hero!

apozaf · 6 June 2021 08:39

OMFG, NO, totally NOT!! I’m not of that crazy kind, plz do not frame me, I am working on the front against Covid!
But I do not like that this pandemic is used by politicians for survailance again.
Really 4carlos, I’ve treated hundreds of C patients and I know exactly what it can do, you got me totally wrong.

Seven.of.nine · 6 June 2021 08:58

OT: It must be considered what consequences the current Covid policy has for democracy, society and freedom. We also should not forget all experiences mankind had made with surveillance systems in totalitarian states. All this access control, contact tracing and data concentration systems, once installed, will NEVER AGAIN be uninstalled.

4carlos · 6 June 2021 11:20

OT: Nobody must install an app or get vaccinated? Tell me if I’m wrong. So far, you can comfortably resist in the living room without fear of the consequences?

T:
I don’t see any point in installing an app if the vaccination certificate is sufficient, but there isn’t a conspiracy lurking around every corner. An app contradicts my understanding of data economy, but is not the topic here.

JulienBlanc · 7 June 2021 11:15

For those who can read french, here’s an interesting article about how the situation in France: Pass sanitaire : la poudre aux yeux du pseudonymat, des données médicales en clair

I’ll try to summarize:

there’s far too much data in the 2D code
there’s no encryption for the sensitive data
the verification application is not open-source, and does not work in flight mode (while it is not a sufficient guarantee, the fact that this basic requirement is not even met shows how much they care for privacy…)
it seems that the whole content of the 2D code is sent to a central server
the verification application relies on google services for the android version
there are no technical guarantees that the data won’t be used for other purposes.

Fuzzillogic · 7 June 2021 14:06

@Seven.of.nine, @apozaf, please keep it on topic. I’m not interested in opinions about governments being evil or not, I’m interested in getting apps on SFOS.

mips_tux · 7 June 2021 14:28

Yes, i read this article. Thanks.
At this time, from my own point of view, the best solution, in France is Sanipasse.
Always for those who read french : https://sanipasse.fr/
And also : Sanipasse : le déconfinement libre ! - LinuxFr.org
An app build on sanipasse for Sailfish OS would be the best solution, i think.

arie_jolla · 14 June 2021 15:43

A ‘Leitz folder’ can not be revoked for any unspecified reason by an unknown operator at an unknown organisation.

s_mario · 14 June 2021 18:17

A Leitz folder can also be stolen.

s_mario · 14 June 2021 18:21

Sorry but I do not understand you…