# Potential Security and Privacy Issues in Novel Taiwanese National eID system - 何明洋

{%hackmd @HITCON/r1z4zylVv %}

> 從這開始

###### tags: `HITCON2020`,`HITCON`

## Declaration e-ID

窩不知道

## Distribution

(地圖分佈)

- Compulsory ID cards
- Non-compulsory ID cards
- Issue eID (台灣也被標成這個區塊了)

至少有 47 個國家，歐洲、亞洲、非洲

## Case study
### Recorded Information (Estonia)

- Surname
- Givenname

### Data saved in the chip

#### The information listed on the card

no need to enter pin code to acccess
protected by PIN1
protected by PIN2

#### Authentication key pari (384-bit ECC)
- Protected by PIN1

#### Signature key pair (384-bit ECC)

### Usage

- Legal travel ID for Estonian citizens travelling within the EU
- National health insurance card
- Proof...

#### Ivoting in Estonia
PIN1 E-voting system (public key)
PIN2 Digital signature ,Encrypted vote

PIN1 加密， PIN2 簽章

有線上投票，人民投票的意願變高了

Middleware: DIGIDOC，可以簽文件跟加解密

Changing PIN1,PIN2,PIN3

### X-ROAD
- A data exchange platform that provided integrity and confidentiality
- Use blockchain to record the log of exchange
- Decentralized
- Citizens don't need to provide same data to different agency many times

### Related products
#### Mobile ID
Use a mobile phone as a form of secure digital using special SIM
#### Digi ID
Digital document that can be used in an electronic environment but cnanot be presented to identify a person.
#### Smart ID
...

### Manufacturer
#### Chip
- IDEMIA, French
#### Personalization
#### Certificate

### Introduction (Belgium)
Issue 2004/09/27
Content
Optional
On chip file
Update
Function

### Security and Privacy
Due: 10 years
Content: Quthentication key & signature key
PIN code:
PUK code:

Cryptographic details
JavaCard operating system of Axalto
On-board hardware key generations

### Germany
### Introduction
Issue: 2010/11/01
Content:
- Surname and name at bith,
- First names
- ...

### Introduction (cont.)
PIN code /PUK code
Signature function
- According to the German ...
Secure travel document
- Can be used as a passport substitute for travelling to certain countries

### Security Mechanism

PACE / PA

### Introduction (Croatia)
Issue: 2015/06/08
Content:
- Name, Gender, Citizen, Birthday, Picture, Signature, Residence, Issued by, personal ID
Legal basis:205/06/02

System
Manufacturer
Function

### Security and Privacy
Card
Content RSA 2048 key / RSA 2048 key
Password (PIN): 6~8 pin code for each cert.
Due: 5 yrs
Other:
- <5 y/o: None
- 5~18 y/o: Only authentication
- 18~65: Auth & eletronic signature certificate
- > 64: None or both
#### Security and Privacy

要申請 eID 要先去警察局，要帶證件，證明是自己的資料
然後會送到內政部，內政部會透過 secure channel 跟製造商聯絡
之後就會通知使用者可以領卡，使用者去警察局領卡跟 initial pin code
使用者回到家中就透過 middleware 去設定 2 PIN code、PUK code
可以在家裡很安心的設定 pin code

#### NIAS Authentication

個人使用的時候，要透過 eOI Auth. Provider
使用時透過 TLS 連線

#### e-citizens

比較特別的功能:

- 可以看小孩的成績 (笑)
- 參加政治討論
- 6個月內的處方

## Threat Model and Potential Risks

### Middleware
#### Security and Privacy Hazard

- Single sign-on auth. (SK_auth remains activated)
- Unrestricted release of personal data (identity, address and picture files are not PIN-protected)
- Identity file can be copied to another smart card (called identify left)
- Malicious application can let the eID card sign a different

#### Improvement

- New Auth. Protocol: Auth (revised of HTTPS protocol)
Auth
- require the user's consent for every Auth
- Implemented on chip is better!

#### Threat Model

文獻結論：如果 middleware 沒有問題的話，基本上很安全
使用者可能會忽略掉憑證有問題的網站，還是繼續使用 -> 網站偽造憑證問題

### Attack Event
2007 DDoS from Russian Government toward Estonian eID system
2010 Security flaw discovered in German eID card software (sppof attack)
2017 In Estonia, 760000 state-issued eID cards with faulty chips were vunlnerable to middleware (identity theft)

## Challenge of eID

### Challenges

- Multiple identity systems: Need to integrate multiple systems
- Limited funcionality: Need to develop more applications for digital ID
- Security and privacy Issue: There are stil some security and privacy concerns
- Not yet popular: Need to issue eID to more people caused by multiple reason (不要一半人使用紙本，以半人使用 eID)

## eID in Taiwan

### Origin

- Insufficiency of security
- Too much disclosure
- Low application rate(~20%) of 自然人憑證

### Itro.
- Issue Deferred
- Content: 姓名、身分證字號、出生日期、相片、結婚狀態
- Legal basis: 戶籍法 52, 59 條
- System: T-road、內政部、戶政事務所
- Manufacturer: Unknown (不公開招標)
- Function: Proof of identity & Digi sign.

### Security and Privacy
- Card: ISO 7816 chip, ISO 29115, FIPS140-2
- Content: All of data on it + Others (Sign. cert. (RSA 2048 key))
- Due: ?

公開區用身分證後六碼保護
加密區有配後姓名，但已經在表面了啊？

### T-road

- T-Road 基礎層-基礎網路設置

政府骨幹網路 (GSN)

## eID Guidline

### Card related

| | EE | BE | DE | HR | TW |
| -------- | -------- | -------- | -------- | -------- | -------- |
| Should contain necessary info. only | o | △ | △ | o | △ |
| Should save other important info. in chip | x | x | x | x | o |
| Should require PIN code to access info. in chip | x | x | o | o | o |
| Should require PIN code to use digital signature | o | o | o | o | o |
| Should allow user to set PIN code Privately & securely | o | o | o | o | N/A |
| Should expire in a well-defined time | o | o | o | o | N/A |
| Should utilize safer key and package (e.g. RSA 2048) | o | o | o | o | o(?) |
| Allow different function choice for each age group | o | N/A | o | o | N/A |
| Credible manufacturer | o | o | o | o | N/A |

### System related & Others

| | EE | BE | DE | HR | TW |
| -------- | -------- | -------- | -------- | -------- | -------- |
| A open-source system | o | △ | x | x | x |
| Communication with encrypted data | o | o | o | o | N/A |
| Self-controlled permission between diff. department | △ | N/A | N/A | N/A | N/A |
| Credible database & server | o | o | o | o | ? |
| NOT accessible outside government | o | o | △ | o | N/A |
| -------- | -------- | -------- | -------- | -------- | -------- |
| Versatility | o | o | o | o | ? |
| Usability | o | o | o | o | N/A |
| Sufficient legitmacy | o | o | o | o | x |
| Penalty & Obligations | o | o | o | o | x |
| Transparency | o | o | △ | △ | x |

### TW eID Pros and Cons

| Advantage | Pontential problem |
| -------- | -------- |
| Many services would be available w/T-road | Application? |
| Convenient (e.g. spend less time on filling in the form) | No due date |
| Reduce direct disclosure | No ACT to guarance |
| Enable digital signature | How to set PIN CODE securely |
| Alleviate the risk of identity spoofing (PIN code) | Being tracked by government? |
| Difficult to be copied | Middleware? |
| | 刁民 |

## QA

Q: 在這個 eID 有一個滿重要的部分，他其實是不需要插卡，只要感應就可以，這樣不是會造成額外的問題嗎？您的議題中沒有提到這個的解法
A: 歐洲國家也都是插卡，並沒有感應的功能，所以 case study 並沒有討論到，我有點不確定台灣的 eID 到底能不能感應。
會眾補充: 就我們目前的研究，新的 eID 應該是加密區跟自然人憑證都不開放 NFC 的功能，只有公開區跟前面那個戶籍地的那邊有 NFC

Q: 因為 eID 裡面包含了所有的個人資訊，一旦遭到攻擊... 如果遭受攻擊的話，我們要怎麼回復這個系統？
A: 某國(?) 是立刻回收有風險的卡片，撤銷有問題的憑證，用這樣的方式先止血，再慢慢修復。確實一開始要確保沒有問題，不然發生問題要花更多的經費... 會很麻煩。

補充：
各國發生的比較嚴重的事件中，在那個艾莎米雅有發生問題多達 70 萬張卡片，實際上這個事情很有名，他們也不用多說
embed 原廠在產生私鑰時，偷吃步，用比較快的方法去產生質數，導致容易被破解，3 年前的駭客年會也有人提過