Archives for posts with tag: eID

Eergisteren nam ik deel aan een debat over het nieuwe Nederlandse eID stelsel (oftewel Idensys zoals het nu heet. Eerder schreef ik over de rampzalige gevolgen van de destijds nieuwe koers van het stelsel. Is er in de tussentijd iets veranderd?
Read the rest of this entry »

De Nederlandse overheid werkt al een aantal jaren aan een nieuw eID stelsel (een elektronische vorm van identificatie online) ter vervanginging van DigiD. Dat is ook wel nodig, want DigiD is kwetsbaar, wat tot grote schade kan leiden. Onder deze druk, en vanwege het feit dat marktpartijen de oorspronkelijke plannen voor het eID stelsel niet zagen zitten, heeft de overheid er onlangs voor gekozen een andere koers te varen. Het eID stelsel wordt een uitbreiding van eHerkenning (een systeem voor online identificatie voor bedrijven), en gaat Idensys heten. Dat is wat mij betreft niet alleen een stap terug (eHerkenning is gebaseerd op verouderde en relatief onveilige concepten), maar zelfs een stap in de verkeerde richting.

De oorspronkelijke plannen voor een eID stelsel

Read the rest of this entry »

Today I read an interesting paper by Marian Harbach and colleagues from the University of Hannover. They have studied the factors that influence the acceptance of new methods authentication online. In particular, they have studied user attitudes towards using the new German electronic identity card (nPA) as a replacement for username/password based authentication online. This is highly relevant for our own work on IRMA, a platform for authentication based on attribute based credentials.

Read the rest of this entry »

In our IRMA project we develop a platform to support attribute based credentials (ABC) on a smart card. We believe the IRMA scheme is more secure and more flexible than the attestation based approach (as used by the German eID system, that use the placeholder name Mustermann on their sample cards). Below I will explain why.

Read the rest of this entry »

Many countries that have an electronic identity (eID) system attach the eID chip to a classical identity card. From a historical perspective this is a natural approach (eIDs have evolved from the electronic or biometric passports). However, as a consequence, people can only own at most a single eID, and a significant group of citizens are excluded from owning an eID at all. This severely affects the coverage and inclusiveness of eID applications, and even prevents the implementation of certain types of eID applications.

Read the rest of this entry »

Ideally, a relying party that needs to verify certain attributes of a user would do so all by himself. However, in the new German eID system there are currently 7 so called eID service providers that handle this task on behalf of many relying parties. The Germans did this to allow service providers to quickly adopt the new eID system, because they can simply contract an eID service provider instead of implementing the functionality themselves. However, this creates a hotspot. For all users the eID service provider sees all attributes verified for all relying parties it services. The eID service provider is therefore in principle able to link a user to all the relying parties it visits, together with the relevant attributes. This appears to be a serious privacy risk. Or isn’t it?

Read the rest of this entry »

In the IRMA (I Reveal My Attributes) project we are working to make attribute based credentials practical. IRMA provides very efficient implementations of such credentials on (contactless) smart cards. This allows us to use the smart card as a secure and portable container for these credentials. One of the things we have been looking at is possible use cases. Last week I discussed how the IRMA card can be used to stop the resale of event tickets. In this blog post I will discuss an almost trivial application: proving age bounds.

Read the rest of this entry »