Hacker News Reader

Comment by scandox | Hacker News Reader

> Ars is also aware of unconfirmed reports of a Western European country that also issues affected ID cards.

Any educated guesses?

Infineon seems to be popular supplier for smartcard ID cards over whole EU, with Estonia and Slovakia being special in that most of the issued ID cards actually have the chip (it's optional and not especially useful in most of EU). I would hazard to guess that said country is Luxembourg, Belgium or Germany (in this order of probability) as these countries also have somewhat large penetration of state-issued smart cards.

In Belgium all ID cards issued over the past 14 years have a chip, this should cover all people with a Belgian ID card as a Belgian ID card needs to be replaced in less than 14 years.

edit: As it is also required to have an ID card this should cover 100% of the population of Belgium.

Some batches of German ID cards use Infineon chips (I don't know which version as only some seem to be affected). A chip is built into all IDs issues since 2010 but it's disabled or at least unused on almost all cards. Not sure they actually do key generation on the card which seems to be the affected thing.

What I meant by penetration is the percentage of people who actually have the chip activated and use it for something useful.

In Czech Republic chip ID is optional and you have to pay (~20EUR) for the chip itself. As it does not have any meaningful purpose that is legal (loading your own certificate onto the card is technically possible but explicitly outlawed) even the local authorities issuing IDs will advise you that you don't want chip ID.

In contrast to that in the above mentioned countries I've seen state issued smartcards (regardless of whether they are EU-wide ID or just additional smartcard) used for useful purposes (eg. to submit VAT returns online, which is something that in .cz you can do with any PKCS#11 token of you choosing or by using state-run OAuth-ish ID provider)

I cannot provide any citation for that, but I believe that the EU regulations related to digital signatures require that the private key to not be available to the state, which implies either on-card generation or same process as is used by commercial CAs (which is the case in .cz, where you can choose from three or so CAs which are at least notionally commercial entities)

Basically nobody in Germany uses the chip for identification. I once opened a bank account with it just for the novelty but even the one use should put me into a very small group of active users. Even most government agencies don't offer to use your card.

Actually signing is performed differently and since this summer they switched to a cloud signing process where you don't have access to your key. You cannot get a certificate for a key on the card anymore. Not that anyone actually used that feature.

I mentioned Germany because I've seen Luxembourg-style smartcard authentication as one of posdibilities for submitting german VAT returns online when I cared about such things few years ago and the application involved in that looked mostly the same as Luxembourgh and Belgian one (Oracle Forms, similar UI...)

Edit: otherwise you confirm my suspicion that essentially nobody uses the chip on ID cards outside of Estonia (Slovakia is mentioned due to their recent massive rollout of chip IDs inspired by Estonia, but I assume that actual usefullnes is nil)

https://www.dnielectronico.es/PortalDNIe/PRF1_Cons02.action?...

Googling suggests that they might be another user of the ~~infected~~ infineon SLE78 platform.

Reply on news.ycombinator.com