Private keys used to sign EU Digital Covid Certificate might have been leaked

Re:Private keys used to sign EU Digital Covid Certificate mi... by GuB-42 on Wednesday October 27, 2021 @10:31AM (#29013784)

I checked the Hitler code with apps from Latvia, Switzerland, Luxembourg, Iceland and France.

The apps for Latvia, Luxembourg and Switzerland say OK, the one for France says "OK but fraudulent", the one for Iceland says no. From the article it looks like the Italian app also says no.

Not revoked everywhere it seems. Also, the French app seems to check against a blacklist, so it is possible that only the Hitler code is considered invalid and not the signing key.

[ Parent | on HN ]

Re:Private keys used to sign EU Digital Covid Certificate mi... by SahAssar on Wednesday October 27, 2021 @10:46AM (#29013982)

> "OK but fraudulent"

What does that even mean?

[ Parent | on HN ]

Re:Private keys used to sign EU Digital Covid Certificate mi... by GuB-42 on Wednesday October 27, 2021 @11:08AM (#29014309)

It has the green check mark, like a valid certificate because the vaccination scheme is right. But under it is a warning that the pass is fraudulent (blacklisted).

It is a weird UI choice but making the distinction between an invalid pass (ex: partial vaccination) and a fraudulent one is useful.

[ Parent | on HN ]

Re:Private keys used to sign EU Digital Covid Certificate mi... by mongole on Wednesday October 27, 2021 @10:56AM (#29014109)

The Austrian app is also satisfied.

[ Parent | on HN ]

Re:Private keys used to sign EU Digital Covid Certificate mi... by Sander_Marechal on Wednesday October 27, 2021 @10:42AM (#29013920)

I just checked with the Dutch app. It says the QR code is valid.

[ Parent | on HN ]