I mean that's a seriously big advance over anything I imagined a govt capable of. Estonia was the only other place I heard even close.
And is 183 out of 2 million so bad? Just sign the next round of certificates with this lot and move on.
So yeah, these things are getting deployed in some places but I'm not too hopeful it will end up being much more than a gimmick. At least I hope not because the next step on the minds of some of these "technical" people is electronic voting and that won't end well...
But since no browser makes it easy to sign anything with a certificate stored on disk (or in a USB stick), this policy has led to serious dependence on ActiveX plugins (and therefore IE and Windows) that everyone has probably heard about.
Now the Koreans are trying to fix that, but since the government is just as boneheaded as ever, the officially mandated "cross-browser" solution is just a Windows binary that installs NPAPI and PPAPI plugins into every browser. Some variants even work on Linux, but only because they're implemented as Java applets.
PKI is cool in theory. In reality, it's hard to implement it in a way that is accessible to the general public.
Not very smart move if you ask me. If you teach users to ignore HTTPS errors, then MITM attack becomes easier because user don't see anything suspicious.
In our case I think we even have our own CA trusted by the browsers so there's no apparent reason for the self-signing.
>If you teach users to ignore HTTPS errors, then MITM attack becomes easier because user don't see anything suspicious.
That's precisely the point I made to the "technical" person and it was ignored...
It's a little unclear to me what the current status is: apparently it's valid for the National (Tax etc) Portal (altinn.no - literal translation: (hand)ineverything.no)). The basic idea was that the Postal service already allow the sending/delivery of registered letters -- so why not just use that for validating the ID. These days mail is largely handled by supermarkets -- and my impression is that the ID check isn't as reliable as it used to be when the postal service operated as a government monopoly.
Anyway, AFAIK, it's still the closest thing we have to working, secure digital ID in Norway.
German ones do something similar since late 2010. The card can be used for online authentication and eletronic signatures (requires certificate that is separately available).
So does Finland (since 2004).
But under 10% of the population has such a card (most people use drivers licence and/or passport as ID), and thus almost no private web services accept it for identification.
(How can you use a completely compromised private key as a root of trust for another certificate, anyway?)
https://scholar.google.com/scholar?cluster=92037504584829650...
This paper explains how an attacker can efficiently factor 184 distinct RSA keys out of more than two million 1024-bit RSA keys downloaded from Taiwan's national "Citizen Digital Certificate" database.
These keys were generated by government-issued smart cards that have built-in hardware random-number generators and that are advertised as having passed FIPS 140-2 Level 2 certification. These 184 keys include 103 keys that share primes and that are efficiently factored by a batch-GCD computation. This is the same type of computation that was used last year by two independent teams (USENIX Security 2012: Heninger, Durumeric, Wustrow, Halderman; Crypto 2012: Lenstra, Hughes, Augier, Bos, Kleinjung, Wachter) to factor tens of thousands of cryptographic keys on the Internet.