Security and Privacy Improvements for the Belgian eID Technology

Abstract

The Belgian Electronic Identity Card enables Belgian citizens to prove their identity digitally and to sign electronic documents. At the end of 2009, every Belgian citizen older than 12 years will have such an eID card. In the future, usage of the eID card may be mandatory. However, irresponsible use of the card may cause harm to individuals. Currently, there exist some privacy and security problems related to the use of the eID card. This paper focuses on solutions to tackle these problems. A new authentication protocol is introduced to substantially reduce the risk of abusing the single sign-on authentication and privacy friendly identity files are proposed to improve the citizen's privacy.

Building advanced applications with the Belgian eID

“…The eID card contains three files: (1) a digital picture of the citizen, (2) an identity file which contains the basic identity information and a hash value of the picture file; this file is signed by the National Registry, (3) an address file which contains the citizen's current residence; it is signed by the National Registry together with the identity file to guarantee the link between both files.…”

“…The message consists of a header 'KEYGEN', the NRN, the serial number of the eID card and possibly some other user information, making the message card specific. The hash of the message, hash M (keyGenMsg) is then signed with the signature key on the eID card resulting in a 1024 bit signature Sig (2). The fixed format prevents that an adversary obtains Sig by requesting a signature on a forged message; any message to be signed by the eID card should not match this format, except in this protocol.…”

“…When the data has been stored on the remote server, it can be retrieved by the owner from everywhere (see Table II). First, the message keyGenMsg is reconstructed (1) and signed with the eID card (2). With the signature Sig, the secret key K T (3) is regenerated for encrypting the secret tag (4).…”

“…lack of essential functionality and, more importantly, real killer applications. Moreover, the use of the current eID card involves a few security and privacy hazards [2,3].A recent survey on the use of the Belgian eID card in corporate environments ‡ suggests one of the main obstacles for using the eID card is the mistrust in the technology. While about 99% of the Belgian citizens possess a Belgian eID card, 56% of the respondents never used it.…”

“…lack of essential functionality and, more importantly, real killer applications. Moreover, the use of the current eID card involves a few security and privacy hazards [2,3].…”