Could governments and banks become CAs?

Question

When you apply for a passport, driver's license, home mortgage, bank account, credit card, etc., the issuing organization must verify your identity. In the course of doing so, would it be feasible for them to issue an x.509 certificate? These could then be used by individuals for S/MIME, quick-and-easy identification on government websites, digital signatures on electronic tax filing, etc.

Specifically, I want to know:

Is there any reason (from a security standpoint) that a government, bank, or credit card company should not be part of PKI?
Does it make sense to issue x.509 certificates that are associated with "offline" entities, the way PGP keys are (supposed to be) associated with real people?

Is there a national government that does not have a CA? As for banks, there are some. [a simple google search](https://www.google.com.br/search?num=40&newwindow=1&q=bank+certificate+authority) [shows](https://www.bb.org.bd/services/ca/ca_cps.pdf) [several](https://www.bsi.si/en/reporting.asp?MapaId=1625). — Mindwin, Jan 20 '17 at 16:20
@Mindwin I'm asking about a CA for issuing certificates to individual bank customers. My bank sure as heck didn't give me a cert. — shadowtalker, Jan 20 '17 at 16:27
I think that @Mindwin gave you an [example](https://www.bsi.si/en/reporting.asp?MapaId=1629) of a bank that issues certificates to individuals, although it is a central bank, not a retail bank. — Ellie Kesselman, Jan 22 '17 at 08:10
[e-Estonia](https://e-estonia.com/) is the best example of an open system like this. Most banks do issue their customers a certificate; it is embedded within the chip on your bank card. However, this is a closed system - third-party developers can't (easily) integrate with it. — paj28, Jan 22 '17 at 13:39
@paj28 oh is that how those card chips work? They're only just starting to catch on here in the United States. — shadowtalker, Jan 22 '17 at 14:03
@ssdecontrol - Roughly, yes. There's a much better explanation in [this answer](http://security.stackexchange.com/a/49294/31625) — paj28, Jan 22 '17 at 14:17
Why would a bank help you do business with third parties? A bank wants your (financial) business just for themselves. Managing a CA is hard work. You have to revoke certs, keep your keys safe, issue certs. All of that would generate expenses that would add a price tag to the cert. TINSTAAFL. — Mindwin, Jan 23 '17 at 10:43

score 30 · Answer 1 · answered Jan 19 '17 at 14:33

30

I know of at least one government that has a root CA:

The state of the Netherlands. As far as I know they don't use it to identify people when they come pick up their driver license.

I think Estonia has a system in which all residents have a card containing a certificate.

answered Jan 19 '17 at 14:33

Sjoerd

28,707
12
74
102

11

Multiple European governments (I know of France and Germany) don't operate their own public CA directly but they have (formerly and now at least partially) state-owned telecommunication companies who operate a public CA each. – David Foerster Jan 19 '17 at 18:21
1

As an interesting aside, the Dutch Government was heavily affected by the [DigiNotar breach](https://en.wikipedia.org/wiki/DigiNotar) and then took over operations of that CA. – Boris the Spider Jan 20 '17 at 08:27
does this mean that governments could perform a MITM attack on anyone in that country? – User1 Jan 20 '17 at 08:39
4

@user1 if a CA is trusted by browsers, the owner of that CA can perform MITM attacks against anyone _using the browser_! [Certificate pinning](https://security.stackexchange.com/questions/29988/what-is-certificate-pinning) is designed to prevent such attacks. – Boris the Spider Jan 20 '17 at 10:16
4

@user1 Most national CAs aren't actually trusted by browsers (they don't need this, since they do not issue TLS server certificates). – user1686 Jan 20 '17 at 12:28
1

@grawity there is a miriad of national CAs in the browser trust stores. – Ángel Jan 21 '17 at 01:07
3

@user1 Theoretically yes, but note that _any_ CA being found performing a MITM attack (which would be easy to prove) would lead to their immediate revocation and a lot of public shaming. – Ángel Jan 21 '17 at 01:08

score 20 · Answer 2 · edited Mar 17 '17 at 13:14

20

To complement Sjoerd's answer: some countries even give every single citizen and resident their own certificates, stored inside an ICC that is also the primary identity document. For illustration, here are mine (and the two CAs from the trust store of my macOS computer).

They're used in government agencies, post offices, pharmacies, and even companies. Many also use them online (using a smartcard reader and a browser extension) to file their taxes, access official correspondence, or request/check on social benefits.

edited Mar 17 '17 at 13:14

Community

1

answered Jan 19 '17 at 21:00

Constantino Tsarouhas

301
1
6

3

Wow, this is damn close to what I had in mind. It makes a ton of sense. Can you also use those certificates as encryption keys? – shadowtalker Jan 19 '17 at 23:44
4

@ssdecontrol The private key is stored in government records. It's strictly an authentication and signing key for official affairs. Non-governmental entities still use state-provided APIs and websites, passing tokens (or something like that; I'm not an expert in that field) around generated by the ICC (the chip is PIN-protected). Although it would've been handy to add more keys to the card, e.g., for building access or for banking, it's not possible as far as I know. ;-) – Constantino Tsarouhas Jan 20 '17 at 00:23
Yep, many European countries do this (although usually not nearly as well-developed as Estonia's) – my ID card in 2009 already had a certificate as well. Operators here even issue special _SIM_ cards capable of holding X.509 certs. (Although they have no public API, so they're mainly for accessing banks and gov't sites...) – user1686 Jan 20 '17 at 12:27
2

@RandyMarsh: Are you sure the government records actually store the private key? They don't need this for your mentioned purposes, and at least _here_ the rules for "qualified" certificates require the private key to be generated within the card itself, making it impossible to export even by the issuer. – user1686 Jan 20 '17 at 12:32
2

@ssdecontrol Whilst signing keys can't be used directly as encryption keys, you can use them to authenticate a key exchange (using Diffie-Hellman or similar), bootstrapping integrity into confidentiality. – James_pic Jan 21 '17 at 20:47

score 13 · Answer 3 · edited Mar 17 '17 at 13:14

13

•Is there any reason (from a security standpoiny) that a government, bank, or credit card company should not be part of PKI?

Mixing business and worldwide government interests isn't something most security professionals are keen on and the damage that can be caused by a rogue CA (whoever the owner was/is) is very real, so that is the main security risk.

There are a few (like CNNIC) but the community isn't overly keen on them and some have been revoked from the popular certificate stores (which is as pretty good as killing them off) because of proven abuse.

That said the reason there's not many is probably mostly non technical, the barrier to entry is they would have to maintain its security and probably have to have regular audits to remain eligible to be on some lists (which I would imagine most wouldn't want to bother with unless they're charging an amount that makes it commercially viable) such as the Mozilla Firefox default list of trusted CAs and also be trusted not to sign other certificates that they are not entitled to. Certificate pinning helps (it's tricky to fake google.com with modern browsers now) but that's not to stop them from pretending to be my bank etc. if they get comprmised. Plus there's the added reputation risk if they get compromised which makes it less appealing.

See also Are there other roots of trust on my computer aside from these 46 root certificates? which references the Hong Kong Post Office root certificate.

This page listing the main stores and the principles and criteria to be included they must follow may also help.

edited Mar 17 '17 at 13:14

Community

1

answered Jan 19 '17 at 13:32

Matthew1471

1,124
10
14

2

I don't know that the OP is asking about governments taking a role similar to Verisign - i.e., taking a primary role in authenticating non-government websites. I think OP is asking about using it to allow individuals to authenticate to the government websites (or in person even) when performing governmental functions. – Joe Jan 19 '17 at 17:37
@Joe I'm asking about something in the middle. You're correct that I'm definitely not thinking about using these certificates for websites. But I am thinking about using them for non-governmental functions like payments authorization, as well as being available for light-duty file encryption. – shadowtalker Jan 19 '17 at 18:51
2

+1, this appears to be the only answer that attempts to answer the question as asked. The answer is: Yes. – President James K. Polk Jan 21 '17 at 12:49
@JamesKPolk do you think it's better than the one I accepted? – shadowtalker Jan 21 '17 at 14:28
@ssdecontrol: That is entirely up to you. The answer you accepted and the all the others I've read attempt to show that there are already government CAs that do exactly what you suggest, but they avoid answering the question of whether there are potential negative security consequences of such a model. – President James K. Polk Jan 21 '17 at 16:21
@JamesKPolk good point, although I ended up accepting that answer because of the specific discussion of offline and online trust, which I felt was relevant. I was torn between this answer and the one I accepted because they both went beyond the simple "here's an example of a government CA". If you think this answer is more valuable to the community than the one I chose, I'd be happy to switch. – shadowtalker Jan 21 '17 at 16:39
@ssdecontrol: thank you but it is important that the accepted answer reflect your choices, not mine. My comments are meant to amplify the discussion, not direct a particular action. – President James K. Polk Jan 21 '17 at 16:45

usr-local-ΕΨΗΕΛΩΝ · Accepted Answer · 2020-11-27T23:04:33.087

Case study: Italy

Italy provides a well-known root CA list. The list is made mainly by banks or official professional associations.

The official list is maintained at this address (no English version found), official requirements in English listed here.

What the OP legitimately asks is if the government itself, or a trusted agency may release X.509 certificates for everyone for public use, e.g. sign your own email.

Talking about Italy and mainly other EU countries, this is mainly a cost/benefit choice. Central governments do not normally have large budgets.

Issuing a passport is something different than maintaining digital certificates. A passport is something governments are issuing to the majority of their people to allow international travels, considering modern passenger flows, email-signing certificates are used by a definitely small niche of the market.

Commercial companies as the ones listes above require money by people applying for a digital ID in order to support their complex and critical infrastructure. They will check your government-issue ID to bind a specific digital identity (public key) to a government-issued identity, which in simple words is you but then leads us in the field of philosophy: "Who are we? What is the relationship between an individual and his identity? Is it illegal to use a legal name?"

In Italy, again, something more specific for some kind of unified digital ID has been done and is called SPID (pron. speed, acronym Sistema Pubblico per l'Identità Digitale, Public System for Digital Identity) and is implemented using X.509 certificates and SAML tokens exchange. Those certificates can be used only to authenticate. Unfortunately the entire expensive project will have a hard life.

##Shattered Italian digital IDs (pre-SPID era) So far all government offices tried to implement their own digital ID system to allow people to use a lot of online services, but the absence of a single government-pushed digital ID standard let do fragmentation in the market.

The 20 regions implemented the "CRS" (Carta Regionale Servizi, Regional Health Card), which is basically your Health Card enhanced with a smart card token, of which Wikipedia shows no photo (but really, think about a chip on the same plastic tag you find now). It contains an SSL Client certificate valid only (gasp!) within your Region, so if you relocate you need to replace your card despite your Tax Code/Social Security Number does not change during your entire life.

Another implementation of officially-recognized IDs was digital signature. Yea, that's right! X.509-powered non-repudiation certificates stored in... uhm... that's the point! Those signatures were originally developed to give legal value to PDF/TXT documents, such as notary or government acts, but also private contracts. They needed to be deployed to smart cards or USB/SIM tokens, but their difficulty of utilization (need a workstation with reader, drivers and software, with the OSS community angry) forced the powers-that-be to approve HSMs. Long story short they are used only within specific regulated environments where hand signature is now forbidden or non-practical.

The certified email system and the digital certaneity of the sender

And then certified email. Third disaster in the country under examination. What the OP asked is a digital certificate for his emails, right? Riiiiiiiight? Italian people are smart, so smart that they have reinvented their own SMTP with PEC (Posta Elettronica Certificata, Electronic Certified Mail). Quick lesson on PEC:

PEC address space is separated from internet-mail (RFC822) space. They comply to the RFC and transit via SMTP (encrypted SMTP) but basically a PEC address, in the original form, did not accept mail from internet host and could send only to PEC address spaces. This has changed, as now the exception is that a PEC-to-email message is not fully certified
ISPs provide proof of delivery that ~~can~~ is required to be accepted in official acts and courts
ISPs also provide binding of addresses to identities with a public registry
Private keys are held by ISPs. You do not sign your message, they do with your signature. Scary!!!!

For example, if you want to officially inquire Mr. President Gentiloni, drop a message to presidenza@pec.governo.it they can't deny to have received.

Now to SPID. Under President Renzi government, Italy finally tried to define an "ID system that rules them all". SPID was meant to allow citizens to access all online public systems with a single ID. SPID is currently a username/password/OTP authentication issued by 4 companies only. Government agencies are mandated to support SPIDfor public-oriented services. In the near future, we expect SPID to be used for schooling, as you already sign up for your children's school offline or online with or without a SPID.

All the digital ID systems suffer one thing: people don't need them in their daily life and that is the reason they don't sign up for them even when they are free. Digital alphabetization in this country is quite low compared to other countries, and all services/offices except one, with obviously no English localization are available without a SPID digital ID.

The Digital Identity Card project

Italy can be proud to be the first European country to have developed (which must not be confused with deployed) an electronic identity card made of the same e-passport technology and with a X.509 certificate for every individual. Since 1994!!!! But since it was never deployed nation-wide, and citizens had to either obtain a paper ID (which EU successfully deprecated along Greek paper IDs by 2026 deadline) or relocate to Milan and Rome, the only cities issuing a plastic biometric ID, the SPID project came to rise and success.

Well... there was another practical reason for SPID. ID can be issued only to physical people, while SPIDs can be issued to enterprises (i.e. a company identity).

Finally, only in 2016 the CIE plastic biometric ID was deployed nation-wide. Not all documents are replaced, but the plastic one is the only legal choice for newly issued IDs.

This allowed the Accedi con CIE (enter with Digital ID) project to be developed. You can log in using the X.509 certificate embedded in the plastic ID. A number of digital services are available to review/pay taxes, access health and labour related information, etc.

Since 2016, then, the X.509 certificate in the CIE card is (one of) the digital identity of an Italian citizen.

International trust: cross-border identity

Attempts in the EU are being made to make digital signatures and digital IDs interoperable across countries. However, until a single list of trusted CAs will be made across all Europe, certificates issued in a certain country are not necessarily trusted in another.

This is being mitigated by the eIDAS directive. A lot of time will take for digital IDs to be usable across all EU countries, but the goal is to make a unique "trust market" along the current "unique [currency] market".

As of 2020, Italy, our case study, has joined the eIDAS project and you can use both SPID and CIE card to enter any eIDAS service. An example is Europass.

Offline vs online trust

Digital IDs has little to do with Microsoft and Mozilla trusted certificates. If you see a certain CA in your browser's trust list it does not mean that the CA has power to issue a certificate valid for signing Revenue Agency documents. No, it means that the CA can issue a certificate stating the machine can "officially" respond for requests directed to "https://www.example.org".

The strenght and at the same time complexity of the PKI system itself is the lack of a single, central, trust list. Such lack is the only means of democracy in Internet, but here we are again: a CA must be enlisted in all lists to become "operational".

As an example, I'd like to ask users from America, East Asia and Oceania if their computers trust the following certificate:

Serial: ‎35 d9 75 94 d1 b6 75 4d b6 36 42 cb b5 ea cf cf
Subject DN: SERIALNUMBER = 97103420580,SN = Sicurezza,G = Ufficio,O = ,DigitPA,C = IT
Issued by DN: CN = Ufficio Sicurezza,O = DigitPA,C = IT
Valid until: 2020-05-17

Hint: my Windows 10 says "no"

But that certificate is an official government-related certificate.

Conclusion

I provided an example in which a central government or a bank trusted by the government issues X.509 certificates to people. There is to me no real good reason for a government not to be a CA.

The OP should not confuse the legal validity of a "paper" ID with the commercial added-value of an interoperable "digital ID", which effectively is a commercial good worth money.

Disclosure: my company actively works in tax & compliance environment for a number of European legal entities, where our customers (financial operators) are mandated by law to obtain and properly use digital signatures. I work daily with digital IDs so I claim to be an "expert" in the subject.

`A passport is something governments are required to issue to their people to allow international travels`, may want to re-word this. In China, if the government has reason to believe you will embarrass them or speak out against them, they will deny or cancel your passport. In the United States, the government can also deny or cancel your passport if they suspect you of `X`, or if you're guilty of `Y`. Neither government is required to give you a passport if they don't want to. — Mark Buffalo, Oct 24 '17 at 18:48
Yes Mark, my intent was speaking in terms of numbers. Let the numbers speak then — usr-local-ΕΨΗΕΛΩΝ, Oct 24 '17 at 18:56

score 8 · Answer 5 · answered Jan 19 '17 at 15:04

Many governments do have CA for their internal usages, that are used both for their employees and internal servers.. And correctly delivering a personal certificate is not much different from delivering an identity card or a passport.

Now suppose that every identity card delivered in one country includes a smartcard and standard certificates with the same validity of the id card itself. The added cost comparing to a simple identity card will be about tens euros or dollars. Compared to the cost of employees processing the delivery chain, it is not really expensive.

But if every citizen now have a strong certificate store (smartcard) with a delivery process guaranteed by the government, and certificates that he could use for any authentication, digital signature or even encryption question, do you think that it will have no impact on companies delivering payed certificates? IMHO it could be seen as unfair competition by all those companies. And that alone is largely enough for governments to not come towards that path...

That being said, some banks already have subsidiary companies specialized in delivering strong certificates on smartcards with face to face delivery. But as they do not use public resources for that, there is no unfair competition.

score 8 · Answer 6 · answered Jan 20 '17 at 09:36

Estonia is the poster child in this regard.

For about 15 years our government has operated a PKI system, where every citizen and legal permanent resident is issued a smart card containing two certificates - one for authentication and one for signing documents. Now basically anybody can apply for a similar card tied to the PKI through the Estonian e-residency program.

The authentication certificate is used for secure online auhentication for numerous services

All kinds of e-government services, both personal and for managing one's company
Online banking
Accessing your health records
Accessing any private online service, which implements ID-card authentication

The signature certificate can be used to give legally binding signatures to any kind of digital document. This greatly simplifies doing business without moving loads and loads of paper around or meeting face-to-face just to sign something.

The same system can also be used to encrypt documents for transmission. All public certificates are accessible in a central LDAP repository, if You know the citizen ID of the recipient. Decryption of course is only possible with the smart card containing the corresponding private key.

In a similar fashiong the so-called "digital seals" are issued to legal entities to sign digital documents on behalf of a company (for example a digital proof of a bank transaction that I might download from an online bank portal is signed by the bank as a legal entity not a specific person working for the bank).

Operating this infrastructure has been contracted out to a private company actually owned by two of the biggest commercial banks and the biggest telco.

As a side-business this same company also has a public CA included in major browsers that they use to sell server certificates commercially.

score 1 · Answer 7 · answered Jan 20 '17 at 21:59

In Spain you can request a certificate like this

which is needed to perform some online administration actions. For example, to buy public debt in the Bank of Spain website or getting a birth certificate online. FNMT is the organization that emits them, but in fact its an organization with lots of years of history, printing money. The certificate can also be used to sign documents and many other things but you can't use it for software signing pourposes (only documents).

In order to get the certificate you can:

Use the DNI-e, the electronic ID card which everybody have, but you'll need a smart card reader, which very few people have. Or...
Go to a National Treasury offices (Agencia Tributaria) to verify identity.

Once you had the certificate you can renew it as many times as you want.

The FNMT root certificate is included in Windows and works with Internet Explorer and Google Chrome out of the box. There's a bug report for Mozilla in order to include it in their distribution, but there have been some problems and it's not yet included.

Note that it has been added to NSS bundle, and it is going to be included in Firefox 53 — Ángel, Jan 21 '17 at 01:16