People are often confusing eID related topics that are not one and the same. Not knowing all the facts makes them scared of their privacy. Lets clarify some questions that I have seen people to be misunderstanding.
Using national eID cards or others solutions do not have significant differences from privacy standpoint compared to for example self-sovereign identity (SSI).
What is an eID?
eID is type of verifiable credential. It is issued by an trusted authority, only you have control over it and websites or apps can request you to present this credential for verification. After verification the website will get some identity information about you that the issuer has embedded into the certificate.
eID can be in the form of Smart Card like national ID card which is issued as an alternative to passport, USB cryptostick or security token, SIM card with embedded certificates in your phone or specially engineered and secure mobile app.
How are government information systems related to eID?
Your medical history, tax and income information, family relationship, addresses etc are all already in government databases. Government can read this data any time it wants according to its regulation regardless if you have eID card or not. Difference is that if you do not have secure eID credential then you yourself cannot access it and you cannot check who has been reading your data.
Is personal unique code for every citizen constitutional?
All governments must be able to differentiate one citizen from another. You do not want to end up in jail because somebody else with same name has murdered someone. Without unique identifier it is also really complicated for institutions like banks to make sure that the guy with the same name as you cannot withdraw all the money from your account. See examples of different possible unique identifiers below from the ETSI EN 319 412-1 standard.
How much new information I must give to get eID token?
There is no difference if you request true SSI verified credential from your government, get your new passport or get national electronic ID card. If government is taking height and weight measurements, capturing fingerprint, checking hair and skin color and saving this all to its database then it is not related to electronic ID card function. For electronic ID card function is minimally enough to have only personal ID code. Name is also a good practice. This means that no new information is given to the government.
Is every eID usage registered in government database?
Similarly to the SSI the issuer might or might not be contacted to verify the credential. Electronic national ID cards can be verified in 2 ways. One is checking Certificate Revocation List (CRL) which are updated usually a few times per day. Using this method the eID card can be verified completely offline and ID card issuer never knows if and who verified the card.
Second option is to use realtime Online Certificate Status Protocol (OCSP). In this case the issuer OCSP responder can save IP addresses of verifiers who have verified your certificate validity at this point of time. This is useful because if your card and pin has been stolen then you can block the card and next moment the bad guys cannot use it anymore.
Is there too much information revealed when using electronic ID card online? Service providers usually get very basic information, for example name and personal identity code. Often the identity code contains your birthday as well.
What data is available to the service when I log in and sign documents with ID card, Mobile-ID or Smart-ID?
Service gets your firstname, lastname and unique personal identity code. This is minimum information to identify the person you are transacting with and no other data is needed. If you service needs more information then there are other services for that. Just to be clear that identity code can be parsed and your gender with birthday deducted, in some countries even this information is missing. No biometric information, no fingerprints, no facial image, no address, no height and no eye color. Here is all of the information from my active ID card, nothing secret in there:
$ cat 38112086027.pem
-----BEGIN CERTIFICATE-----
MIIFwDCCA6igAwIBAgIQOMm/0JR7zi1aArcEgjE3PTANBgkqhkiG9w0BAQsFADBj
MQswCQYDVQQGEwJFRTEiMCAGA1UECgwZQVMgU2VydGlmaXRzZWVyaW1pc2tlc2t1
czEXMBUGA1UEYQwOTlRSRUUtMTA3NDcwMTMxFzAVBgNVBAMMDkVTVEVJRC1TSyAy
MDE1MB4XDTE3MTEwODA3NDkyNFoXDTIyMTAxMjIwNTk1OVowgZIxCzAJBgNVBAYT
AkVFMQ8wDQYDVQQKDAZFU1RFSUQxGjAYBgNVBAsMEWRpZ2l0YWwgc2lnbmF0dXJl
MSAwHgYDVQQDDBdQQUxBLE1BUkdVUywzODExMjA4NjAyNzENMAsGA1UEBAwEUEFM
QTEPMA0GA1UEKgwGTUFSR1VTMRQwEgYDVQQFEwszODExMjA4NjAyNzB2MBAGByqG
SM49AgEGBSuBBAAiA2IABCTuoJqEhmBs+VgHmY4IBMHgzzDWRwePn4L7icr8/9OJ
aVpW76AsmlEsq2cya49XsiYCy8GTtoek+/Yd/3W8yqlAdwEvLeOJHBFwIOcm408/
QfgQlBF7WQpg0bTpymsIKKOCAewwggHoMAkGA1UdEwQCMAAwDgYDVR0PAQH/BAQD
AgZAMFQGA1UdIARNMEswPgYJKwYBBAHOHwEBMDEwLwYIKwYBBQUHAgEWI2h0dHBz
Oi8vd3d3LnNrLmVlL3JlcG9zaXRvb3JpdW0vQ1BTMAkGBwQAi+xAAQIwHQYDVR0O
BBYEFFA+4NEGEp+075jA1gabUPt0yHAPMIGKBggrBgEFBQcBAwR+MHwwCAYGBACO
RgEBMAgGBgQAjkYBBDBRBgYEAI5GAQUwRzBFFj9odHRwczovL3NrLmVlL2VuL3Jl
cG9zaXRvcnkvY29uZGl0aW9ucy1mb3ItdXNlLW9mLWNlcnRpZmljYXRlcy8TAkVO
MBMGBgQAjkYBBjAJBgcEAI5GAQYBMB8GA1UdIwQYMBaAFLOriLyZ1WKkhSoIzbQd
cjuDckdRMGoGCCsGAQUFBwEBBF4wXDAnBggrBgEFBQcwAYYbaHR0cDovL2FpYS5z
ay5lZS9lc3RlaWQyMDE1MDEGCCsGAQUFBzAChiVodHRwOi8vYy5zay5lZS9FU1RF
SUQtU0tfMjAxNS5kZXIuY3J0MDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly93d3cu
c2suZWUvY3Jscy9lc3RlaWQvZXN0ZWlkMjAxNS5jcmwwDQYJKoZIhvcNAQELBQAD
ggIBAAsPR6S9fyeZ9T8mCpidsx7tIhjRwZ+rkJnB849B2J+tv59yxSA98xV+/cgN
nJXTfMmfHuzxdwlifTbWqcSvHsGqMs6BjPX5c4MJlJS+z47HffRpKI1wthctyAlH
KIzG+hA2CTlHZBwQ00v4bdjhBFrEam5gAgkjnw3E5iqwLNwxWanqvm/pHyYKDTsC
Cuag4TgeMDUvkMS3ZeYBbJUAcFg7UXk1nInDR1tZ8E1dAvVScYYkieTiOXNNG61z
nhP8TF1IQieq0+oP6c6MAsFGYgXJXIef0vx1bYuV9gr416aoQ4IHoFZvYXdM2FwL
RkA7gg+d4lcTG7XM9hBUf3a8rwF26WTbY7pnEvLd5oi8m3fzjdvdgwhCYRstXKSP
SCUbCB8EnQWoYDWcrycioRCv071HUjey2a2qMmki3e5In7W/ezCBnBV/38Hx8N4z
JIt7UlOUs9RsQd28OL+xrB7ufZ+qQxFFKU+9ozT8W1EDBD0cXA+GS6B06Lb4NVN/
0kcqw12rAMgglWN+ZDKU2tXdQlkCTbkMdt794zf0CNqW0DbYJoPXfOgxX13A7bNH
mB9WgbCcDEginZi4j56I0zr7gkZ/Qzw5/rv5mxcYBZcuPtGeYPbCgE7LJKffYnUS
667XLKxMZg4eJyG5jAOlpm4gvLw1bOeEQk477uarpTtTfkfg
-----END CERTIFICATE-----
$ openssl x509 -in 38112086027.pem -text -noout
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
38:c9:bf:d0:94:7b:ce:2d:5a:02:b7:04:82:31:37:3d
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=EE, O=AS Sertifitseerimiskeskus/2.5.4.97=NTREE-10747013, CN=ESTEID-SK 2015
Validity
Not Before: Nov 8 07:49:24 2017 GMT
Not After : Oct 12 20:59:59 2022 GMT
Subject: C=EE, O=ESTEID, OU=digital signature, CN=PALA,MARGUS,38112086027, SN=PALA, GN=MARGUS/serialNumber=38112086027
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (384 bit)
pub:
04:24:ee:a0:9a:84:86:60:6c:f9:58:07:99:8e:08:
04:c1:e0:cf:30:d6:47:07:8f:9f:82:fb:89:ca:fc:
ff:d3:89:69:5a:56:ef:a0:2c:9a:51:2c:ab:67:32:
6b:8f:57:b2:26:02:cb:c1:93:b6:87:a4:fb:f6:1d:
ff:75:bc:ca:a9:40:77:01:2f:2d:e3:89:1c:11:70:
20:e7:26:e3:4f:3f:41:f8:10:94:11:7b:59:0a:60:
d1:b4:e9:ca:6b:08:28
ASN1 OID: secp384r1
NIST CURVE: P-384
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
X509v3 Key Usage: critical
Non Repudiation
X509v3 Certificate Policies:
Policy: 1.3.6.1.4.1.10015.1.1
CPS: https://www.sk.ee/repositoorium/CPS
Policy: 0.4.0.194112.1.2
X509v3 Subject Key Identifier:
50:3E:E0:D1:06:12:9F:B4:EF:98:C0:D6:06:9B:50:FB:74:C8:70:0F
qcStatements:
0|0......F..0......F..0Q.....F..0G0E.?https://sk.ee/en/repository/conditions-for-use-of-certificates/..EN0......F..0......F...
X509v3 Authority Key Identifier:
keyid:B3:AB:88:BC:99:D5:62:A4:85:2A:08:CD:B4:1D:72:3B:83:72:47:51
Authority Information Access:
OCSP - URI:http://aia.sk.ee/esteid2015
CA Issuers - URI:http://c.sk.ee/ESTEID-SK_2015.der.crt
X509v3 CRL Distribution Points:
Full Name:
URI:http://www.sk.ee/crls/esteid/esteid2015.crl
Signature Algorithm: sha256WithRSAEncryption
0b:0f:47:a4:bd:7f:27:99:f5:3f:26:0a:98:9d:b3:1e:ed:22:
18:d1:c1:9f:ab:90:99:c1:f3:8f:41:d8:9f:ad:bf:9f:72:c5:
20:3d:f3:15:7e:fd:c8:0d:9c:95:d3:7c:c9:9f:1e:ec:f1:77:
09:62:7d:36:d6:a9:c4:af:1e:c1:aa:32:ce:81:8c:f5:f9:73:
83:09:94:94:be:cf:8e:c7:7d:f4:69:28:8d:70:b6:17:2d:c8:
09:47:28:8c:c6:fa:10:36:09:39:47:64:1c:10:d3:4b:f8:6d:
d8:e1:04:5a:c4:6a:6e:60:02:09:23:9f:0d:c4:e6:2a:b0:2c:
dc:31:59:a9:ea:be:6f:e9:1f:26:0a:0d:3b:02:0a:e6:a0:e1:
38:1e:30:35:2f:90:c4:b7:65:e6:01:6c:95:00:70:58:3b:51:
79:35:9c:89:c3:47:5b:59:f0:4d:5d:02:f5:52:71:86:24:89:
e4:e2:39:73:4d:1b:ad:73:9e:13:fc:4c:5d:48:42:27:aa:d3:
ea:0f:e9:ce:8c:02:c1:46:62:05:c9:5c:87:9f:d2:fc:75:6d:
8b:95:f6:0a:f8:d7:a6:a8:43:82:07:a0:56:6f:61:77:4c:d8:
5c:0b:46:40:3b:82:0f:9d:e2:57:13:1b:b5:cc:f6:10:54:7f:
76:bc:af:01:76:e9:64:db:63:ba:67:12:f2:dd:e6:88:bc:9b:
77:f3:8d:db:dd:83:08:42:61:1b:2d:5c:a4:8f:48:25:1b:08:
1f:04:9d:05:a8:60:35:9c:af:27:22:a1:10:af:d3:bd:47:52:
37:b2:d9:ad:aa:32:69:22:dd:ee:48:9f:b5:bf:7b:30:81:9c:
15:7f:df:c1:f1:f0:de:33:24:8b:7b:52:53:94:b3:d4:6c:41:
dd:bc:38:bf:b1:ac:1e:ee:7d:9f:aa:43:11:45:29:4f:bd:a3:
34:fc:5b:51:03:04:3d:1c:5c:0f:86:4b:a0:74:e8:b6:f8:35:
53:7f:d2:47:2a:c3:5d:ab:00:c8:20:95:63:7e:64:32:94:da:
d5:dd:42:59:02:4d:b9:0c:76:de:fd:e3:37:f4:08:da:96:d0:
36:d8:26:83:d7:7c:e8:31:5f:5d:c0:ed:b3:47:98:1f:56:81:
b0:9c:0c:48:22:9d:98:b8:8f:9e:88:d3:3a:fb:82:46:7f:43:
3c:39:fe:bb:f9:9b:17:18:05:97:2e:3e:d1:9e:60:f6:c2:80:
4e:cb:24:a7:df:62:75:12:eb:ae:d7:2c:ac:4c:66:0e:1e:27:
21:b9:8c:03:a5:a6:6e:20:bc:bc:35:6c:e7:84:42:4e:3b:ee:
e6:ab:a5:3b:53:7e:47:e0
Excerpt from ETSI EN 319 412-1 – Natural person semantics identifier
The semantics of id-etsi-qcs-SemanticsId-Natural shall be as follows. When the natural person semantics identifier is included, any present serialNumber attribute in the subject field shall contain information using the following structure in the presented order:
- 3 character natural identity type reference;
- 2 character ISO 3166 [2] country code;
- hyphen-minus “-” (0x2D (ASCII), U+002D (UTF-8)); and
- identifier (according to country and identity type reference).
The three initial characters shall have one of the following defined values:
- “PAS” for identification based on passport number.
- “IDC” for identification based on national identity card number.
- “PNO” for identification based on (national) personal number (national civic registration number).
- “TAX” for identification based on a personal tax reference number issued by a national tax authority. This value is deprecated. The value “TIN” should be used instead.
- “TIN” Tax Identification Number according to the European Commission – Tax and Customs Union (https://ec.europa.eu/taxation_customs/tin/tinByCountry.html). Or
- Two characters according to local definition within the specified country and name registration authority, identifying a national scheme that is considered appropriate for national and European level, followed by the character “:” (colon).
Other initial character sequences are reserved for future amendments of the present document.
EXAMPLES: “PASSK-P3000180”, “IDCBE-590082394654” and “EI:SE-200007292386”.
When a locally defined identity type reference is provided (two characters followed by “:”), the nameRegistrationAuthorities element of SemanticsInformation (IETF RFC 3739 [1]) shall be present and shall contain at least a uniformResourceIdentifier generalName. The two letter identity type reference preceding the “:” character shall be unique within the context of the specified uniformResourceIdentifier.
