25

There is a QR code which I think gets translated into an ID. How does that ID get checked? Is there a request to a common EU database with Switzerland and UK?

Improve this question
2
  • 11
    The UK is not in the EU, and is not part of any EU covid vaccine database initiative.
    – Rory Alsop ♦
    Sep 16, 2021 at 16:44
  • 5
    My vauge understanding is that the UK is using the same underlying system but with it's own signing key and at least some EU countries are accepting UK signed certs.
    – Peter Green
    Sep 17, 2021 at 7:33

2 Answers 2

Reset to default
47

The Certificate functions as follows:

  1. The EU Digital COVID Certificate contains a QR code with a digital signature to protect it against falsification.
  2. When the certificate is checked, the QR code is scanned and the signature verified.
  3. Each issuing body (e.g. a hospital, a test centre, a health authority) has its own digital signature key. All of these are stored in a secure database in each country.
  4. The European Commission has built a gateway through which all certificate signatures can be verified across the EU. The personal data of the certificate holder does not pass through the gateway, as this is not necessary to verify the digital signature. The European Commission also helped Member States to develop national software and apps to issue, store and verify certificates and supported them in the necessary tests to on-board the gateway.

Source

The specifications have all been published on github

Improve this answer
3
  • 4
    Recommend that this is made the accepted answer.
    – Flyto
    Sep 17, 2021 at 16:43
  • And all I did was quote the official explanation…
    – Krist van Besien
    Sep 18, 2021 at 5:58
  • 1
    The QR code contains a base45 encoded string that is zlib-compressed. When decompresed, the result is a CBOR Web Token structure. This structure contains all relevant data. The application, which is regularly updated, will check the digital signature (thus works offline). (The process is described in the gibhub link provided in this answer)
    – Mark Johnson
    Oct 14, 2021 at 13:31
34

Given that the check also works offline (just tested it myself with the CovPass Check app), there cannot be any requests to any server. However, what the QR code includes, is data about the person (name and date of birth), as well as the information if the vaccination is complete (at least for the digital certificate issued in Germany). That data is most likely signed with a private key from the issuer, and this signature can then be validated with a public key, that's part of the check app. This process doesn't require any internet connection (the process of creating the QR code requires it, since it has to be generated by the holder of the private key).

Improve this answer
16
  • 6
    Had the same experience with another national app some time ago. It does check a server regularly, possibly to update/add/revoke public keys. I haven't investigated this further.
    – Relaxed
    Sep 16, 2021 at 16:34
  • 7
    I’d also note that online checks would be a massive privacy breach as they would let the government track your movements using check in data.
    – JonathanReez ♦
    Sep 16, 2021 at 16:57
  • 14
    @JonathanReez The "massive privacy breach" is simply called a smartphone. And many people use it to save and display the mentioned QR code.
    – Eric Duminil
    Sep 17, 2021 at 0:47
  • 3
    @JonathanReez well, many governments already require everyone to leave their personal data everywhere they go (restaurants, hairdressers, etc.) in order to "track infections". So privacy has already been abolished, independently of whether the EU DCC gets checked online or offline...
    – wimi
    Sep 17, 2021 at 7:18
  • 4
    @wimi But this is generally in the form of a handwritten entry on a piece of paper that will not normally be used.
    – Robin Salih
    Sep 17, 2021 at 12:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .