Download (PDF, 589 KB, Datei ist nicht barrierefrei

EVoCAtIon MAnAGEMEnt
the eID server and application server when transmitted via a
public network.
6. Revocation management in the new
German identity card
to prevent abuse of stolen or lost identity cards, the card
holder must be able to block or cancel them via revocation
management [Bender 2010].
Currently, chip cards, e.g. cards for the qualified electronic
signature, are cancelled by means of a chip-specific public
key that can be compared with a revocation list – in other
words, a global, chip-specific feature. however, a chipspecific
feature is always person-related, as it uniquely
identifies the chip and consequently the card holder.
such a mechanism would thus undermine the data
protection-friendly design of the eID function, in which only
those data from the chip are transmitted that are necessary
for the service. For example, an online service that only
requires proof of age for age-restricted services must not be
able to use a unique revocation attribute to cross-reference
these data with a service that receives name, address and
similar data from the identify document (this is particularly
important for the pseudonym).
one solution to this conflict is to use service-specific revocation
lists, i.e. every identity card transmits a service- and
card-specific revocation attribute to the service provider
during the electronic identification process, which the provider
then checks against his individual, i.e. service-specific
revocation list.
For each service that uses the eID function of the new identity
card, a service-specific revocation list is generated from a
global revocation list. A service- and card-specific attribute
sent to the service provider from the chip of the identity card
during the eID function can then be compared with a specific
revocation list in order to identify cancelled IDs.
the use of service- and card-specific revocation attributes
ensures that service providers cannot exploit these to
recognize identity documents across services. this applies
analogously for the revocation service: this central authority
is unable to derive the service- and card-specific revocation
attributes from the revocation key without the assistance of
the service providers and the authorization CAs – it is not possible
to trace identity cards via the revocation mechanism.
the use of revocation passwords and checksums also promotes
data protection.
Revocation management
Overview
Lost and stolen list
ID card authority
Revocation
password for entry
in register of IDs Hotline
Berechtigungs-CA
Berechtigungs-CA
Authorization CA
Dienstanbieter
Dienstanbieter
Service provider
rEVoCAtIon MAnAGEMEnt
20 21
Police
Loss reported
Revocation
initiated
Loss reported
Revocation
initiated
Citizen
Revocation initiated
with revocation password
Revocation password
in PIN letter
ID manufacturer
Revocation initiated
with revocation checksum
General revocation list
Service provicer-specific revocation list
eID revocation service