Belgian EID Card 15/12/2004 Derette Willy eID program manager

2 Agenda  Role of Steria in the project  Actual status of the Roll out o Different actors o Global planning  The Belpic Project  Use of the eID card  Contents of the EID Card  The trusted CA Hierarchy  The Trusted Services  Mutual Authentication SSL V3  Realisations – How to Use – Quick Scan

3 Managed Services 50% Systems Integration 50% Core businessesMarkets Public Government 30% Manufacturing Utilities Transport 30% Banking & Insurance 25% Telecom 15% Consulting 10% Identity Card of Steria 8400 employees of which 230 in Belux 987 M € revenue (2003) of which 36 M€ in Belux Belux: Public: 48%, Industry: 25 % Finance: 27 % Belux: MS: 34 % ; SI: 60% ; C: 6 %

4 BELPIC project: role of Steria Design of architecture (central and local) Software Development modifications on mainframe new application servers PC’s in the municipalities Infrastructure delivery (central and local) Project management

5 Card & CA setupPilot (11) GO roll out RA/Infrastrucutre 2002 Jan …… Dec 2003 Jan … Jun … Dec 12/06 Jan 2004 … Mar … Jul Roll Out infrastructure Contract … 2005 Jan 7 months Prep.Site Surveys Installation & training T0 T0 + 2MT0 + 7M Operational fase T0 + 5Y T0 + 3M T0 + 5M ABC BELPIC project: actors / planning

6

7

8 BELPIC project Aim of Belpic-project Give Belgian citizens an electronic identity card enabling them to authenticate themselves towards diverse applications and to put digital signatures Chip contains the same information as printed on the card (name, first names, nationality, birth place and date, sex, validity of the card, photo, signature, identification number) filled up with: Certificates (signature, authentication) The main residence of the holder No other information on the card is allowed! Proof of identity & Signature tool No Encryption

9 Use of e-ID Customer identification (data capture) No errors Very fast (Complete) Identity information => Profiling Strong authentication Universal solution (advantage for the customer) SSO (Single sign on) => one authentication server “State of the art” (= Replacement of the token) / No pin mailers Signature Anywhere, anytime. Simplicity (  token) Non repudiation Encryption No encryption for the moment (foreseen at a later stage) Private key backup & archiving issue

10 ID ADR Photo PUK1/2 ADR = adres ID = Ident ) PH = hash photo Cert_Cit-Auth Cert_Cit-Sign Pin code     PUK1/3 BELPIC Contents of EID Card Cert_CA-Cit Cert_RRNAS Prik_Cit-Auth Prik_Cit-Sign PubK_CA-Role Private keysCertificates Public keys Prik_Base Pin Code Housekeeping Activate & Unblock eID identity data PuK_Base Role 7 WDe/2002 Cert_CA-Root S (ID+ADR+PH)

11 The trusted CA hierarchy Globalsign Top Root CA Selfsigned Belgium Root Signed Belgium Self Signed eID Citizen CA - Signature (1024 bits) - Cert_SAW-Enc - Authentication (1024 b) Government CAAdministration CAForthcoming CA - Cert_SAW-Sign - Cert_RRNAS - Cert_RRNDMZ - (Cert_XKMS) - Cert_Role-7? WDe/2002 Selfsigned eID

12 Trusted Services Registration Authentication Secure Sites Municipality OCSP Or CRL Certification Authority Citizens National Register Control & Registration Authentication & Signature Validation CRL Certificate Request 1 2

13 Digitally Signing a Message Hash Encryption Sender’s Private key Encrypted Hash Digital Signature Hash Algorithm Network Hash Algorithm Encrypted Hash = ? SenderReceiver Sender’s Public Key WDe/2002

14 Web Server User SSL v3 Mutual Authentication Connect to server (server name) Acknowledge presence Sending of challenge (RND) Server encrypts with its Private key Send back with Certificate chain Check cert. Validity & server name If OK notify server Server sends challenge Browser encrypts with private key Of authentication certificate (PIN code) Encrypted challenge +certificate chain (authent. Certificate only if chain NA) Server checks (OCSP-CRL) If ok notify user Agree on session key Browser generates key & encrypt with Pub. Key server. Sent to server. Secure Store Cert_Cit-Auth CertChain_Server

15 How using? Steria has developed modules / methods for Getting User Identity: Name, First Name, Gender, Birth date, Birth place, Nationality, National Register Number, Address, Photo. Authenticating Card Holder: Authentication with the authentication private key of the card holder. Signing Data: Signing data by the Card with the non-repudiation private key of the card holder. Applications Stand Alone Application Client/Server Application Light Client : Browser application PC Emulation to a central environment

16 Examples: Stand-alone application

17 How using?