# Privacy-Preserving Solution for European Union Digital Vaccine Certificates
## 2 Related Work  
There exist several proposals for the COVID-19 Pass, COVID-19 Certificates, or the Green Pass. Recently, [PERSON] et al. [2], [PERSON] et al. [3], and [PERSON] et al. [4] surveyed proposals and works focused on COVID-19 digital certificates. In this section, we firstly present well-known deployed solutions; then, we present privacy-preserving proposals and concepts that are relevant to our scheme. In 2021, the EU worked on uniforming documents on COVID-19 vaccinations, completed tests, and suffered disease to facilitate and make the proof of these facts in Europe efficient. The created system was called EU Digital COVID Certificates (DCC). This system was gradually adopted in several European countries [5]. In order to enhance the user experience for presenting and verifying the certificate, several countries, including the Czech Republic, developed dedicated smartphone applications. The applications are developed and managed by each EU member state independently, but they are compatible with each other due to unified rules on how to generate the certificates. For instance, the cTecka and Tekka [6] applications are considered the official applications of the digital Czech COVID-19 certificate. This application is available free of charge for both Android and iOS mobile platforms. The certificate compliance can be demonstrated through either a QR code or the raw data. Therefore, the app is used to show either a valid test, vaccination,or recent illness. In order for the system to function, there must be a central authority (i.e., EU), and so-called EU gateways must be operated in individual countries, mediating the mutual recognition of certificates. Therefore, a specific infrastructure and a defined chain of cryptographic trust are necessary for the system to function. All participating countries are required to adhere to the central technical specifications, but at the same time, they also have the flexibility to incorporate nationally defined rules, e.g., duration of recognition of the validity of Polymerase Chain Reaction (PCR) or antigen tests. The data structure presented by the QR code contains the following information: (1) Name and surname of the given person (in the format according to the national alphabet and also separately without diacritics or other characters of the national alphabet), (2) Date of birth, (3) Vaccination-related data (vaccine used, number of vaccinations, date of last vaccination, member state, issuer, certificate identifier, and validity of vaccination according to national rules), or relevant data regarding tests or the disease experienced, and (4) Certificate signature (seal) to verify the authenticity of the given certificate. Everything stored in a QR code is in the JavaScript Object Notation (JSON) format, as prescribed by the relevant [7] specification. Recently, [PERSON] [8] discussed the contradiction between privacy and unforgeability properties in EU Digital COVID Certificates (DCC). He concludes that DCCs could be more privacy-preserving than various blockchain-based vaccine passport solutions. Nevertheless, the privacy of DCCs could be improved by minimizing identifiers, abandoning transaction authentication numbers, and solving the unlinkability problem. On the other hand, maintaining unforgeability is impossible without revealing some personal data. The IBM Digital Health Pass (IDHP) [1] is IBM's solution for authentication using COVID-19 vaccination certificates or test results. It is a complex system combining testing and vaccination into one unit using blockchain technology. The IDHP system includes the entire process, spanning from authorizing issuers and establishing the format of individual health certificates, to the issuance of certificates and their subsequent verification. The user end can be imagined as a certain form of digital wallet, wherein the user has his health data stored. This gives the user a degree of control over their sensitive health data.