# Privacy-Preserving Solution for European Union Digital Vaccine Certificates
## 3 Identified Security and Privacy Issues of EU Digital COVID-19 Certificates  
In this section, we present the most relevant security and privacy issues related to the implementation of EU DCCs, with a specific focus on the presentation of certificates through smartphone apps. Since there are several smartphone applications with equivalent characteristics, we use Czech Tecka [6] as a reference. In this application, the following issues can be identified:  
* **Ineffective certificate holder identification:*
* The first issue of the EU DCC is the insufficient identification of the certificate holder. Although the certificate contains information about the holder such as name, date of birth, and nationality, it is not possible to verify and bind this information to the holder of the certificate without the presentation of additional identity documents, such as a national identity card, passport, or other similar documents according with the regulations of the respective state. These documents contain a photo of the holder, enabling their binding with the certificate holder. The problem arises when the verifying person lacks the authority to request these additional documents from the person being verified or this person refuses to provide such documents, is not capable of doing so, or does not possess them. Without this step, the binding of the presented certificate to the given person is not verified, and the meaning of the entire control process is not achieved. Consequently, nothing prevents multiple people from using a single certificate. _Solution:__Include a photo of the certificate holder in the digital vaccination certificate._
* **High violation of user privacy:*
* The second issue of the EU DCCs is the high violation of user privacy by revealing much personal information about the user. As part of the non-infectivity or completed vaccination verification phase, the user has to present a complete vaccination certificate in the form of a QR code to a verifier. Therefore, a large amount of sensitive information about the user is revealed to the verifier. The verifying person not only gets basic information about non-infectivity or completed vaccinations, but also lots of other sensitive information such as name, surname, date of birth, nationality, or applied vaccination type. Moreover, the verifier may even take pictures of the QR codes, which implies that they do not only verify the validity of the certificate but also handle and store the personal data of all entering persons. In several situations, it is not necessary to disclose all of this information. Leaving aside the matter of binding the certificate to a specific person, the only relevant information is whether the user has a valid certificate or not. _Solution:__Disclose only the necessary information from the certificate. Keep the rest of the information hidden from the verifier._
* **Impersonation, alienation, or misuse of certificates:*
* The third issue of the EU DCCs is that QR codes only include static data about the certificate holder and vaccination details. There is no interactive cryptographic protocol used in order to prevent replay attacks. Therefore, an eavesdropper or anyone with access to the QR code can easily load the certificate onto one's own smartphone application, and the given certificate can be presented as their own. In fact, in some businesses, staff take pictures of the QR codes under the pretense that they will verify the QR code later or as evidence that they conducted the verification process. _Solution:__Implement an interactive cryptographic protocol (i.e., a challenge-response protocol) and integrate the user's secret keys to the certificate verification phase._
* **Missing revocation mechanisms:*
* The fourth issue of the EU DCCs is the absence of a certificate revocation mechanism. No certificate revocation list is used in smartphone applications and throughout the EU DCC system.