A look inside the European Covid Green Certificate (Codemotion 2021)

A look inside the
European Covid Green Certiﬁcate
Luciano Mammino ( )
@loige
2021-12-01
loige.link/green
1

Get these slides!
loige
loige.link/green
2

Let me introduce myself ﬁrst...
3

👋I'm Luciano ( 🍕🍝 )
3

Senior Architect @ fourTheorem (Dublin )
3

nodejsdp.link
📔Co-Author of Node.js Design Patterns 👉
3

nodejsdp.link
📔Co-Author of Node.js Design Patterns 👉
Let's connect!
(blog)
(twitter)
(twitch)
(github)
loige.co
@loige
loige
lmammino
3

We are business focused technologists that
deliver.
| |
Accelerated Serverless AI as a Service Platform Modernisation
We are hiring: do you want to ?
work with us
loige 4

Disclaimers
loige
🤓I am not involved with the DGC working group

5

Disclaimers
loige
🤓I am not involved with the DGC working group

😢COVID has been tough on everyone,
we'll try to focus only on the tech here!
5

Agenda + Goals
loige
1. Needs and principles
2. 🗝Cryptographic model
3. 📦The data
4. 🧅Layers of encoding
5. 🛠Decoding in Rust
6

Agenda + Goals
loige
1. Needs and principles
2. 🗝Cryptographic model
3. 📦The data
4. 🧅Layers of encoding
5. 🛠Decoding in Rust
🤨Learn some cool technologies
🧐Learn a tiny bit of Rust
🤓Be nerdy and have fun!
6

The need for a digital certiﬁcate in
the COVID age
loige 7

the COVID age
loige 8

the COVID age
loige
😷We need a system to quickly provide a proof against COVID
(Vaccination, negative test, proof of recovery)
8

the COVID age
loige
It needs to be personal, easy to carry around (digital),
easy to issue and to validate
8

the COVID age
loige
It needs to be personal, easy to carry around (digital),
easy to issue and to validate
🌎It needs to be secure against forgery and work across countries
8

The EU Covid Green Pass
a.k.a.
Electronic Health Certiﬁcates
(HCERT)

loige.link/hcert-spec
loige 9

Electronic Health Certiﬁcates (HCERT)
Requirements & Guiding Principles
loige 10

loige
✍Signed data with machine readable content
10

loige
📃Use compact encoding
10

loige
📃Use compact encoding
🤲Based on open standards
10

Asymmetric cryptographic signatures
loige 11

loige
🤫Private Key
101010101000101010010...
11

loige
🤫Private Key 📢Public Key
101010101000101010010... 0101010101010101010101...
11

loige
🔗
101010101000101010010... 0101010101010101010101...
11

loige
101010101000101010010... 0101010101010101010101...
12

loige
101010101000101010010... 0101010101010101010101...
The owner of the private
key signs the document
12

loige
101010101000101010010... 0101010101010101010101...
The owner of the private
key signs the document
Anyone can validate the
signature using the public
key
12

What's inside a certiﬁcate?
loige 13

loige
Cryptographic header (Key Id, Algorithm)
13

loige
DGC container
13

loige
DGC container
Cryptographic Signature
13

loige
DGC container
Header (Issuer, Issue date, expiry date)
13

loige
DGC container
13
Certiﬁcates list
Personal data (name, surname, DoB)

loige
DGC container
13
Certiﬁcates list
vaccine, test, or recovery data
Personal data (name, surname, DoB)

An example
loige loige.link/green-examples 14

An example

{
"1": "DK",
"4": 1625054000,
"6": 1622462000,
"-260": {
"ver":"1.0.0",
"nam":{
"fn":"Klaus",
"fnt":"KLAUS",
"gn":"Jørgensen",
"gnt":"JOERGENSEN"
},
"dob":"1983-01-06",
"v":[
{
"tg":"840539006",
"vp":"1119349007",
"mp":"EU/1/20/1528",
"ma":"ORG-100030215",
"dn":2,
"sd":2,
"dt":"2021-05-03",
"co":"DK",
"is":"Danish Health Data Authority",
"ci":"URN:UVCI:01:DK:B986830007345F99AE898FB82C6C61F2#A"
}
]
}
}
An example

{
"1": "DK",
"4": 1625054000,
"6": 1622462000,
"-260": {
"ver":"1.0.0",
"nam":{
"fn":"Klaus",
"fnt":"KLAUS",
"gn":"Jørgensen",
"gnt":"JOERGENSEN"
},
"dob":"1983-01-06",
"v":[
{
"tg":"840539006",
"vp":"1119349007",
"mp":"EU/1/20/1528",
"ma":"ORG-100030215",
"dn":2,
"sd":2,
"dt":"2021-05-03",
"co":"DK",
}
]
}
}
An example
loige loige.link/green-examples
DGC Header
15

{
"1": "DK",
"4": 1625054000,
"6": 1622462000,
"-260": {
"ver":"1.0.0",
"nam":{
"fn":"Klaus",
"fnt":"KLAUS",
"gn":"Jørgensen",
"gnt":"JOERGENSEN"
},
"dob":"1983-01-06",
"v":[
{
"tg":"840539006",
"vp":"1119349007",
"mp":"EU/1/20/1528",
"ma":"ORG-100030215",
"dn":2,
"sd":2,
"dt":"2021-05-03",
"co":"DK",
}
]
}
}
An example
Personal info
DGC Header
15

{
"1": "DK",
"4": 1625054000,
"6": 1622462000,
"-260": {
"ver":"1.0.0",
"nam":{
"fn":"Klaus",
"fnt":"KLAUS",
"gn":"Jørgensen",
"gnt":"JOERGENSEN"
},
"dob":"1983-01-06",
"v":[
{
"tg":"840539006",
"vp":"1119349007",
"mp":"EU/1/20/1528",
"ma":"ORG-100030215",
"dn":2,
"sd":2,
"dt":"2021-05-03",
"co":"DK",
}
]
}
}
An example
Personal info
Vaccine info
DGC Header
15

Layered
encoding
loige 16
🧅

Layered
encoding
loige
QRCODE ASCII mode
16
🧅

Layered
encoding
loige
QRCODE ASCII mode
Preﬁx + Base45 encoding
16
🧅

Layered
encoding
loige
QRCODE ASCII mode
Zlib compression
16
🧅

Layered
encoding
loige
QRCODE ASCII mode
Zlib compression
CWT signed data (COSE)
16
🧅

Layered
encoding
loige
QRCODE ASCII mode
Zlib compression
CWT signed data (COSE)
CBOR document
16
🧅

loige
HC1:NCFOXN%TSMAHN-H9QCGDSB5QPN9OO3:D4$X4-36
5KN-TMLV4.P7*ZOP-IMJTI94F/8X*G3M9JUPY0BZW4Z
*AK.GNNVR*G0C7PHBO335KN/NBEDBVBJ623323EAJ7U
J5PNDIB6PNS7B1DN%BBWC7WC7GB3683ML7SZ4ZI00T9
UKPSH9WC5PF6846A$Q 76QW6A/98T5WBI$E9$UPV3Q.
GUQ$9WC5R7ACB97C968ELZ5$DP6PP5IL*PP:+P*.1D9
R8Q02-DE%QHOJ+PB/VSQOL9DLKWCZ3EBKDYGIZ J$XI
4OIMEDTJCJKDLEDL9CZTAKBI/8D:8DKTDL+SQ05.$S6
ZC0JBY63-C3F+LBQ99Q9E$BDZIA9JJ-JS7BYZJ92KG0
TB9FNDA5KD9FED.B4JB3E9B9NNPCV9E6LFSD9C8J-QD
SWNG4C-TLNKE$JDVPLW1KD0KCZGBKQCJE%RH5WAMSSR
$F-75NXONQ84QV9/7/-LT1AIYBZGD$9RCLV-PTZ-K63
ET-D1757H3GF9MV2N7WNQSY1SBZT-:81JJLHFQ-VG$H
K00XWPD2
QRCode content
17

loige
K00XWPD2
QRCode content "HC1:" (preﬁx)
17

loige
K00XWPD2
QRCode content "HC1:" (preﬁx)
Binary data encoded in
Base45
17

loige
Allows to encode binary data in text format (ASCII)
Base45
19

loige
Like Base64, but it uses 45 characters instead:
Base45
19

loige
Like Base64, but it uses 45 characters instead:
loige.link/base45-explained
Base45
19

Base45
loige
01001001 00100000 01100111
01101111 01110100 00100000
01101101 01111001 00100000
01110011 01101000 01101111
01110100 01110011 00100000
11011000 00111101
Some binary data
20

Base45
loige
01001001 00100000 01100111
01101111 01110100 00100000
01101101 01111001 00100000
01110011 01101000 01101111
01110100 01110011 00100000
11011000 00111101
UTF8 (17 bytes)
I got my shots 💉
Some binary data
20

Base45
loige
01001001 00100000 01100111
01101111 01110100 00100000
01101101 01111001 00100000
01110011 01101000 01101111
01110100 01110011 00100000
11011000 00111101
UTF8 (17 bytes)
I got my shots 💉
Hex (38 bytes)
49 20 67 6f 74 20 6d 79 20 73 68
6f 74 73 20 f0 9f 92 89
Some binary data
20

Base45
loige
01001001 00100000 01100111
01101111 01110100 00100000
01101101 01111001 00100000
01110011 01101000 01101111
01110100 01110011 00100000
11011000 00111101
UTF8 (17 bytes)
I got my shots 💉
Hex (38 bytes)
49 20 67 6f 74 20 6d 79 20 73 68
6f 74 73 20 f0 9f 92 89
Base64 (28 bytes)
SSBnb3QgbXkgc2hvdHMg8J+SiQ==
Some binary data
20

Base45
loige
01001001 00100000 01100111
01101111 01110100 00100000
01101101 01111001 00100000
01110011 01101000 01101111
01110100 01110011 00100000
11011000 00111101
UTF8 (17 bytes)
I got my shots 💉
Hex (38 bytes)
49 20 67 6f 74 20 6d 79 20 73 68
6f 74 73 20 f0 9f 92 89
Base64 (28 bytes)
SSBnb3QgbXkgc2hvdHMg8J+SiQ==
Base45 (29 bytes)
0B9J3DSUEZ$DR4459DLWEH74Z7K23
Some binary data
20

loige
loige.link/base45-rfc
"A QR-code is used to encode text as a graphical image. [...] QR-codes
cannot be used to encode arbitrary binary data directly. [...] Compared
to already established Base64, Base32 and Base16 encoding schemes
[...], the Base45 scheme described in this document offer a more
compact QR-code encoding"
Base45
21

loige
Base45
NCFOXN%TSMAHN-H9QCGDSB5QPN9OO3:D4$X4-365KN-
TMLV4.P7*ZOP-IMJTI94F/8X*G3M9JUPY0BZW4Z*AK.
GNNVR*G0C7PHBO335KN/NBEDBVBJ623323EAJ7UJ5PN
DIB6PNS7B1DN%BBWC7WC7GB3683ML7SZ4ZI00T9UKPS
H9WC5PF6846A$Q 76QW6A/98T5WBI$E9$UPV3Q.GUQ$
9WC5R7ACB97C968ELZ5$DP6PP5IL*PP:+P*.1D9R8Q0
2-DE%QHOJ+PB/VSQOL9DLKWCZ3EBKDYGIZ J$XI4OIM
EDTJCJKDLEDL9CZTAKBI/8D:8DKTDL+SQ05.$S6ZC0J
BY63-C3F+LBQ99Q9E$BDZIA9JJ-JS7BYZJ92KG0TB9F
NDA5KD9FED.B4JB3E9B9NNPCV9E6LFSD9C8J-QDSWNG
4C-TLNKE$JDVPLW1KD0KCZGBKQCJE%RH5WAMSSR$F-7
5NXONQ84QV9/7/-LT1AIYBZGD$9RCLV-PTZ-K63ET-D
1757H3GF9MV2N7WNQSY1SBZT-:81JJLHFQ-VG$HK00X
WPD2
22

loige
Base45
WPD2
Base45
Decode
22

loige
Base45
WPD2
Base45
Decode
Compressed binary data
22

Zlib compression
loige
"zlib is designed to be a free, general-purpose, legally
unencumbered -- that is, not covered by any patents -- lossless
data-compression library for use on virtually any computer
hardware and operating system"
zlib.net
24

Zlib compression
loige
25

Zlib compression
loige
Zlib inﬂate
25

Zlib compression
loige
Zlib inﬂate
Compressed binary data Decompressed binary data
25

Zlib compression
loige
👀We start to see
some "readable"
information!
26

COSE / CWT
loige
CBOR Object Signing and Encryption / CBOR Web Token
27

CBOR !? 🤔
loige
But wait, what the heck is
✋
28

CBOR
loige
TLDR; Like JSON but in binary!
loige.link/cbor-rfc
29

JSON
loige
A schema-less data format where a value can be:
Null
Boolean
Number
String
Array
Object
null
true
-17.34
"A programmer walks into a bar..."
["foo", 1.23, null, false, [22]]
{"foo": "bar", "manyvals": [1,2,3], "nested": {}}
30

CBOR
loige
A schema-less binary data format where a value can be:
Null
Boolean
Number
String Text
Array
Object Map
F6
F5
fbc031570a3d70a3d7
7820412070726f6772616d6d65722077616c6b7320696e746f2061206261722e2e2e
8563666f6ffb3ff3ae147ae147aef6f48116
a363666f6f63626172686d616e7976616c7383010203666e6573746564a0
31

CBOR
loige
It also supports:
Byte String (a sequence of raw bytes)
Tags (annotations that allow to create new types)
32

CBOR
loige
An example:
A3 63666F6F 63626172 686D616E7976616C73 83 01 02 03 666E6573746564 A0
33

CBOR
loige
An example:
A3 63666F6F 63626172 686D616E7976616C73 83 01 02 03 666E6573746564 A0
{
}
33

CBOR
loige
An example:
A3 63666F6F 63626172 686D616E7976616C73 83 01 02 03 666E6573746564 A0
{
"foo":
}
33

CBOR
loige
An example:
A3 63666F6F 63626172 686D616E7976616C73 83 01 02 03 666E6573746564 A0
{
"foo": "bar",
}
33

CBOR
loige
An example:
A3 63666F6F 63626172 686D616E7976616C73 83 01 02 03 666E6573746564 A0
{
"foo": "bar",
"manyvals":
}
33

CBOR
loige
An example:
A3 63666F6F 63626172 686D616E7976616C73 83 01 02 03 666E6573746564 A0
{
"foo": "bar",
"manyvals": [
}
],
33

CBOR
loige
An example:
A3 63666F6F 63626172 686D616E7976616C73 83 01 02 03 666E6573746564 A0
{
"foo": "bar",
"manyvals": [
}
],
1,
33

CBOR
loige
An example:
A3 63666F6F 63626172 686D616E7976616C73 83 01 02 03 666E6573746564 A0
{
"foo": "bar",
"manyvals": [
}
],
1, 2,
33

CBOR
loige
An example:
A3 63666F6F 63626172 686D616E7976616C73 83 01 02 03 666E6573746564 A0
{
"foo": "bar",
"manyvals": [
}
],
1, 2, 3
33

CBOR
loige
An example:
A3 63666F6F 63626172 686D616E7976616C73 83 01 02 03 666E6573746564 A0
{
"foo": "bar",
"manyvals": [
}
],
"nested":
1, 2, 3
33

CBOR
loige
An example:
A3 63666F6F 63626172 686D616E7976616C73 83 01 02 03 666E6573746564 A0
{
"foo": "bar",
"manyvals": [
}
],
"nested": {}
1, 2, 3
33

COSE / CWT
loige
CBOR Object Signing and Encryption / CBOR Web Token
ok... again 😅
34

COSE
loige
CBOR Object Signing and Encryption
35

COSE
loige
COSE (inspired by ) deﬁnes CBOR-based protocols for:
JOSE
35

COSE
loige
JOSE
Encrypted data
35

COSE
loige
JOSE
Encrypted data
Cryptographic signed data
35

COSE
loige
JOSE
Encrypted data
MACed data
35

COSE
loige
loige.link/cose-rfc
JOSE
Encrypted data
MACed data
35

CWT
loige
Like but for CBOR
JWT
CBOR Web Token
36

CWT
loige
Like but for CBOR
JWT
Deﬁnes a protocol for transferring claims between parties
CBOR Web Token
36

CWT
loige
Like but for CBOR
JWT
CBOR Web Token
Claims are digitally signed for authenticity
36

CWT
loige
Like but for CBOR
JWT
loige.link/cwt-rfc
CBOR Web Token
Claims are digitally signed for authenticity
36

CWT
loige
A CWT is made of 4 parts:
CBOR Web Token
37

CWT
loige
Protected header
CBOR Web Token
37

CWT
loige
Protected header
CBOR Web Token
Non protected header
37

CWT
loige
Protected header
CBOR Web Token
Payload
37

CWT
loige
Protected header
CBOR Web Token
Payload
Signature
37

CWT
loige
A CWT is encoded as a (tagged) CBOR array with 4 values:
Protected header (binary string)
CBOR Web Token
Non protected header (map)
Payload (binary string)
Signature (binary string)
38

loige
Array (length 4)
CWT tag
39

Protected
header
Binary String
loige
Array (length 4)
CWT tag
39

Protected
header
Binary String
loige
Array (length 4)
CWT tag
39
Unprotected header
Map (length 0)

Protected
header
Binary String
loige
Array (length 4)
CWT tag
39
Unprotected header
Map (length 0)
Payload
Binary String

Protected
header
Binary String
loige
Array (length 4)
CWT tag
39
Unprotected header
Map (length 0)
Payload
Binary String
Signature
Binary String

loige
CWT payload
Binary String follows (CBOR Encoded)
40

loige
CWT payload
{
"1": "DK",
"4": 1625054000,
"6": 1622462000,
"-260": {
"ver":"1.0.0",
"nam":{
"fn":"Klaus",
"fnt":"KLAUS",
"gn":"Jørgensen",
"gnt":"JOERGENSEN"
},
"dob":"1983-01-06",
"v":[
{
"tg":"840539006",
"vp":"1119349007",
"mp":"EU/1/20/1528",
"ma":"ORG-100030215",
"dn":2,
"sd":2,
"dt":"2021-05-03",
"co":"DK",
}
]
}
}
Binary String follows (CBOR Encoded)
CBOR decode
(to JSON)
40

How to decode - quick recap
loige 41

loige
1. Remove "HC1:" preﬁx
41

loige
2. Base45 decode
41

loige
2. Base45 decode
3. Zlib decompress
41

loige
2. Base45 decode
3. Zlib decompress
4. Parse CWT
41

loige
2. Base45 decode
3. Zlib decompress
4. Parse CWT
5. Parse CWT Payload as CBOR
41

loige
2. Base45 decode
3. Zlib decompress
4. Parse CWT
6. Party hard! 🥳
41

loige
2. Base45 decode
3. Zlib decompress
4. Parse CWT
6. Party hard! 🥳
Hey, let's implement this...
41

loige
2. Base45 decode
3. Zlib decompress
4. Parse CWT
6. Party hard! 🥳
Hey, let's implement this... in Rust!
41

loige
cargo new dgc-decode
Project bootstrap
42

// src/main.rs
fn main() {
let cert_data = "HC1:NCFOXN%TSMAHN-H9QCGDSB5QPN9OO3:D4$X4-365KN-TMLV4
todo!()
// 1. Remove "HC1:" prefix
// 2. Base45 decode
// 3. Zlib decompress
// 4. Parse CWT
// 5. Parse CWT Payload as CBOR
}
1
2
3
4
5
6
7
8
9
10
11
loige 43

// src/main.rs
fn main() {
todo!()
// 2. Base45 decode
// 4. Parse CWT
}
1
2
3
4
5
6
7
8
9
10
11
// src/main.rs
1
2
fn main() {
3
4
todo!()
5
6
// 2. Base45 decode
7
8
// 4. Parse CWT
9
10
}
11
loige 43

// src/main.rs
fn main() {
todo!()
// 2. Base45 decode
// 4. Parse CWT
}
1
2
3
4
5
6
7
8
9
10
11
// src/main.rs
1
2
fn main() {
3
4
todo!()
5
6
// 2. Base45 decode
7
8
// 4. Parse CWT
9
10
}
11
todo!()
// 2. Base45 decode
// 4. Parse CWT
// src/main.rs
1
2
fn main() {
3
4
5
6
7
8
9
10
}
11
loige 43

// src/main.rs
fn main() {
todo!()
// 2. Base45 decode
// 4. Parse CWT
}
1
2
3
4
5
6
7
8
9
10
11
// src/main.rs
1
2
fn main() {
3
4
todo!()
5
6
// 2. Base45 decode
7
8
// 4. Parse CWT
9
10
}
11
todo!()
// 2. Base45 decode
// 4. Parse CWT
// src/main.rs
1
2
fn main() {
3
4
5
6
7
8
9
10
}
11
// src/main.rs
fn main() {
todo!()
// 2. Base45 decode
// 4. Parse CWT
}
1
2
3
4
5
6
7
8
9
10
11
loige 43

fn main() {
let no_prefix = remove_prefix(cert_data);
todo!();
// 2. Base45 decode
// 4. Parse CWT
}
fn remove_prefix(data: &str) -> &str {
todo!()
// remove "HC1:" prefix and return remaining string
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
loige 44

fn main() {
todo!();
// 2. Base45 decode
// 4. Parse CWT
}
todo!()
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
fn main() {
1
2
3
todo!();
4
// 2. Base45 decode
5
6
// 4. Parse CWT
7
8
}
9
10
11
todo!()
12
13
}
14
loige 44

fn main() {
todo!();
// 2. Base45 decode
// 4. Parse CWT
}
todo!()
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
fn main() {
1
2
3
todo!();
4
// 2. Base45 decode
5
6
// 4. Parse CWT
7
8
}
9
10
11
todo!()
12
13
}
14
todo!()
}
fn main() {
1
2
3
todo!();
4
// 2. Base45 decode
5
6
// 4. Parse CWT
7
8
}
9
10
11
12
13
14
loige 44

fn main() {
todo!();
// 2. Base45 decode
// 4. Parse CWT
}
todo!()
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
fn main() {
1
2
3
todo!();
4
// 2. Base45 decode
5
6
// 4. Parse CWT
7
8
}
9
10
11
todo!()
12
13
}
14
todo!()
}
fn main() {
1
2
3
todo!();
4
// 2. Base45 decode
5
6
// 4. Parse CWT
7
8
}
9
10
11
12
13
14
fn main() {
todo!();
// 2. Base45 decode
// 4. Parse CWT
}
todo!()
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
loige 44

fn main() {
todo!();
// 2. Base45 decode
// 4. Parse CWT
}
if data.len() < 4 || !data.starts_with("HC1:") {
panic!("Invalid prefix"); // IRL use a Result!
}
&data[4..]
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
loige 45

fn main() {
todo!();
// 2. Base45 decode
// 4. Parse CWT
}
}
&data[4..]
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
}
&data[4..]
fn main() {
1
2
3
todo!();
4
// 2. Base45 decode
5
6
// 4. Parse CWT
7
8
}
9
10
11
12
13
14
15
16
}
17
loige 45

fn main() {
todo!();
// 2. Base45 decode
// 4. Parse CWT
}
}
&data[4..]
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
}
&data[4..]
fn main() {
1
2
3
todo!();
4
// 2. Base45 decode
5
6
// 4. Parse CWT
7
8
}
9
10
11
12
13
14
15
16
}
17
fn main() {
todo!();
// 2. Base45 decode
// 4. Parse CWT
}
}
&data[4..]
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
loige 45

fn main() {
let decoded = decode_base45(no_prefix);
todo!()
// 4. Parse CWT
}
fn decode_base45(data: &str) -> Vec<u8> {
todo!()
// parse the string as base45 encoded and return the
// resulting raw bytes
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
loige 46

fn main() {
todo!()
// 4. Parse CWT
}
todo!()
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
fn main() {
1
2
3
4
todo!()
5
6
// 4. Parse CWT
7
8
}
9
10
11
todo!()
12
13
14
}
15
16
// ...
17
loige 46

fn main() {
todo!()
// 4. Parse CWT
}
todo!()
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
fn main() {
1
2
3
4
todo!()
5
6
// 4. Parse CWT
7
8
}
9
10
11
todo!()
12
13
14
}
15
16
// ...
17
todo!()
}
fn main() {
1
2
3
4
todo!()
5
6
// 4. Parse CWT
7
8
}
9
10
11
12
13
14
15
16
// ...
17
loige 46

fn main() {
todo!()
// 4. Parse CWT
}
todo!()
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
fn main() {
1
2
3
4
todo!()
5
6
// 4. Parse CWT
7
8
}
9
10
11
todo!()
12
13
14
}
15
16
// ...
17
todo!()
}
fn main() {
1
2
3
4
todo!()
5
6
// 4. Parse CWT
7
8
}
9
10
11
12
13
14
15
16
// ...
17
fn main() {
todo!()
// 4. Parse CWT
}
todo!()
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
loige 46

loige
cargo add base45
# Cargo.toml
# ...
[dependencies]
base45 = "3.0.0"
47

fn main() {
todo!()
// 4. Parse CWT
}
base45::decode(data).unwrap() // IRL use a Result!
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
loige 48

fn main() {
todo!()
// 4. Parse CWT
}
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
fn main() {
1
2
3
4
todo!()
5
6
// 4. Parse CWT
7
8
}
9
10
11
12
}
13
14
// ...
15
loige 48

fn main() {
todo!()
// 4. Parse CWT
}
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
fn main() {
1
2
3
4
todo!()
5
6
// 4. Parse CWT
7
8
}
9
10
11
12
}
13
14
// ...
15
fn main() {
todo!()
// 4. Parse CWT
}
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
loige 48

fn main() {
let decompressed = decompress(decoded);
todo!()
// 4. Parse CWT
}
fn decompress(data: Vec<u8>) -> Vec<u8> {
todo!()
// decompress using zlib inflate
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
loige 49

fn main() {
todo!()
// 4. Parse CWT
}
todo!()
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
fn main() {
1
2
3
4
5
todo!()
6
// 4. Parse CWT
7
8
}
9
10
11
todo!()
12
13
}
14
15
// ...
16
loige 49

fn main() {
todo!()
// 4. Parse CWT
}
todo!()
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
fn main() {
1
2
3
4
5
todo!()
6
// 4. Parse CWT
7
8
}
9
10
11
todo!()
12
13
}
14
15
// ...
16
todo!()
}
fn main() {
1
2
3
4
5
todo!()
6
// 4. Parse CWT
7
8
}
9
10
11
12
13
14
15
// ...
16
loige 49

fn main() {
todo!()
// 4. Parse CWT
}
todo!()
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
fn main() {
1
2
3
4
5
todo!()
6
// 4. Parse CWT
7
8
}
9
10
11
todo!()
12
13
}
14
15
// ...
16
todo!()
}
fn main() {
1
2
3
4
5
todo!()
6
// 4. Parse CWT
7
8
}
9
10
11
12
13
14
15
// ...
16
fn main() {
todo!()
// 4. Parse CWT
}
todo!()
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
loige 49

loige
cargo add inflate
# Cargo.toml
# ...
[dependencies]
base45 = "3.0.0"
inflate = "0.4.5"
50

fn main() {
todo!()
// 4. Parse CWT
}
inflate::inflate_bytes_zlib(data.as_slice()).unwrap()
// IRL use a Result!
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
loige 51

fn main() {
todo!()
// 4. Parse CWT
}
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
fn main() {
1
2
3
4
5
todo!()
6
// 4. Parse CWT
7
8
}
9
10
11
12
13
}
14
15
// ...
16
loige 51

fn main() {
todo!()
// 4. Parse CWT
}
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
fn main() {
1
2
3
4
5
todo!()
6
// 4. Parse CWT
7
8
}
9
10
11
12
13
}
14
15
// ...
16
fn main() {
todo!()
// 4. Parse CWT
}
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
loige 51

Are we on the right track?
loige
fn main() {
println!("{}", String::from_utf8_lossy(&decompressed));
}
// ...
1
2
3
4
5
6
7
8
9
10
52

loige
fn main() {
}
// ...
1
2
3
4
5
6
7
8
9
10
fn main() {
1
2
3
4
5
6
7
}
8
9
// ...
10
52

loige 53

loige
We are starting to see some
readable info! 🤩 53

fn main() {
let cwt_payload = get_cwt_payload(decompressed);
todo!()
}
fn get_cwt_payload(data: Vec<u8>) -> Vec<u8> {
todo!()
// Parse raw bytes as CBOR.
// Extract and return the raw bytes representing
// the CWT payload
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
loige 54

fn main() {
todo!()
}
todo!()
// the CWT payload
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
fn main() {
1
2
3
4
5
6
todo!()
7
8
}
9
10
11
todo!()
12
13
14
// the CWT payload
15
}
16
17
// ...
18
loige 54

fn main() {
todo!()
}
todo!()
// the CWT payload
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
fn main() {
1
2
3
4
5
6
todo!()
7
8
}
9
10
11
todo!()
12
13
14
// the CWT payload
15
}
16
17
// ...
18
todo!()
// the CWT payload
}
fn main() {
1
2
3
4
5
6
todo!()
7
8
}
9
10
11
12
13
14
15
16
17
// ...
18
loige 54

fn main() {
todo!()
}
todo!()
// the CWT payload
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
fn main() {
1
2
3
4
5
6
todo!()
7
8
}
9
10
11
todo!()
12
13
14
// the CWT payload
15
}
16
17
// ...
18
todo!()
// the CWT payload
}
fn main() {
1
2
3
4
5
6
todo!()
7
8
}
9
10
11
12
13
14
15
16
17
// ...
18
fn main() {
todo!()
}
todo!()
// the CWT payload
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
loige 54

loige
cargo add ciborium
# Cargo.toml
# ...
[dependencies]
base45 = "3.0.0"
ciborium = "0.2.0"
inflate = "0.4.5"
55

use ciborium::{de::from_reader, value::Value};
fn main() {
todo!()
}
let parsed: Value = from_reader(data.as_slice()).unwrap();
println!("{:?}", parsed);
todo!()
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
loige 56

fn main() {
todo!()
}
todo!()
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
1
2
fn main() {
3
4
5
6
7
8
todo!()
9
10
}
11
12
13
14
15
todo!()
16
}
17
18
// ...
19
loige 56

fn main() {
todo!()
}
todo!()
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
1
2
fn main() {
3
4
5
6
7
8
todo!()
9
10
}
11
12
13
14
15
todo!()
16
}
17
18
// ...
19
1
2
fn main() {
3
4
5
6
7
8
todo!()
9
10
}
11
12
13
14
15
todo!()
16
}
17
18
// ...
19
loige 56

The content is an array
57
loige

// ...
// IRL avoid .unwrap() like hell and propagate errors correctly!
let (tag, arr) = parsed.as_tag().unwrap();
assert_eq!(tag, 18);
let arr = arr.as_array().unwrap();
let payload = arr[2].as_bytes().unwrap();
payload.clone()
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
loige 58

// ...
payload.clone()
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
// ...
1
2
3
4
5
6
7
8
9
payload.clone()
10
}
11
12
// ...
13
loige 58

// ...
payload.clone()
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
// ...
1
2
3
4
5
6
7
8
9
payload.clone()
10
}
11
12
// ...
13
// ...
1
2
3
4
5
6
7
8
9
payload.clone()
10
}
11
12
// ...
13
loige 58

// ...
payload.clone()
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
// ...
1
2
3
4
5
6
7
8
9
payload.clone()
10
}
11
12
// ...
13
// ...
1
2
3
4
5
6
7
8
9
payload.clone()
10
}
11
12
// ...
13
// ...
1
2
3
4
5
6
7
8
9
payload.clone()
10
}
11
12
// ...
13
loige 58

// ...
payload.clone()
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
// ...
1
2
3
4
5
6
7
8
9
payload.clone()
10
}
11
12
// ...
13
// ...
1
2
3
4
5
6
7
8
9
payload.clone()
10
}
11
12
// ...
13
// ...
1
2
3
4
5
6
7
8
9
payload.clone()
10
}
11
12
// ...
13
payload.clone()
// ...
1
2
3
4
5
6
7
8
9
10
}
11
12
// ...
13
loige 58

// ...
payload.clone()
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
// ...
1
2
3
4
5
6
7
8
9
payload.clone()
10
}
11
12
// ...
13
// ...
1
2
3
4
5
6
7
8
9
payload.clone()
10
}
11
12
// ...
13
// ...
1
2
3
4
5
6
7
8
9
payload.clone()
10
}
11
12
// ...
13
payload.clone()
// ...
1
2
3
4
5
6
7
8
9
10
}
11
12
// ...
13
// ...
payload.clone()
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
loige 58

fn main() {
let parsed_payload = parse_cwt_payload(cwt_payload);
}
fn parse_cwt_payload(data: Vec<u8>) -> Value {
// parse the binary data as CBOR
todo!()
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
loige 59

fn main() {
}
todo!()
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
1
2
fn main() {
3
4
5
6
7
8
9
}
10
11
12
13
todo!()
14
}
15
16
// ...
17
loige 59

fn main() {
}
todo!()
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
1
2
fn main() {
3
4
5
6
7
8
9
}
10
11
12
13
todo!()
14
}
15
16
// ...
17
todo!()
}
1
2
fn main() {
3
4
5
6
7
8
9
}
10
11
12
13
14
15
16
// ...
17
loige 59

fn main() {
println!("{:#?}", parsed_payload);
}
from_reader(data.as_slice()).unwrap()
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
loige 60

fn main() {
}
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
1
2
fn main() {
3
4
5
6
7
8
9
10
}
11
12
13
14
}
15
16
// ...
17
loige 60

fn main() {
}
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
1
2
fn main() {
3
4
5
6
7
8
9
10
}
11
12
13
14
}
15
16
// ...
17
1
2
fn main() {
3
4
5
6
7
8
9
10
}
11
12
13
14
}
15
16
// ...
17
loige 60

fn main() {
}
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
1
2
fn main() {
3
4
5
6
7
8
9
10
}
11
12
13
14
}
15
16
// ...
17
1
2
fn main() {
3
4
5
6
7
8
9
10
}
11
12
13
14
}
15
16
// ...
17
fn main() {
}
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
loige 60

Ok, let's make it more readable... 😅
loige 62

Ok, let's make it more readable... 😅
loige
cargo add serde_json
62

use serde_json::to_string_pretty;
fn main() {
println!("{}", to_string_pretty(&parsed_payload).unwrap());
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
loige 63

fn main() {
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
1
2
3
fn main() {
4
5
6
7
8
9
10
11
}
12
13
// ...
14
loige 63

fn main() {
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
1
2
3
fn main() {
4
5
6
7
8
9
10
11
}
12
13
// ...
14
1
2
3
fn main() {
4
5
6
7
8
9
10
11
}
12
13
// ...
14
loige 63

fn main() {
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
1
2
3
fn main() {
4
5
6
7
8
9
10
11
}
12
13
// ...
14
1
2
3
fn main() {
4
5
6
7
8
9
10
11
}
12
13
// ...
14
fn main() {
}
// ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
loige 63

All the code:
loige.link/green-code
loige 65

A better (& more complete) implementation
as a Rust library
loige
github.com/rust-italia/dgc
66

Exercise for the viewer:
Try to validate the signature
loige 67

loige
🔑You can get the Public Key from the certiﬁcate
here: loige.link/green-examples
67

loige
📑Here you can ﬁnd more about how the CoseSign1
protocol works: loige.link/cose-sign-verif
67

loige
📦You could use a crate like for crypto!
ring
67

loige
📦You could use a crate like for crypto!
ring
(Spoiler: I implemented some of this stuff in my library!)
67

Is all this stuﬀ legal? 😰
loige 68

loige
👀You can certainly look into your certiﬁcate (and the
test certiﬁcates!)
68

loige
🗣Looking into other people's certiﬁcate will disclose
a lot of privacy-sensitive info (thread carefully)
68

loige
🗣Looking into other people's certiﬁcate will disclose
a lot of privacy-sensitive info (thread carefully)
📲Building a validator app? Check your country's
regulation (especially if you need to store data!)
68

Cover Picture by on
❤ Huge thanks to for some precius review sessions and many pull requests!
❤ Thanks to , , , , for reviews and suggestions.
FPVmat A Unsplash
rust-italia
@gbinside @88_eugen @AlleviTommaso @npmccallum @pelger
loige
☝nodejsdp.link
loige.link/green
THANK YOU!
❤
69

A look inside the European Covid Green Certificate (Codemotion 2021)

Recomendados

Recomendados

Más contenido relacionado

Similar a A look inside the European Covid Green Certificate (Codemotion 2021)

Similar a A look inside the European Covid Green Certificate (Codemotion 2021) (20)

Más de Luciano Mammino

Más de Luciano Mammino (20)

Último

Último (20)

A look inside the European Covid Green Certificate (Codemotion 2021)