You can go to something called multi-party computations where you have more powerful tools, but also more requirements on those online and number of shares. Typically those proofs are if no more than half of the parties collude and so on.

In multi-party computations, if you go one step further in complexity, zero knowledge proofs are crypto-magic, but low-level crypto-magic.

Sounds good to me.

If you don’t find technological solution to uncloneability, then people will get creative and find something.

In the Netherlands, we have seen people getting very creative so they had to test to entry or show status to entry. The first thing was a static QR code. Of course, this was cloned. People take the photos. Then, they made a slightly animated one. In the middle of ...

In the Netherlands, for instance, we use it also for online registrations. Then, it’s not the bouncer with a tablet, but it’s a website. You want to offer something online which has age requirement or something, then you can also authenticate with this.

We understand. Well, we tried to get a foot in the door before some changes, but it’s moving very, very fast. We still think it’s better to do something now than not. It’s a nice feature.

If you have a twin and you’re really close, you might still give them everything you own. You’re sharing a mother so you might as well share a bank account. You wouldn’t do this with some random person.

In that sense it’s something where we feel it might actually be something worth adopting for the government at a bigger scale. The nice benefit is that if you have multiple things that are qualified, then the threshold to give somebody…

I think that vaccine passports are a good application. I also know that Taiwan has been for many years doing lots of digital. Like back in 2003, you already have a digital citizen card when other countries were, not pen and paper, but not classified as…

If I would clone the entire hard drive of my phone, find the app and get that piece of storage and put it somewhere else, they could impersonate me on other things as well.

Already in the Netherlands, it’s now used for enough things that there is the barrier. I might be OK (I’m not, but I might be OK as a stupid human) to give somebody else my vaccine passport. I would not be OK giving the same person authority over my bank ...

Certainly not in the demo that we built here. This thing becomes more powerful if IRMA is used for more things.

Yes. You only get half of the key. Your phone only holds to half the key. The other key part is on the key-share server.

That could mean that whoever is interacting with you sees the same transcript with you today and on a different date. They know it’s the same person.

The idea here is, no, neither party is offline. That’s necessary because else, you could link sessions. If either side would be static, then you would be presenting the same information today as you would at other points.

Even though I don’t want to live in Nijmegen, I could get a statement from Nijmegen because they have agreed to issue things. That’s depends on the authority and the competencies of what they’re allowed to issue.

Nijmegen is also allowed to issue also for people living in Eindhoven where our university is. That’s what this thing means.

One step further would be Taiwan, Taipei’s Pass using it, but then Taiwan also starts using it even though you can only get it digitally issued from Taipei, but they will accept the Taipei issues.

In the Netherlands. I’ve been advocating for years, have been running events, and so on to make people more sensitive to those issues. Their feeling is that the government and companies are trustworthy. In all the polls, it’s typically at the bottom-end of Europe when it comes to feelings of ...

One of the things I appreciate about Taiwan is that people have a good sense of security and privacy. I understand it comes for a reason, that you have some big neighbor next to you which constantly reminds you that yes, you better be careful with information.

Yes, we understand selling something which is defending the privacy is often a little bit more cumbersome. For instance, you need varying QR codes. If you have static QR codes, you’re suddenly lumping people together on their shared information. That is the question of how much value you can put ...

Not because it integrates with Bluetooth, the IRMA app doesn’t need the Bluetooth part, but because the Play Store say anything that has to do with COVID has to come through the CDCs. That was the story for there.

In the Netherlands, as you actually said, the IRMA people tried to push forward and in this case, it would have been them uploading. That’s when they went into the road of not being authorized.

The cryptography behind it is strong enough that we don’t need a time out. [laughs]

This is about how it’s being used. I think Audrey, what you were asking is whether the session expires. Actually, the same QR code if it’s not being used can just stay there until the next person.

At that point, you know which ones they want to see and it will only tell about those credentials.

The tablet will display the big check that it’s OK.

Exactly, right. The bouncer at the bar but it’s not posting it’s an interactive barcode.

Still working on it.

Also, note that when we did the trial run, we couldn’t read the phone until we did the full screen.