Privacy-Preserving Digital Vaccine Passport

Thai Duong (1) , Jiahui Gao (2) , Duong Hieu Phan (3, 4) , Ni Trieu (2)

1 Google Inc [Mountain View]
2 ASU - Arizona State University [Tempe]
3 C2 - Cybersécurité et Cryptographie
4 INFRES - Département Informatique et Réseaux

The global lockdown imposed during the Covid-19 pandemic has resulted in significant social and economic challenges. In an effort to reopen economies and simultaneously control the spread of the disease, the implementation of contact tracing and digital vaccine passport technologies has been introduced. While contact tracing methods have been extensively studied and scrutinized for security concerns through numerous publications, vaccine passports have not received the same level of attention in terms of defining the problems they address, establishing security requirements, or developing efficient systems. Many of the existing methods employed currently suffer from privacy issues. This work introduces PPass, an advanced digital vaccine passport system that prioritizes user privacy. We begin by outlining the essential security requirements for an ideal vaccine passport system. To address these requirements, we present two efficient constructions that enable PPass to function effectively across various environments while upholding user privacy. By estimating its performance, we demonstrate the practical feasibility of PPass. Our findings suggest that PPass can efficiently verify a passenger's vaccine passport in just 7 milliseconds, with a modest bandwidth requirement of 480KB.

Domains: Cryptography and Security [cs.CR]

Thai Duong, Jiahui Gao, Duong Hieu Phan, Ni Trieu. Privacy-Preserving Digital Vaccine Passport. CANS 2023 - The 22nd International Conference on Cryptology and Network Security, Oct 2023, Augusta, United States. pp.137-161, ⟨10.1007/978-981-99-7563-1_7⟩. ⟨hal-04276497⟩