cybersecurity

We already have zero knowledge proof in Germany, but nearly no one uses it.

Our ID cards have an embedded private key.

The theoretical flow is (very simplified of course)

1. Webseite sends challenge to a locally running app
2. App request the ID card (NFC, you can use your mobile phone as a reader)
3. Reader asks for pin
4. Requested information from website are show (for example pseudonym id, full data, age verification onlz, so older 18 or older 21)
5. You acknowledge this
6. Signed message with requested information is send back to server
7. Server verifies signature with official key servers of the federal authority for our ID cards.

Works, secure and save.

But, because of privacy concerns, many users did not activate this feature and, besides some government websites, nobody essentially accepts it.

Also, it is hard to explain that, despite the fact that your ID card acting as the private key, your signature is anonymous if you don't explicitly allow the websites to see your data