Portugal also has a national ID card that's a smart card and includes a key. The last time I tried to use it in the justice ministry website it required accepting a self-signed HTTPS certificate. When I reported the issue I got a "oh, just accept it and it will be fine" response from a supposedly technical person.
So yeah, these things are getting deployed in some places but I'm not too hopeful it will end up being much more than a gimmick. At least I hope not because the next step on the minds of some of these "technical" people is electronic voting and that won't end well...
Italy started issuing smart cards around 2006. Some (not all, you need to request it and takes longer to have it) of the ID cards issued are electronic. They contain a RSA key pair and a X.509 certificate. There are some mandatory use cases, (eg: all documents or emails being transmitted to Governmental agencies must be digitally signed) and some optional ones (you can store fiscal documents as signed PDFs if you don't want to store them physically for ten years). Among regular citizens it has very little use. It has some quirks, but it's a step forward. To boost its usage, the EU should issue a standard and ask every country to adopt it.
And of course there's South Korea, where every financial transaction above a certain amount needs to be signed with an X.509 certificate. Back in the late 90s and early 00s, Korea was a pioneer in the public use of PKI.
But since no browser makes it easy to sign anything with a certificate stored on disk (or in a USB stick), this policy has led to serious dependence on ActiveX plugins (and therefore IE and Windows) that everyone has probably heard about.
Now the Koreans are trying to fix that, but since the government is just as boneheaded as ever, the officially mandated "cross-browser" solution is just a Windows binary that installs NPAPI and PPAPI plugins into every browser. Some variants even work on Linux, but only because they're implemented as Java applets.
PKI is cool in theory. In reality, it's hard to implement it in a way that is accessible to the general public.
In Kazakhstan it's achieved by using signed Java applet. It works well in Windows, OS X and Linux. In Linux there are some problems with smart card readers, but generally things work well. I don't like Java applets, but they are probably better than ActiveX.
There's similar problem in Kazakhstan. egov.kz is their e-government site. They issued their own root certificate and they use it to sign all users certificates. And they signed their SSL certificate with that certificate which causes it to show alarm.
Not very smart move if you ask me. If you teach users to ignore HTTPS errors, then MITM attack becomes easier because user don't see anything suspicious.
It's a dumb move from browser makers (self-signed certificates really shouldn't be the same kind of error as outright fraud). Maybe they can get the Kazakh root certificate incorporated into major browsers? But until then what other approach is possible to bootstrap it? There are obvious reasons the Kazakh government infrastructure wouldn't want to be dependent on e.g. Verisign.
It's a little unclear to me what the current status is: apparently it's valid for the National (Tax etc) Portal (altinn.no - literal translation: (hand)ineverything.no)). The basic idea was that the Postal service already allow the sending/delivery of registered letters -- so why not just use that for validating the ID. These days mail is largely handled by supermarkets -- and my impression is that the ID check isn't as reliable as it used to be when the postal service operated as a government monopoly.
Anyway, AFAIK, it's still the closest thing we have to working, secure digital ID in Norway.
> Portugal also has a national ID card that's a smart card and includes a key.
German ones do something similar since late 2010. The card can be used for online authentication and eletronic signatures (requires certificate that is separately available).
> Portugal also has a national ID card that's a smart card and includes a key.
So does Finland (since 2004).
But under 10% of the population has such a card (most people use drivers licence and/or passport as ID), and thus almost no private web services accept it for identification.
So yeah, these things are getting deployed in some places but I'm not too hopeful it will end up being much more than a gimmick. At least I hope not because the next step on the minds of some of these "technical" people is electronic voting and that won't end well...