Understanding NHS Digital vaccination certificates.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "fedae783",
   "metadata": {},
   "source": [
    "# Understanding NHS digital vaccination certificates"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "id": "e5fa2ce2",
   "metadata": {},
   "outputs": [],
   "source": [
    "from pyzbar.pyzbar import decode as qrdecode\n",
    "from PIL import Image\n",
    "import zlib, base45, base64, cbor2"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "8fc71c6c",
   "metadata": {},
   "source": [
    "The NHS app offers two types of certificates:\n",
    " * 'Coronavirus (COVID-19) vaccination records'\n",
    " * [NHS COVID Pass](https://www.gov.uk/guidance/demonstrating-your-covid-19-status)\n",
    " \n",
    " \n",
    " \n",
    "## Coronavirus (COVID-19) vaccination records\n",
    "\n",
    "These appear to be [EU standard conforming](https://ec.europa.eu/health/ehealth/covid-19_en). But since isn't taking part in the EU Digital greent certificate initiative, these will not be validated by cert reading apps of countries. Malta was complaining about this. The ground work has been done, the data is compatible, the [EU is happy to have other countries take part too](https://ec.europa.eu/info/live-work-travel-eu/coronavirus-response/safe-covid-19-vaccines-europeans/eu-digital-covid-certificate_en) - it all just seems political.\n",
    "\n",
    "There is a 'blueprint' implementation of various useful apps and specifications on [the EU's github organisation](https://github.com/eu-digital-green-certificates). It should really be straight forward to add Englands public keys to [that app](https://github.com/eu-digital-green-certificates/dgca-verifier-app-android) so that they can also be verified.\n",
    "\n",
    "\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "id": "cbc46a23",
   "metadata": {},
   "outputs": [],
   "source": [
    "## from https://covid-status.service.nhsx.nhs.uk/pubkeys/keys.json\n",
    "keys = [{\n",
    "\t\"kid\": \"S2V5MVJF\",\n",
    "\t\"publicKey\": \"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEtWokvmqrJOv/0PO9Vy8lpb6SgWw+rao0qIXntO/Bf7ExryL3yyKRI73IqAh38Lk4joqHrZK8XLZV9PMclgmTVg==\"\n",
    "}, {\n",
    "\t\"kid\": \"S2V5MlJF\",\n",
    "\t\"publicKey\": \"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEAauvVllnjXm0toiI2cUQfCTdZiDQ6kvtoo1bSnl8W3Rq7WyOeHWYKhBaQ4rEBceqNl5+v1ZLGj0WfnIhXh246Q==\"\n",
    "}, {\n",
    "\t\"kid\": \"S2V5M1JF\",\n",
    "\t\"publicKey\": \"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2ZpDNa1VV6g2PkmyKoL1INO0MtTqE5WT45i3QhY9FFMjbF9ieqnHV4R814wrN3f3vzkx0VN/YJZH4rI1GDlfqw==\"\n",
    "}, {\n",
    "\t\"kid\": \"S2V5NFJF\",\n",
    "\t\"publicKey\": \"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8g5iFLRT7NyRmKp7pcP8uEgoHFhfmcXOLLD4RUtX50/Rh4Cz7l/faAiODNMmCkcWLA1Z8WOZoNFQsdmeDjXuLQ==\"\n",
    "}, {\n",
    "\t\"kid\": \"S2V5NVJF\",\n",
    "\t\"publicKey\": \"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEOFOUp1+SLuaM3NnV+OMZKZOoPg76T7D+vqRCasD0BrRZmlUH2gD+aVlpKvp+u7h8ywTR7T6Z6/iI2Qe6F5begg==\"\n",
    "}, {\n",
    "\t\"kid\": \"S2V5MVBSTw==\",\n",
    "\t\"publicKey\": \"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyfUqlGg4hfyPYgZJzl1KepkfTaX+F3592syCJ0ylVOHA4fE6vavLXE4cG+Whz/eqyW/rFuZ0HBHHEskmpCngOA==\"\n",
    "}, {\n",
    "\t\"kid\": \"S2V5MlBSTw==\",\n",
    "\t\"publicKey\": \"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEP6P6ZlbhcW1xZpp91qagUY+iLIyuu+CynzAlrqiiseqmOYH8uJ71CkbEYhbVh8TemnbaR0unE2j9EPK7Y/x7Vg==\"\n",
    "}, {\n",
    "\t\"kid\": \"S2V5M1BSTw==\",\n",
    "\t\"publicKey\": \"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAErltiOh3nmU+x4p5r249O/2fBSnHkjJpas23lhMAtEYeQutHiw0G+zeEUNZ/n++/XbFoY5hH68d27cGaGW6uoxw==\"\n",
    "}, {\n",
    "\t\"kid\": \"S2V5NFBSTw==\",\n",
    "\t\"publicKey\": \"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEEfIefhjjacwZ+xxKudJGqdHr0j95tWtYIUGPeWV2XWmduygfe3oIFJu/A2kYGmeZ4u/ERSTNM2ZXuE9k19xVJQ==\"\n",
    "}, {\n",
    "\t\"kid\": \"S2V5NVBSTw==\",\n",
    "\t\"publicKey\": \"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE+4ukUdmm9f4AmyQBwTLQFKPPCQj4fP2BpQkIl2hb4p6FxPGDP9z3JkIo2w2xkoxqs2JrTHn2MCdyh3aeyZWD4A==\"\n",
    "}]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "2e49a84a",
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "id": "131009ef",
   "metadata": {},
   "outputs": [],
   "source": [
    "## my personal vaccination certificate, not part of this repo - contains PII\n",
    "nhsDataOrig = qrdecode(Image.open('nhs-vaccination-certificate.png'))[0]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "id": "2b83fb9a",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "b'HC1:'"
      ]
     },
     "execution_count": 4,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "nhsDataOrig.data[:4]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "id": "1b824eb2",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "518"
      ]
     },
     "execution_count": 5,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "len(nhsDataOrig.data[4:])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "id": "eca679aa",
   "metadata": {},
   "outputs": [],
   "source": [
    "## so its got the right starting string"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "id": "85d07ec1",
   "metadata": {},
   "outputs": [],
   "source": [
    "nhsData = cbor2.loads(zlib.decompress(base45.b45decode(nhsDataOrig.data[4:])))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "id": "c56b1552",
   "metadata": {},
   "outputs": [],
   "source": [
    "from copy import deepcopy\n",
    "def sanitise(d):\n",
    "    d = deepcopy(d)\n",
    "    d[4] = 1620000000\n",
    "    d[6] = 1630000000\n",
    "    d[-260][1]['v'][0]['ci'] = 'URN:UVCI:01:GB:...'\n",
    "    d[-260][1]['v'][0]['dt'] = '2021-06-01'\n",
    "    d[-260][1]['dob'] = '1900-01-01'\n",
    "    d[-260][1]['nam'] = {'fn' : 'SURNAME', 'gn' : 'Firstname', 'fnt' : 'SURNAME', 'gnt': 'FIRSTNAME'}\n",
    "    return d"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "id": "be6fbcf4",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "{1: 'GB',\n",
       " 4: 1620000000,\n",
       " 6: 1630000000,\n",
       " -260: {1: {'v': [{'ci': 'URN:UVCI:01:GB:...',\n",
       "     'co': 'GB',\n",
       "     'dn': 2,\n",
       "     'dt': '2021-06-01',\n",
       "     'is': 'NHS Digital',\n",
       "     'ma': 'ORG-100001699',\n",
       "     'mp': 'EU/1/21/1529',\n",
       "     'sd': 2,\n",
       "     'tg': '840539006',\n",
       "     'vp': '1119305005',\n",
       "     'lot': 'PW40040'}],\n",
       "   'dob': '1900-01-01',\n",
       "   'nam': {'fn': 'SURNAME',\n",
       "    'gn': 'Firstname',\n",
       "    'fnt': 'SURNAME',\n",
       "    'gnt': 'FIRSTNAME'},\n",
       "   'ver': '1.0.0'}}}"
      ]
     },
     "execution_count": 9,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "## All the details! Seem entirely standard conforming.\n",
    "sanitise(cbor2.loads(nhsData.value[2]))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "id": "b9068cd3",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "{1: -7, 4: b'Key5PRO'}"
      ]
     },
     "execution_count": 10,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# This is the key identifier\n",
    "cbor2.loads(nhsData.value[0])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "id": "88f22104",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE+4ukUdmm9f4AmyQBwTLQFKPPCQj4fP2BpQkIl2hb4p6FxPGDP9z3JkIo2w2xkoxqs2JrTHn2MCdyh3aeyZWD4A=='"
      ]
     },
     "execution_count": 11,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "pk = next(x['publicKey'] for x in keys if base64.b64decode(x['kid']) == cbor2.loads(nhsData.value[0])[4])\n",
    "## ok, so the PK is \n",
    "pk"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "aebd61ba",
   "metadata": {},
   "source": [
    "Cose needs the $x$ and $y$ (or $r$ and $s$) factors of the elliptic curve to validate the signature. I am not sure how to get these though currently. [8gwifi] has a pem parser function that gives them to me - select `Public Key` on that website, and stick \n",
    "\n",
    "```\n",
    "-----BEGIN PUBLIC KEY-----\n",
    "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE+4ukUdmm9f4AmyQBwTLQFKPPCQj4fP2BpQkIl2hb4p6FxPGDP9z3JkIo2w2xkoxqs2JrTHn2MCdyh3aeyZWD4A==\n",
    "-----END PUBLIC KEY-----\n",
    "```\n",
    "\n",
    "But we can also get these numbers in python."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "id": "aaef13b0",
   "metadata": {},
   "outputs": [],
   "source": [
    "from pyasn1.codec.der.decoder import decode"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "id": "1fb6739a",
   "metadata": {},
   "outputs": [],
   "source": [
    "received_record, rest_of_substrate = decode(base64.b64decode(pk))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "id": "c79cf32a",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "field-0 is SequenceOf:\n",
      " 1.2.840.10045.2.1 1.2.840.10045.3.1.7\n",
      "field-1 is 0000010011111011100010111010010001010001110110011010011011110101111111100000000010011011001001000000000111000001001100101101000000010100101000111100111100001001000010001111100001111100111111011000000110100101000010010000100010010111011010000101101111100010100111101000010111000100111100011000001100111111110111001111011100100110010000100010100011011011000011011011000110010010100011000110101010110011011000100110101101001100011110011111011000110000001001110111001010000111011101101001111011001001100101011000001111100000\n"
     ]
    }
   ],
   "source": [
    "for field in received_record:\n",
    "    print('{} is {}'.format(field, received_record[field]))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "id": "3b692a10",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "b\"\\x04\\xfb\\x8b\\xa4Q\\xd9\\xa6\\xf5\\xfe\\x00\\x9b$\\x01\\xc12\\xd0\\x14\\xa3\\xcf\\t\\x08\\xf8|\\xfd\\x81\\xa5\\t\\x08\\x97h[\\xe2\\x9e\\x85\\xc4\\xf1\\x83?\\xdc\\xf7&B(\\xdb\\r\\xb1\\x92\\x8cj\\xb3bkLy\\xf60'r\\x87v\\x9e\\xc9\\x95\\x83\\xe0\""
      ]
     },
     "execution_count": 15,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "pkBin = received_record[1].asOctets()\n",
    "pkBin"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "c271f6af",
   "metadata": {},
   "source": [
    "so starting with 04 - uncompressed two numbers, but the encoding seems difficult to get?\n",
    " * https://stackoverflow.com/questions/16899247/how-can-i-decode-a-ssl-certificate-using-python/50072461 \n",
    " * https://superuser.com/questions/900918/get-x-and-y-components-of-ec-public-key-using-openssl\n",
    " \n",
    " "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "id": "0dacbeca",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "65"
      ]
     },
     "execution_count": 16,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "len(pkBin)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "id": "0c15b855",
   "metadata": {},
   "outputs": [],
   "source": [
    "X = pkBin[1:33]\n",
    "Y = pkBin[33:]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "id": "9508a1eb",
   "metadata": {},
   "outputs": [],
   "source": [
    "## lets use that to validate the certificate."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "id": "0aebf06d",
   "metadata": {},
   "outputs": [],
   "source": [
    "from cose.messages import CoseMessage\n",
    "from cose.keys import CoseKey\n",
    "from cose.algorithms import EdDSA\n",
    "from cose.keys.curves import P256\n",
    "from cose.keys.keyparam import KpKty, KpKeyOps, EC2KpCurve, EC2KpX, EC2KpY\n",
    "from cose.keys.keytype import KtyEC2\n",
    "from cose.keys.keyops import VerifyOp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "id": "266eb545",
   "metadata": {},
   "outputs": [],
   "source": [
    "cose_key = {\n",
    "    KpKty: KtyEC2,\n",
    "    EC2KpCurve: P256,\n",
    "    KpKeyOps: [VerifyOp],\n",
    "    EC2KpX: X,\n",
    "    EC2KpY: Y,\n",
    "}\n",
    "\n",
    "cose_key = CoseKey.from_dict(cose_key)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "id": "8415ffef",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "<COSE_Sign1: [{'Algorithm': 'Es256', 'KID': b'Key5PRO'}, {}, b'\\xa4\\x01bGB' ... (257 B), b'M\\xf0\\x17[\\xa3' ... (64 B)]>"
      ]
     },
     "execution_count": 21,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# decode and verify the signature\n",
    "\n",
    "decoded = CoseMessage.decode(zlib.decompress(base45.b45decode(nhsDataOrig.data[4:])))\n",
    "\n",
    "decoded"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "id": "e0f001bf",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "True"
      ]
     },
     "execution_count": 22,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "decoded.key = cose_key\n",
    "\n",
    "decoded.verify_signature()"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "6f8dca4b",
   "metadata": {},
   "source": [
    "Peachy!"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "1d4b6969",
   "metadata": {},
   "source": [
    "# NHS COVID Pass\n",
    "\n",
    "@martinbrook released his [Covid Pass certificate on github](https://github.com/eu-digital-green-certificates/dcc-quality-assurance/issues/64). I will be taking a look at that one, but again, the qr code is not contained in this repo. Download it from the github issue, take a png screenshot of the qr code, and save it as `covid-pass-certificate.png` for the code below to work.\n",
    "\n",
    "The [NHS COVID Pass](https://www.gov.uk/guidance/demonstrating-your-covid-19-status) seems to be what the government wants to use for international travel - rather than the vaccination certificates which should contain all relevant information already? I am confused.\n",
    "\n",
    "There are some [guidance on how to use this](https://www.nhsx.nhs.uk/covid-19-response/using-the-nhs-covid-pass/), including a ['verifier app'](https://www.nhsx.nhs.uk/covid-19-response/international-covid-pass-verifier-app-user-guide/). However I am unable to find this app in the [google play store](https://play.google.com/store/search?q=NHS%20COVID%20Pass%20Verifier%20app), and a [telegraph article confirms that the app has yet to be released](https://www.telegraph.co.uk/news/2021/07/15/covid-passport-backlash-pubs-restaurants-say-cant-check-qr-codes/)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 27,
   "id": "4afb6602",
   "metadata": {},
   "outputs": [],
   "source": [
    "covidPassOrig = qrdecode(Image.open('covid-pass-certificate.png'))[0]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "id": "eeffe0a9",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "131"
      ]
     },
     "execution_count": 24,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "len(covidPassOrig.data)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "id": "9b352bc6",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "b'S2V5MlBSTw==.MTIxMDYzMDE1NDJNQ'"
      ]
     },
     "execution_count": 25,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "covidPassOrig.data[:30]"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "2e8c270f",
   "metadata": {},
   "source": [
    "This has a different data structure to the Vaccination records. \n",
    "\n",
    " * The initial part seems to match one of the keys from the nhs key list\n",
    " * Otherwise the NHS has not released any information on the encoding. It seems to contain quite a bit less data than the vaccination certificates (131 bytes vs 518 bytes in my case)\n",
    "     "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "id": "481a6ed7",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEP6P6ZlbhcW1xZpp91qagUY+iLIyuu+CynzAlrqiiseqmOYH8uJ71CkbEYhbVh8TemnbaR0unE2j9EPK7Y/x7Vg=='"
      ]
     },
     "execution_count": 26,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "pkCP = next(x['publicKey'] for x in keys if x['kid'] == covidPassOrig.data[:12].decode('ascii'))\n",
    "## ok, so the PK is \n",
    "pkCP"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "1ae2754e",
   "metadata": {},
   "source": [
    "Can't really do much more here. "
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.9.2"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}