Estonian ID-card ROCA crypto crisis

In autumn 2017, Estonia — whose entire e-government, banking, and voting infrastructure rests on a mandatory cryptographic ID-card — faced a state-level crisis when researchers found that the card's chip generated mathematically weak RSA keys. The flaw, dubbed ROCA (Return of Coppersmith's Attack, CVE-2017-15361), threatened to let attackers forge the digital identity of any affected cardholder.

What happened

The vulnerability lived in Infineon Technologies' RSALib library, used in the smartcard chips that Estonia (and many TPMs, passports, and tokens worldwide) relied on. Infineon's non-standard prime-generation method produced RSA moduli with a hidden structure, allowing the private key to be factored from the public key using an adaptation of Coppersmith's theorem. Because every Estonian ID-card's public key is published in a national directory, an attacker needed no physical access and no PIN — only the public key and sufficient computing power.

The flaw was discovered in February 2017 by researchers at Masaryk University (CRoCS) in the Czech Republic, who disclosed it confidentially to Infineon. Estonia's Information System Authority (RIA) was privately warned on 30 August 2017 and went public with a vague "potential risk" on 5 September 2017, deliberately withholding technical details until the coordinated disclosure on 16 October 2017.

Impact

• Roughly 750,000–760,000 cards — issued since October 2014, including e-Residency cards — were affected, covering well over half of Estonia's 1.3 million population.
• The cards underpin digital signatures, online banking, tax filing, prescriptions, and i-Voting, so a forged-identity scenario was an existential threat to trust in the entire e-state.
• No confirmed real-world exploitation occurred, but estimates put the cost of factoring a single 2048-bit key within reach of well-resourced attackers.

Response

On 3 November 2017, the Police and Border Guard Board suspended the certificates of the affected cards. Rather than physically recall and reissue every card — as some other countries did — Estonia rolled out a remote software update that re-generated keys on-card using a different, secure method, letting most citizens fix their cards online. By April 2018, after several hundred thousand renewals, RIA declared the crisis resolved.

Why it matters

The ROCA crisis is the canonical case of a supply-chain cryptographic failure striking national critical infrastructure: a single vendor's library flaw cascaded into a constitutional-scale identity risk. Estonia's handling — transparent (if tightly sequenced) disclosure, plus remote re-keying instead of mass recall — is now studied as a model of crisis response, demonstrating that a digital state can absorb a foundational cryptographic break without collapsing public trust.