Breaking and Fixing the CIE Secure Communication Channel

In this thesis we describe how we broke the secure communication channel between the Italian Electronic Identity Card (Carta d'identità elettronica, or CIE) and the CIE Middleware (the software used to communicate with it). Analyzing the CIE Middleware software, we found issues with the key management and integrity checks on a public key used to establish the secure communication channel. These issues lead to a vulnerability that compromises the security of the channel, allowing an attacker to perform a man-in-the-middle attack (MITM) on it, enabling them to intercept and modify all data transmitted over the supposedly secure channel. The vulnerability discussed in this thesis, including a possible fix, has been responsibly disclosed to the CIE Middleware developers.