View source for Estonian identity card

{{Short description|National identity card of Estonia}}
{{Infobox Identity document
|document_name = Estonian identity card
|image = New Estonian ID card (2021)(front).jpg
|image_caption = Front of new Estonian identity card
|using_jurisdiction = {{flag|Estonia}}
|valid_jurisdictions = {{flag|European Union}}  <br> {{flag|United Kingdom}} (EU Settlement Scheme) <ref>{{Cite web|title=Visiting the UK as an EU, EEA or Swiss citizen|url=https://www.gov.uk/guidance/visiting-the-uk-as-an-eu-eea-or-swiss-citizen|access-date=2023-05-11|website=GOV.UK|date=27 May 2022 |language=en}}</ref> <br> Rest of [[Europe]] <small>(except [[Belarus]], [[Russia]], and [[Ukraine]])</small>{{hr}} {{flag|Georgia}} <br> {{flag|Montserrat}} (max. 14 days) <br>  {{flagicon|France}} [[Overseas France]] <br> {{flag|Tunisia}} (organized tours)
|document_type = Mandatory [[identity document]]
|eligibility= [[Estonian citizenship]] or [[European Economic Area|EEA]]/Switzerland if residing
|date_first_issued= 23 August 2021
|purpose=Identification, travel
|expiration= 5 years
}}
The '''Estonian identity card''' ({{langx|et|ID-kaart}}) is a mandatory [[identity document]] for citizens of [[Estonia]]. In addition to regular identification of a person, an ID-card can also be used for establishing one's identity in electronic environment and for giving one's [[digital signature]]. Within Europe (except Belarus, Russia, Ukraine and United Kingdom)<ref>{{Cite web |url=http://mfa.gov.ct.tr/consular-info/visa-regulations/ |title=Validity of ID Card |date=4 March 2014 |location=North Cyprus}}</ref><ref name="gov.uk">{{Cite web|title=Visiting the UK as an EU, EEA or Swiss citizen|url=https://www.gov.uk/guidance/visiting-the-uk-as-an-eu-eea-or-swiss-citizen|access-date=2021-10-01|website=GOV.UK|language=en}}</ref> as well as French overseas territories, Georgia and Tunisia (on organized tours only)<ref>{{Cite web|url=http://tunesien.tn/visum/|title=Visa information - Tunisia embassy in Berlin}}</ref> the Estonian ID-card can be used by the citizens of Estonia as a [[travel document]].

The mandatory identity document of a citizen of the [[European Union]] is also an identity card, also known as an [[ID Card|ID card]]. The Estonian ID-card can be used to cross the Estonian border, however Estonian authorities cannot guarantee that other EU member states will accept the card as a travel document.<ref>{{Cite web |url=https://www.politsei.ee/en/teenused/isikut-toendavad-dokumendid/ |title=Estonian ID Card Information by Estonian Police and Border Guard Board |publisher=[[Police and Border Guard Board]] |access-date=2017-02-28 |archive-date=2021-02-26 |archive-url=https://web.archive.org/web/20210226011717/https://www2.politsei.ee/en/teenused/isikut-toendavad-dokumendid/ |url-status=dead }}</ref>

In addition to regular identification of a person, an ID-card can also be used for establishing one's identity in electronic environment and for giving one's digital signature. With the Estonian ID-card the citizen will receive a personal @eesti.ee e-mail address, which is used by the state to send important information. In order to use the @eesti.ee e-mail address, the citizen has to forward it to his or her personal e-mail address, using the State Portal eesti.ee.

The [[Police and Border Guard Board]] (PPA) on 25 September 2018 introduced the newest version of Estonia's ID-card, featuring additional security elements and a contactless interface. The new cards also utilizes Estonia's own font and elements of its brand. One new detail is the inclusion of a [[QR code]], which makes it easier to check the validity of the ID-card. The new design also features a color photo of its bearer, which doubles as a security element and is made up of lines; looking at the card at an angle, another photo appears. The new chip has a higher capacity, allowing the addition of new applications to it.<ref>{{cite news |title=New Estonian ID Card 2019 |publisher=ERR |url= https://news.err.ee/ |access-date=2018-10-01}}</ref>

== Scope ==
The Estonian ID-cards are used in [[health care]], [[electronic banking]], signing contracts, [[public transit]], encrypting email and [[voting]]. Estonia offers over 600 e-services to citizens and 2,400 to businesses.<ref>{{Cite news |title=Estonia takes the plunge |url=https://www.economist.com/international/2014/06/28/estonia-takes-the-plunge |access-date=2024-07-10 |work=The Economist |issn=0013-0613}}</ref> The card's chip stores digitized data about the authorized user, most importantly: the user's full name, gender, [[national identification number]], and [[cryptographic keys]] and [[public key certificate]]s.

== Types of Estonian ID cards ==
There are several types of identity documents issued by the Estonian state that are usually referred to as the Estonian ID-card. These are the ''identity card'', the ''digital identity card'', the ''residence permit card'', the ''e-resident’s digital identity card'' and the ''diplomatic identity card''.

While these identity documents are issued to different categories of persons and have a different appearance, all these documents provide the same electronic functionality via a smart card chip.<ref name=parsovs_phd>{{cite thesis|type=PhD|first=Arnis|last=Parsovs|date=March 2021|title=Estonian Electronic Identity Card and its Security Challenges|publisher=University of Tartu|url=https://dspace.ut.ee/handle/10062/71481}}</ref>{{rp|52}}

{| class="wikitable"
|+ Types of Estonian ID cards
|-
! type
! front
! back
|-
| Identity card
| [[File:New Estonian ID card (2021)(front).jpg|199x199px]]
| [[File:New Estonian ID card (2021)(back).jpg|199x199px]]
|-
| Digital identity card
(and e-resident's digital identity card)
| [[File:Estonian digital identity card starting 2018-12-03 (Front).jpg|199x199px]]
| [[File:Estonian digital identity card starting 2018-12-03 (Back).jpg|199x199px]]
|-
| Residence permit card
| [[File:Estonian residence permit card starting 2020-10-01 (Front).jpg|199x199px]]
| [[File:Estonian residence permit card starting 2020-10-01 (Back).jpg|199x199px]]
|-
| Diplomatic identity card
| [[File:Estonian diplomatic identity card starting 20181203 (Front).jpg|199x199px]]
| [[File:Estonian diplomatic identity card starting 2018-12-03 (Back).jpg|199x199px]]
|}

== Electronic functionality of the ID card ==

From its introduction in 2002 until now, the core electronic functionality provided by the Estonian ID-card has stayed the same. The ID-card contains two asymmetric ([[RSA (cryptosystem)|RSA]] or ECC) [[key pairs]] with the corresponding [[X.509]] [[Public key certificate|public-key certificates]], and symmetric keys to perform card management operations.{{r|parsovs_phd|p=25}}

'''Authentication key.''' The authentication key is used to log into [[e-services]] by providing a signature in the [[Transport Layer Security|TLS]] [[client certificate]] authentication process. This key can also be used to decrypt documents encrypted for the cardholder. This is used only infrequently, as such documents would become unreadable if the card were lost or destroyed. [[Cryptographic signature]] and decryption operations with this key have to be authorized using the 4-digit PIN1 code.

'''Digital signature key.''' The digital signature key is used to give legally binding digital signatures that under eIDAS are recognized as qualified electronic signatures. Each signature operation with the key has to be authorized using the 5-digit PIN2 code.

'''Personal data file.''' The ID card chip contains a publicly readable personal data file, which consists of 16 records containing the same information as is printed on the card.

'''Card management operations.''' The cards are preloaded with [[Symmetric-key algorithm|symmetric keys]] that can be used by the manufacturer to perform various card management operations in the post-issuance phase. This provides a method to reset PIN codes in the event the cardholder forgets them, generate new keys, write new certificates, and even reinstall the whole smart card applet if needed.{{r|parsovs_phd|p=25}}

The Estonian state provides [[DigiDoc]] software allowing users to cryptographically sign digital documents. Since 2016 the DigiDoc software can create files that follow the [[EU]]-wide [[ETSI]] standard called [[Associated Signature Containers#ASiC Extended (ASiC-E)|ASiC-e]].<ref>https://www.etsi.org/deliver/etsi_en/319100_319199/31916201/01.01.01_60/en_31916201v010101p.pdf {{Bare URL PDF|date=March 2022}}</ref><ref>{{Cite web|url=https://www.id.ee/?id=37026|title=Mis vahe on .bdoc ja .asice laiendiga digiallkirjastatud dokumentidel?}}</ref>

By 7 September 2021, 1,391,704,193 electronic signatures were given, thus averaging to 50 signatures per card user per year.<ref>[http://www.id.ee] Estonian ID-card</ref>

Under Estonian law, since 15 December 2000 the cryptographic signature is legally equivalent to a manual [[signature]].<ref>[[Elektrooniline Riigi Teataja]]: [https://www.riigiteataja.ee/ert/act.jsp?id=694375 Digitaalallkirja seadus] (this version valid from 8 January 2004 up to 31 December 2007)</ref> This law has been superseded by the EU-wide eSignature Directive since 2016.<ref>{{Cite web |url=https://ec.europa.eu/cefdigital/wiki/display/CEFDIGITAL/Introduction+to+e-signature |title=Introduction to e-signature |access-date=2019-08-09 |archive-date=2019-08-09 |archive-url=https://web.archive.org/web/20190809164717/https://ec.europa.eu/cefdigital/wiki/display/CEFDIGITAL/Introduction%2Bto%2Be-signature |url-status=dead }}</ref>

== Uses for identification ==
The card's compatibility with standard [[X.509]] and [[Transport Layer Security|TLS]] infrastructure by providing a [[client certificate]] to each person has made it a convenient means of identification for use of web-based government services in Estonia (see [[e-Government]]). All major banks, many financial and other web services support ID-card based authentication. Adding support of Estonian ID-card based identification is very simple nowadays because majority of used browsers, web servers and other software supports TLS (SSL) client-certificate based authentication and Estonian ID-card use exactly that system.

=== Web discussion forums ===
Web commentary columns of some Estonian newspapers, most notably ''[[Eesti Päevaleht]]'', used to support ID-card based authentication for comments. This approach caused some controversy in the internet community.<ref>[http://www.epl.ee/artikkel/272699] {{Webarchive|url=https://web.archive.org/web/20070926230244/http://www.epl.ee/artikkel/272699|date=2007-09-26}} PRIIT HÕBEMÄGI: Anonüümsete kommentaaride lõpetamise kommentaarid</ref>

=== Public transport ===
Larger cities in Estonia, such as [[Tallinn]] and [[Tartu]], have arrangements making it possible for residents to purchase "virtual" transportation tickets linked to their ID-cards.

Period tickets can be bought online via electronic bank transfer, by [[SMS]], or at public kiosks. This process usually takes less than a few minutes and the ticket is instantly active from the moment of purchase or since the first use of the ticket.<ref>{{Cite web|url=https://www.tartu.ee/en/node/1250|title=Bussikaardi korduma kippuvad küsimused|date=24 July 2023 }}</ref>

Customers also have the option of requesting e-mail or SMS notification alerting them when the ticket is about to expire, or of setting up automatic renewal through internet banking services.

To use the virtual ticket, customers must carry their ID-card with them whenever they use public transport. During a routine ticket check, users are asked to present their ID-card, which is then inserted into a special device. This device then confirms that the user holds a valid ticket, and also warns if the ticket is about to expire. The ticket check usually takes less than a second.

Ticket information is stored in a central database, not on the ID-card itself. Thus, to order a ticket, it is not necessary to have an ID-card reader. Ticket controllers have access to a local archive of the master database. If the ticket was purchased after the local archive was updated, the ticket device is able to confirm the ticket from the master database over mobile data link.

=== Electronic voting ===
The Estonian ID-card is also used for authentication in Estonia's [[Electronic voting in Estonia|Internet-based voting]] program called [[i-Voting]].

In February 2007, Estonia was the first country in the world to institute electronic voting for [[parliamentary elections]]. Over 30,000 voters participated in the country's e-election.<ref>{{cite web |url=http://www.id.ee/blog_en/?p=6 |title=IdBlog » the Number of Electronic Voters Tripled |access-date=2012-12-09 |url-status=dead |archive-url=https://web.archive.org/web/20120301202941/http://www.id.ee/blog_en/?p=6 |archive-date=2012-03-01 }} idBlog - The number of electronic voters tripled</ref> In the [[2011 Estonian parliamentary election|Parliamentary election of 2011]] 140,846 votes were cast electronically representing 24% of total votes.<ref>{{Cite web|url=http://www.vvk.ee/riigikogu-valimised-2011/statistika-2011/e-haaletamise-statistika/|title=Valimised}}</ref>

The software used in this process is available for [[Microsoft Windows]], [[macOS]] and [[Linux]].

== Use as a travel document ==

Since Estonia's accession to the [[European Union]] (EU) in 2004, Estonian citizens who possess an Estonian identity card have been able to use it as an international travel document, in lieu of a passport, for travel within the [[European Economic Area]], as well as the French overseas departments and territories, Andorra, San Marino, Monaco, Vatican City, Northern Cyprus, and Georgia.

However, non-Estonian citizens resident in Estonia are unable to use their Estonian identity cards as an international travel document.

==Security issues==
Over the years the Estonian ID-card and its ecosystem has experienced several security incidents and similar issues.{{r|parsovs_phd|p=118}} Below are listed some of the most significant security incidents that have been encountered.

=== Infineon's RSA key generation flaw ===
In August 2017, a security threat was discovered that affected 750,000 ID and e-residency cards issued between 16 October 2014 and 26 October 2017.<ref>{{cite news |title=Possible security risk affects 750,000 Estonian ID-cards |publisher=Estonian World |url= http://estonianworld.com/technology/possible-security-risk-affects-750000-estonian-id-cards/ |access-date=2017-09-17}}</ref>

It was reported that a [[code library]] developed by [[Infineon]], which had been in widespread use in security products such as [[smartcard]]s and [[Trusted Platform Module|TPM]]s, had a flaw (later dubbed the [[ROCA vulnerability]]) that allowed private keys to be inferred from [[public key cryptography|public keys]].<ref name="ars20171016">{{cite news|last1=Goodin|first1=Dan|title=Millions of high-security crypto keys crippled by newly discovered flaw|url=https://arstechnica.com/information-technology/2017/10/crypto-failure-cripples-millions-of-high-security-keys-750k-estonian-ids/|access-date=16 October 2017|work=Ars Technica|date=16 October 2017|language=en-us}}</ref> As a result, all systems depending upon the privacy of such keys were vulnerable to compromise, such as [[identity theft]] or [[Spoofing attack|spoofing]].<ref name="ars20171016"/> Affected systems include 750,000 [[Estonian national ID card|Estonian national ID-card]]s,<ref name="ars20171016"/> and [[e-Residency of Estonia|Estonian e-residency]] cards.

On 2 November 2017, the Estonian government decided to suspend the affected certificates on the midnight of November 3. For the next five months until 31 March 2018 (incl.), the holders of the suspended certificates were still able to update their ID-cards at PPA customer service points and remotely over the internet. On 1 April 2018, the certificates of the non-renewed ID-cards were revoked and the renewal service for the affected ID-cards was discontinued.{{r|parsovs_phd|p=132}} The governments decision to postpone the revocation of the affected certificates and allowing the remote renewal of suspended certificates have been criticized for not being in compliance with [[Electronic identification|eID]] legal requirements.<ref>{{cite conference |last1=Parsovs |first1=Arnis |title=Solving the Estonian ID Card Crisis: the Legal Issues|book-title=Proc. 17th International Conference on Information Systems for Crisis Response and Management ISCRAM 2020|date=May 2020|url=http://idl.iscram.org/files/arnisparsovs/2020/2245_ArnisParsovs2020.pdf|access-date=7 September 2021}}</ref>

The incident resulted in a litigation process as the ID-card manufacturer [[Gemalto]] failed to inform the Estonian state about the vulnerability in a timely manner. In February 2021, it was reported that [[Gemalto]] and the Estonian state reached a compromise agreement, with [[Gemalto]] agreeing to pay the state 2.2 million EUR in compensation.{{r|parsovs_phd|p=139}}

=== Security flaws in key management ===
There have been several isolated cases of security flaws being discovered in the ID-card key management process. In particular, in some cases, contrary to the security requirements, the ID-card manufacturer [[Gemalto]] had generated private keys outside the chip. In several cases, copies of the same private key have been imported in the ID-cards of different cardholders, allowing them to [[Impersonator|impersonate]] each other. In addition, as a result of a separate flaw in the manufacturing process, corrupted RSA public key moduli have been included in the certificates, which in one case led to the full recovery of the corresponding private key.<ref>{{cite conference |last1=Parsovs |first1=Arnis |title=Estonian Electronic Identity Card: Security Flaws in Key Management |book-title=Proc. 29th USENIX Security Symposium |date=14 August 2020 |url=https://www.usenix.org/conference/usenixsecurity20/presentation/parsovs |access-date=2 September 2020}}</ref>

== See also ==
* [[National identity cards in the European Union]]
* [[Estonian passport]]
* [[Estonian seafarer's discharge book]]
* [[Estonian temporary travel document]]
* [[Estonian alien's passport]]
* [[Estonian travel document for refugees]]
* [[Estonian nationality law]]
* [[Visa requirements for Estonian citizens]]
* [[Visa requirements for Estonian non-citizens]]
* [[e-Residency of Estonia]]
* [[e-Estonia]]
* [[ROCA vulnerability]]

== References ==

{{reflist}}

== External links ==
* [https://s.err.ee/photo/crop/2018/09/27/549820h6da7t27.jpg New Estonian ID Card 2019]
* [https://www2.politsei.ee/en/teenused/isikut-toendavad-dokumendid/id-kaart/ Information about Estonian ID Card by Estonian Police and Border Guard Board]
* [http://www.consilium.europa.eu/prado/en/EST-BO-03001/index.html Information about Estonian ID Card by Prado Consilium]
* [https://www2.politsei.ee/en/nouanded/dokumentide-naidised/identity-card/identity-cards-issued-since-01012011.dot Sample ID Card of an Estonian citizen, issued by Estonian Police and Border Guard Board starting from 01.01.2011]
* [http://www.vm.ee/sites/default/files/content-editors/eesti_valisesindused_eng.jpg A map of Estonian representations abroad] {{Webarchive|url=https://web.archive.org/web/20210225000710/https://vm.ee/sites/default/files/content-editors/eesti_valisesindused_eng.jpg |date=2021-02-25 }}
* [https://www.riigiteataja.ee/akt/223406 Certificate of Return for Estonian citizen]
* [https://www.riigiteataja.ee/en/eli/524032014001/consolide Identity Documents Act]
* [http://www.vm.ee/et/riigid-kuhu-eesti-kodanikel-oigus-siseneda-viisata Visa-Free Country List by Estonian Foreign Ministry] {{Webarchive|url=https://web.archive.org/web/20180307013719/http://www.vm.ee/et/riigid-kuhu-eesti-kodanikel-oigus-siseneda-viisata |date=2018-03-07 }}
* [https://www.passportindex.org/comparebyPassport.php?p1=ee&s=yes Passport Index Visa-Free Score Estonian Passport]
* [http://www.visaindex.com/ Henley & Partners Visa Restrictions Index Map]
* [https://www2.politsei.ee/en/ Issuing authority's official website in English]
* [http://www.pilet.ee/ ID Ticket website]
* [http://www.id.ee/ ID card official information page]
* [https://e-estonia.com/solutions/e-identity/id-card/ ID card information on the e-estonia website]

{{Estonian Travel Documents|state=expanded}}
{{identity cards|state=collapsed}}

{{DEFAULTSORT:Estonian Id Card}}
[[Category:Government of Estonia]]
[[Category:National identity cards by country]]
[[Category:Smart cards]]