DCC reissue feature: Why is it necessary to store the hash for one year?

corona-warn-app / cwa-documentation

Project overview, general documentation, and white papers. The CWA development ends on May 31, 2023. You still can warn other users until April 30, 2023. More information:

https://coronawarn.app/en/faq/#ramp_down

Apache License 2.0

3.28k stars 345 forks source link

DCC reissue feature: Why is it necessary to store the hash for one year? #862

Closed Ein-Tim closed 2 years ago

Ein-Tim commented 2 years ago

Your Question

PR: https://github.com/corona-warn-app/cwa-app-ios/pull/4271
Question: Why is such a long time storage (1 year) of the generated hash necessary? Could you elaborate what abuse scenario this prevents?

thomasaugsten commented 2 years ago

I think the reissue service is the right place for this question because the CWA is not saving the hash https://github.com/Digitaler-Impfnachweis/certification-apis/issues

Ein-Tim commented 2 years ago

@thomasaugsten Okay, thanks! So it was not a decision by the CWA team to store the hash for one year but rather form the team over https://github.com/Digitaler-Impfnachweis?

thomasaugsten commented 2 years ago

It is a joined decision from stakeholder and the developing teams to match the requirements and to prevent misusage

Ein-Tim commented 2 years ago

@thomasaugsten

Okay, thanks.