Germany to introduce an electronic ID card

The German federal government plans to introduce an electronic ID card similar to the electronic passport already in use. In contrast to the passport, the ID card will optionally carry an electronic signature which enables it to use it as an internet authentication device, potentially replacing PIN and TAN based transaction procedures. For the industry, the device will create a significant additional business. The ID card which is scheduled for roll-out in 2010, triggered different echoes from data privacy advocates and from the industry. The Greens in the Berlin parliament criticized that an official document will be coupled with arrangements aiming at private commerce. In addition, data security experts expressed concerns that the fingerprint data, which can be are stored voluntarily on the chip, could be abused. The industry, represented by Berlin-based Bitkom trade organization, hailed the planned introduction. “The electronic ID card improves user security in the internet and thus strengthens confidence of consumers when shopping in the internet,” said Bitkom steering committee member Dieter Kempf. According to the organization, online banking, internet shopping, electronic citizen services and e-government services benefit from the combination of electronic ID card and electronic signature.

For Detlef Houdeau, senior director of Business Development Chip Cards and Security for chip vendor Infineon, the enhanced internet utilization options are the most important aspect of the government decision. Infineon was involved in the definition of the specification set which form the basis for the electronic passport as well as the new ID card. Technically, the electronic content of the ID card is to a large extend identical to the smart card chip in the electronic passport already in use in several countries. The current design goes back to specifications created in 2004; similar approaches are in discussion in the UK, Spain, France and Italy. As with its equivalent in the passport, the electronic circuit in the planned ID card communicates contactlessly with the outside world. It also contains the same microcontroller and provides the same data structures and access methods, explained Houdeau. Both smart card chips can store the same biometric data, Houdeau explained. This includes fingerprint data which in the case of the German ID card will be voluntary (as opposed to the electronic passport). Memory size and data processing hardware as well as basic algorithms are also identical. The specifications are defined in the European CEN TC224 standard, which also covers protocols and security mechanisms.

The ID card, however, stores two sets of data separated from each other. The first set is the same as used in the e-passport. The second set contains the electronic signature and the authentication routine. Both sets are administered by the same microprocessor. In order to use the digital signature for internet or other business, the business partner needs to have an electronic certification. Currently it is not completely clear how these certificates will be distributed; data protection advocates and internet security groups regard the distribution path as one of the weakest points in the system. Nevertheless, proponents of the system such as Infineon believe it greatly improves internet security. For instance, it could replace PIN/TAN procedures today in widespread use for internet financial transactions. “The security level [achieved by the digital signature] is so high that it is justified to say this is a completely new application class,” Houdeau became enthusiastic. The smart card chip industry including chip vendors of course hails the government decision. While the ID cards make up to only a relatively small percentage of the annual smart card chip output, the introduction of these devices still could have a significant business impact.

According to market researcher Gartner, the worldwide market for smart cards and microcontroller-based cards in 2007 accounted to 3.3 billion units. Against this background, the additional business generated through the German ID card decision seems relatively small. Infineon estimates the volume to about seven million units per year — “perhaps more since the government will create incentives to foster a quick introduction,” Houdeau said. Since other EU countries are considering similar roll-outs, Houdeau estimates the potential market opportunity to about 38 million units annually. 78 percent of the total volume are represented by simple, cheap SIM cards. Thus, the market for the more complex ID cards adds up to about 5 percent of the remaining total market volume. In terms of value, the ID card impact however would be significantly higher since they represent a higher value per piece. In 2007, among the smart card vendors, Gemalto was the dominating factor with a market share of 36 percent, followed by Giesecke & Devrient with 16 percent and Oberthur Card Systems with 9 percent, Gartner said. Top supplier of ICs for chip cards was Infineon with shipments accounting for 28 percent of the market, followed by Samsung, Atmel and STMicroelectronics.