The Belgian eID

An ID card seen from above at an angle, with a gold-coloured chip, next to the slot of a card reader.

Ever since you turned twelve, there's been a tiny computer in your wallet. Your ID card has a chip, and in that chip is everything you've seen on this site: two key pairs on an elliptic curve, certificates that prove they belong to you, and a tiny processor that can sign things without ever letting go of its private keys. In this chapter you'll use them for real.

Words you might need

Chip: The gold-coloured square on your card. A real, tiny computer with its own memory and its own processor. It gets power from the card reader.
Card reader: The little device you slide the card into, connected to your computer with a USB cable. Your parents might have one for their taxes. Without a reader you can still read this chapter, but you can't run the demo.
Helper: A small program that runs in the background on your computer and bridges your browser and the card reader. Without that program, no website can reach your card — that's deliberate, otherwise any website could just read out your card. You install it once; see "What you need" below.
PIN: Four digits you got with your card. The chip does nothing with your private keys without that code. Three wrong tries: blocked.
National register number: The number the Belgian State knows you by. It's printed on your card and starts with your birth date, reversed.

What's inside the chip

What	Why
Your name, date of birth, national register number	Signed by the State, so it can't be faked
Your address	Stored separately, since it changes more often than the rest
Your photo	A JPEG of a few kilobytes — in base64 when you read it out
The `auth` key	To prove it's you when logging in
The `sign` key	To sign documents, legally valid
Certificates	The chain of trust up to the Belgian State

The most important part isn't in that table: the private keys can never leave the chip. There's no command to read them out. All a program can ever ask is: "sign this for me". The chip does that internally, after you enter your PIN, and only hands back the signature. That's why your card is safer than a key sitting on your hard drive: that can be copied. A chip can't.

What you need

This chapter only works on a computer — not on your phone or tablet. A smartphone has no connector for a card reader, and there's no version of the helper for Android or iOS. Feel free to read this chapter on your phone, but run the demo on a Windows, macOS or Linux computer.

Your eID and your PIN.
A card reader, connected to this computer over USB. Some laptops even have one built in; otherwise a reader costing a few euros is enough.
The official eID software from the government — download it at eid.belgium.be. That's what recognises your card and your card reader.
The helper from the beID platform — download it at beid.hermesplatform.be/download. That's the program this site (and every other site that works with your eID) needs to reach the card reader.

You install both once; after that they run in the background. If something's missing, the demo below tells you exactly what: "no card or reader found" or "the helper isn't running on this computer".

Try it with your own card

Note: this demo does go through a server. There's no way around that — the card reader is addressed by the beID platform, and the answer comes back over a secured detour. Whatever comes off your card gets shown on your screen once and then discarded. Not stored, not logged, not passed on to anyone. Only do this with your own card.

Choose what you want to do. Start with Read identity.
Click Start the card session. You get redirected, the reader lights up, you enter your PIN.
You come back with your data on screen — plus the proof that it really came from your card.
Then try Sign with the authentication key: type a text, have your chip sign it, and watch this site verify the signature. That's chapter seven, for real.

About sign: that signature is legally just as valid as your signature with a pen. For this demo that doesn't matter — you're signing a little sentence that's stored nowhere. But remember the difference: auth says "this is me", sign says "I agree". Never give your PIN for sign to a site you don't trust.

What happens in those few seconds

This site writes down what it wants (for example "read the identity"), turns that into base64 and signs it with its own private key. That's how the platform knows the request really came from here. (Chapters 1 and 7.)
Your browser sends that to the platform. The reader wakes up, you type your PIN, the chip does its work.
The platform sends you back with a code: a random number, valid for two minutes. There's not a single piece of data in it yet.
This site's server exchanges that code with the platform, and signs that request too. Back comes a token with your data, signed by the platform.
This site checks that signature, checks the hash of the content (chapter 2), and only then believes even a single field.

Chose auth or sign? Then this site also checks the signature from your chip against the certificate that same chip sent along — exactly the Verify button from chapter seven, but with a private key sitting inside a piece of plastic you're holding in your hand.

Everything in those five steps you've already seen: base64, hashing, key pairs, curves, signatures. Not a single new idea gets added. That's how it works with all security: a handful of mathematical ideas, stacked cleverly.

Two generations of cards

Older cards still work with RSA (chapter 5), newer ones with an elliptic curve (chapter 6). You can tell from the result: if it says pkcs1, you have an RSA card; if it says der, a curve one. For the check itself it makes no difference — the certificate says which system it is.

For anyone who wants to build this themselves later: the full technical manual for the platform is at beid.hermesplatform.be. The code behind this page follows it line by line.

This is math: what happens in two seconds

Between typing your PIN and seeing the result on your screen, four signatures get made and checked, each one a calculation on an elliptic curve with numbers over a hundred digits long; a hash gets calculated at least three times; and a secret gets agreed on once using the paint trick. Everything you saw on this site one piece at a time, in a fraction of a second. That's what math does when you let it work.