Research outputs

2026

• Arnis Parsovs. Banks fail to implement measures against Smart-ID phishing.
  Opinion piece · ERR · January 2026 — [in Estonian] [media] [media]

2025

• Gregor Eesmaa. Account Existence Leaks in Estonian Online Services.
  MSc thesis · University of Tartu · August 2025 — [correspondence] [video] [media]

2024

• Danielle Morgan. Determining the A5 encryption algorithms used in 2G (GSM) networks.
  Conference paper · NordSec 2024 · November 2024
• Daniel Würsch. Security Analysis of Skybrake DD5 Immobilizer.
  MSc thesis · University of Tartu · August 2024 — [slides]

2023

• Arnis Parsovs, Burak Can Kus, Geio Tischler. ID card face match: Biometric facial verification using authentic ID card (eMRTD) facial image.
  Demo installation · University of Tartu · September 2023 — [video]

2022

• Arnis Parsovs. Security of the proposed Mobile-ID document decryption feature.
  Report · University of Tartu · July 2022 — [press]
• Arnis Parsovs. Security improvements for the Estonian ID card.
  Report · University of Tartu · June 2022 — [presentation]
• Arnis Parsovs. I-voting on mobile devices: the open issues.
  Report · University of Tartu · May 2022
• Elizabete Liene Šterna. Security Architecture of the Latvian eParaksts mobile.
  MSc thesis · University of Tartu · May 2022
• Semjon Kravtšenko. The Estonian Mobile-ID Implementation on the SIM Card.
  BSc thesis · University of Tartu · May 2022 — [BSides talk]
• Arnis Parsovs. Security requirements for the successor of the Estonian Mobile-ID.
  Report · University of Tartu · April 2022

2021

• Arnis Parsovs. On the format of the authentication proof used by RIA's Web eID solution.
  Report · University of Tartu · October 2021 — [media]
• Arnis Parsovs. Technical details of the security flaw in the Estonian ID cards issued in 2011.
  Report · University of Tartu · September 2021 — [video] [media]
• Peeter Vahe. Tartu Smart Bike Share Access Cards Authentication Analysis.
  BSc thesis · University of Tartu · May 2021 — [demo]
• Toomas Aleksander Veromann. WYSIWYS Extensions to the Estonian ID Card Browser Signing Architecture.
  MSc thesis · University of Tartu · May 2021 — [media]
• Burak Can Kus. Use of Electronic Identity Documents for Multi-Factor Authentication.
  MSc thesis · University of Tartu · May 2021 — [code] [demo]
• Arnis Parsovs. Security Analysis of RIA's Authentication Service TARA.
  Report · University of Tartu · May 2021
• Arnis Parsovs. Estonian Electronic Identity Card and its Security Challenges.
  PhD thesis · University of Tartu · March 2021 — [ebook] [media] [defence] [BSides talk]
• Arnis Parsovs. Estonian ID card (browser signing extension) authentication man-in-the-middle attack.
  Proof-of-concept video with description · YouTube · February 2021 — [press release] [media]

2020

• Arnis Parsovs. Estonian Electronic Identity Card: Security Flaws in Key Management.
  Conference paper · USENIX Security 2020 · August 2020 — [page] [slides] [presentation] [demo]
• Sander-Karl Kivivare. Secure Channel Establishment for the NFC Interface of the New Generation Estonian ID Cards.
  BSc thesis · University of Tartu · August 2020 — [code]
• Eduard Iltšuk. Two-Party ECDSA Protocol for Smart-ID.
  MSc thesis · University of Tartu · August 2020
• Arnis Parsovs. Solving the Estonian ID Card Crisis: the Legal Issues.
  Conference paper · ISCRAM 2020 · May 2020
• Siim-Alexander Kütt. Security Analysis of Tartu Smart Bike Share Android Application.
  BSc thesis · University of Tartu · May 2020 — [media]
• Silver Maala. A Proof of Concept Malware for Interacting with the Smart-ID Android Application.
  BSc thesis · University of Tartu · May 2020 — [demo] [code] [media]
• Arnis Parsovs. Creating a technically valid but legally invalid EU Qualified Electronic Signature.
  Proof-of-concept video with description · YouTube · February 2020 — [news article]

2019

• Abasi-amefon Affia. Assessing the NFC Unlock Mechanism of the Tartu Smart Bike Share System.
  Research seminar report · University of Tartu · Fall 2019
• Tõnu Mets and Arnis Parsovs. Time of signing in the Estonian digital signature scheme.
  Journal article · Digital Evidence and Electronic Signature Law Review · November 2019 — [page] [demo]
• Bruno Produit. Optimization of the ROCA (CVE-2017-15361) Attack.
  MSc thesis · University of Tartu · June 2019 — [slides] [code] [media]

2017

• Annika Tammik. Reproducing Vote Verification Application Builds for Estonian I-Voting System.
  Research seminar report · University of Tartu · Fall 2017 — [slides]
• Danielle Morgan and Arnis Parsovs. Using the Estonian Electronic Identity Card for Authentication to a Machine.
  Conference paper · NordSec 2017 · November 2017 — [extended version] [slides]
• Danielle Morgan. Security of Loyalty Cards Used in Estonia.
  MSc thesis · Tallinn University of Technology · 2017 — [slides]

2016

• Arnis Parsovs. Homomorphic Tallying for the Estonian Internet Voting System.
  Report 2016/776 · Cryptology ePrint Archive · 2016 — [code]

2015

• Sven Heiberg, Arnis Parsovs, Jan Willemson. Log Analysis of Estonian Internet Voting 2013-2014.
  Conference paper · Vote-ID 2015 · August 2015 — [extended version] [slides]
• Rain Viigipuu. Security Analysis of Instant Messenger TorChat.
  MSc thesis · Tallinn University of Technology · June 2015 — [slides]

2014

• Märt Bakhoff. Sniffing Real World EMV Payment Card Protocol Transaction.
  Research seminar report · University of Tartu · Fall 2014 — [slides]
• Arnis Parsovs. Identity Card Key Generation in the Malicious Card Issuer Model.
  Research seminar report · University of Tartu · Spring 2014 — [slides]
• Arnis Parsovs. Practical Issues with TLS Client Certificate Authentication.
  Conference paper · NDSS 2014 · February 2014 — [slides] [demo1] [demo2]

2013

• Arnis Parsovs. Estonian eID Security: Open Issues.
  Presentation · SK annual conference, Tallinn · November 2013
• Arnis Parsovs. Secure Electronic Signature – Secure in the Absence of an Attacker (in Latvian).
  Presentation · LATA Conference "Security and Openness", Riga, Latvia · January 2013

2012

• Arnis Parsovs. Security Analysis of Internet Bank Authentication Protocols and their Implementations.
  MSc thesis · Tallinn University of Technology · June 2012 — [slides] [page and demo]