eID Mongolia¶
Production · Layer 1 — Identity / PKI core ·
Repo: eid-platform-mn · eidmongolia.mn
Mongolia's national eID platform (in the Smart-ID / eIDAS mould). Every authentication and every signature in the ecosystem ultimately rests here. One codebase serves both the eID Mongolia and the Gerege brands through app variants.
What it does¶
- Identifies and authenticates citizens — by QR code, mobile deep link, or a push sent to the holder of a given national ID number.
- Legally valid signatures — PAdES signatures on PDF, with RFC 3161 timestamps.
- The full certificate lifecycle — issuance (CA), validity checking (OCSP/CRL), revocation.
- KYC — verified through DAN, with a liveness check by facial recognition.
Core cryptographic design¶
2-of-2 threshold ECDSA¶
The private signing key does not exist in one piece anywhere. It is split in two: one share on the user's phone, the other on the server. Producing a signature requires both parties (a three-round variant of the Lindell protocol).
What that means: a stolen phone cannot produce a signature, and neither can a compromised server. Neither side alone can sign on the user's behalf.
Dual key, dual certificate¶
Every citizen holds two certificates:
| Certificate | PIN | Purpose |
|---|---|---|
| Authentication | PIN1 | Signing in to a system |
| Signing | PIN2 | Legally valid signature |
That separation matters: signing in never means the user agreed to something. A signature demands a separate PIN, a separate key and separate consent — which is the basis of non-repudiation.
Identifiers¶
| Type | Format | Basis |
|---|---|---|
| Natural person | PNOMN-<civil_id> |
ETSI ID standard |
| Organisation | NTRMN-<registration> |
ETSI ID standard |
The internal identifier is civil_id (the national ID number). For the rules
on identifier casing, see
Platform conventions.
Structure¶
| Part | Technology | Role |
|---|---|---|
server/ |
Go (chi + pgx) | RP-API backend: enrolment, threshold signing, CA/OCSP/CRL, admin, KYC |
web/ |
Next.js | Browser RP demo — QR / push login and signing |
admin/ |
Next.js | Admin console — RP / user / certificate / session management |
ios/ |
Swift | GeregeSmartID SPM SDK + the eID Mongolia app |
android/ |
Kotlin / Compose | mn.eidmongolia.smartid SDK + sample app |
desktop/ |
Swift + .NET | macOS / Windows RP client + USB token kit |
sdk/ |
TypeScript | Web SDK for the RP side |
PKI services¶
| Service | Address | Description |
|---|---|---|
| CA | eidmongolia.mn |
Certification authority |
| OCSP | ocsp.eidmongolia.mn |
Real-time certificate validity checking |
| CRL | published by the CA | Certificate revocation list |
| TSA | tsa.timeserver.mn |
RFC 3161 timestamping |
Key protection: HSMs are used — an on-premise device and a cloud HSM configured to fail over to one another.
The CA role for X-Road
eID Mongolia also acts as the trust service (CA, OCSP) for X-Road Mongolia. Layer 1 therefore supplies layer 0 with its root of trust — the one downward dependency the ecosystem permits.
Ways to integrate (as an RP)¶
A third party can connect to eID in two ways.
1. Through the SSO (recommended). The application connects to Gerege SSO as an OIDC RP, and eID authentication happens at the SSO. In most cases this is the right choice — you write no PKI code, only standard OIDC.
2. As a direct RP. When deep integration is required — for instance embedding the eID flow inside your own mobile app — you register as an RP directly with eID. In that case you use the iOS / Android / TypeScript SDKs.
The RP ↔ rp_app rule
Only the RP is registered with eID. If one RP covers several apps or
subsystems, pass them through the rp_app / rp_app_url fields — logs and
the user's own screen will then show which app made the request. There is no
need to register a separate RP per app.
Wire compatibility¶
The Go server, the iOS SDK and the Android SDK all speak one fixed protocol. Cryptographic serialisation must be byte-identical on every side. That contract is locked down with frozen golden vectors — see Technology stack for the detail.
Full documentation¶
The platform's complete technical documentation (RP integration steps, SDK
reference, PKI/CA onboarding, the admin console guide) lives in its own
documentation site inside the eid-platform-mn repo. The main chapters:
- Concepts — the two-certificate eID · Identifiers · Personal PKI
- Integration (RP) — RP integration · Gerege integration · RP subsystems · TypeScript SDK · Web RP demo · Onboarding organisations
- Client SDKs / apps — iOS · Android · biometric keys · macOS · Windows · USB token kit
- Operators — Admin console · Multilingual support
- PKI / CA — CA onboarding · Passport passive authentication · Face recognition