A tool was created to let the people update their ID cards to use elliptic curve cryptography, it will be made public in november. Some time after that all the older certs will be revoked.
If they just revoked all the affected certs right now then there would be an outrage.
Also cosider that it would currently take around $80k (and some non-negligibe time) to break one single pair of certificate (and thus a person's identity and signature) stored on one card.
That's not to say that everyone's safe, but before the attack becomes properly feasable (and it will be), everyone will be upgraded or revoked.
The $80k figure comes from the PR of the gov agency (RIA) responsible for the ID card infra. I'd take it with a grain of salt.
The affected Estonian ID cards use 2048-bit RSA keys. If you look at the Ars Technica link then they are quoted:
the worst case for a 2048-bit one would require no more than 17 days and $40,300 using a 1,000-instance machine on Amazon Web Service ... On average, it would require half the cost and time to factorize the affected keys.
I assume this is calculated based on the standard EC2 prices ($40300/key with 17 days and 1k machines). If you'd use EC2 spot instances (or the relevant Google or Microsoft services - or any other of the vastly cheaper alternatives) then the cost comes down to about €5k (and 8 days with 1k low-tier EC2 machines) for a single key pair (on average, worst case is 2x that much).
I'm not the one to judge if that's cheap or expensive enough to not worry about anybody ever breaking a key. I just have to point out that this key is equivalent to a real signature and documents signed with it (also cast votes etc) are legally binding. In case of a breached private key, there's no (known) way to prove if it was you who signed some documents or an attacker.
And there's currently no publicly announced plan/date for revoking the affected certs. There's a tool coming out in November that you can use to generate new certs for your own ID card but as it's not compulsory, don't expect 100% of affected people to update in a matter of days, weeks or months.
Aren't these cards in Estonia used for a LOT of things, like banking access? EG: at 50k it's probably not profitable to do this per-user but at 5k it is probably VERY profitable if you could get enough public keys.
Even a single ID card can be valuable - factor a big company CEO's private key, log in to his company's bank, start making transfers to places where the money does not come back from.
You are correct. I stated it as a fact whereas I was just assuming there are vastly cheaper alternatives to AWS to do such nefarious things such as renting machines in a botnet, using dedicated HW that you might have anyway around for coin mining etc.
If they just revoked all the affected certs right now then there would be an outrage.