Exposure Notification

To generate encounter identifiers, first a persistent 32-byte private Tracing Key (${\displaystyle tk}$) is generated by a client. From this a 16 byte Daily Tracing Key is derived using the algorithm ${\displaystyle dtk_{i}=HKDF(tk,NULL,{\text{'CT-DTK'}}||D_{i},16)}$, where ${\displaystyle HKDF({\text{Key, Salt, Data, OutputLength}})}$ is a HKDF function using SHA-256, and ${\displaystyle D_{i}}$ is the day number for the 24-hour window the broadcast is in starting from Unix Epoch Time. These generated keys are later sent to the central reporting server should a user become infected.[26]

From the daily tracing key a 16-byte temporary Rolling Proximity Identifier is generated every 10 minutes with the algorithm ${\displaystyle RPI_{i,j}={\text{Truncate}}(HMAC(dtk_{i},{\text{'CT-RPI'}}||TIN_{j}),16)}$, where ${\displaystyle HMAC({\text{Key, Data}})}$ is a HMAC function using SHA-256, and ${\displaystyle TIN_{j}}$ is the time interval number, representing a unique index for every 10 minute period in a 24-hour day. The Truncate function returns the first 16 bytes of the HMAC value. When two clients come within proximity of each other they exchange and locally store the current ${\displaystyle RPI_{i,j}}$ as the encounter identifier.[26]

Once a registered health authority has confirmed the infection of a user, the user's Daily Tracing Key for the past 14 days is uploaded to the central reporting server. Clients then download this report and individually recalculate every Rolling Proximity Identifier used in the report period, matching it against the user's local encounter log. If a matching entry is found, then contact has been established and the app presents a notification to the user warning them of potential infection.[26]

Unlike version 1.0 of the protocol, version 1.1 does not use a persistent tracing key, rather every day a new random 16-byte Temporary Exposure Key (${\displaystyle tek_{i}}$) is generated. This is analogous to the daily tracing key from version 1.0. Here ${\displaystyle i}$ denotes the time is discretized in 10 minute intervals starting from Unix Epoch Time. From this two 128-bit keys are calculated, the Rolling Proximity Identifier Key (${\displaystyle RPIK_{i}}$) and the Associated Encrypted Metadata Key (${\displaystyle AEMK_{i}}$). ${\displaystyle RPIK_{i}}$ is calculated with the algorithm ${\displaystyle RPIK_{i}=HKDF(tek_{i},NULL,{\text{'EN-RPIK'}},16)}$, and ${\displaystyle AEMK_{i}}$ using the algorithm${\displaystyle AEMK_{i}=HKDF(tek_{i},NULL,{\text{'EN-AEMK'}},16)}$.[27]

From these values a temporary Rolling Proximity Identifier (${\displaystyle RPI_{i,j}}$) is generated every time the BLE MAC address changes, roughly every 15–20 minutes. The following algorithm is used: ${\displaystyle RPI_{i,j}=AES128(RPIK_{i},{\text{'EN-RPI'}}||{\mathtt {0x000000000000}}||ENIN_{j})}$, where ${\displaystyle AES128({\text{Key, Data}})}$ is an AES cryptography function with a 128-bit key, the data is one 16-byte block, ${\displaystyle j}$ denotes the Unix Epoch Time at the moment the roll occurs, and ${\displaystyle ENIN_{j}}$ is the corresponding 10-minute interval number. Next, additional Associated Encrypted Metadata is encrypted. What the metadata represents is not specified, likely to allow the later expansion of the protocol. The following algorithm is used: ${\displaystyle {\text{Associated Encrypted Metadata}}_{i,j}=AES128\_CTR(AEMK_{i},RPI_{i,j},{\text{Metadata}})}$, where ${\displaystyle AES128\_CTR({\text{Key, IV, Data}})}$ denotes AES encryption with a 128-bit key in CTR mode. The Rolling Proximity Identifier and the Associated Encrypted Metadata are then combined and broadcast using BLE. Clients exchange and log these payloads.[27]

Once a registered health authority has confirmed the infection of a user, the user's Temporary Exposure Keys ${\displaystyle tek_{i}}$ and their respective interval numbers ${\displaystyle i}$ for the past 14 days are uploaded to the central reporting server. Clients then download this report and individually recalculate every Rolling Proximity Identifier starting from interval number ${\displaystyle i}$, matching it against the user's local encounter log. If a matching entry is found, then contact has been established and the app presents a notification to the user warning them of potential infection.[27]

Version 1.2 of the protocol is identical to version 1.1, only introducing minor terminology changes.[27]

Some countries, such as France, have pursued centralized approaches to digital contact tracing, in order to maintain records of personal information that can be used to assist in investigating cases.[29][115] The French government asked Apple in April 2020 to allow apps to perform Bluetooth operations in the background, which would allow the government to create its own system independent of Exposure Notification.[116]

On August 9, the Canadian province of Alberta announced plans to migrate to the EN-based COVID Alert from its BlueTrace-based ABTraceTogether app.[75][117] This did not occur, and on November 6 Premier of Alberta Jason Kenney announced that the province would not do so, arguing that ABTraceTogether was "from our view, simply a better and more effective public health tool", and that they would be required to phase out ABTraceTogether if they did switch.[118] British Columbia has also declined to adopt COVID Alert, with provincial health officer Bonnie Henry stating that COVID Alert was too "non-specific".[118]

Australia's officials have stated its COVIDSafe, which is based on Singapore's BlueTrace, will not be shifting from manual intervention.[119][120]

In the United States, states such as California and Massachusetts declined to use the technology, opting for manual contact tracing.[121] California later reversed course and adopted the system in December 2020.[97][98]

Chinese vendor Huawei (which cannot include Google software on its current Android products due to U.S. sanctions) added a OS-level DP-3T API known as "Contact Shield" to its Huawei Mobile Services stack in June 2020, which the company states is intended to be interoperable with Exposure Notification.[122]