Temporary Contact Numbers Protocol

Developed by	TCN Coalition, incl.Covid Watch[1] and CoEpi[2]
Introduced	March 17, 2020 (2020-03-17)[3]
Industry	Exposure Notification
Physical range	~10 m (33 ft)[4]

TheTemporary Contact Numbers Protocol, orTCN Protocol, is anopen source,decentralized, anonymousexposure alert protocol developed byCovid Watch^[1] in response to theCOVID-19 pandemic.^[5][6][7][8] The Covid Watch team, started as an independent research collaboration betweenStanford University and theUniversity of Waterloo was the first in the world to publish awhite paper,^[9] develop,^[3] and open source^[10] fully anonymous Bluetooth exposure alert technology in collaboration with CoEpi^[2] after writing a blog post^[11] on the topic in early March.

Covid Watch's TCN Protocol received significant news coverage^[12] and was followed by similar decentralized protocols in early April 2020 likeDP-3T, PACT,^[13] and Google/AppleExposure Notificationframework. Covid Watch then helped other groups like theTCN Coalition and MIT SafePaths^[14] implement the TCN Protocol within their open source projects to further the development of decentralized technology and foster global interoperability of contact tracing and exposure alerting apps, a key aspect of achieving widespread adoption.^[15] Covid Watch volunteers and nonprofit staff also built a fully open source mobile app for sending anonymous exposure alerts first using the TCN Protocol^[16] and later using the very similar Google/Apple Exposure Notification Framework (ENF).^[17][18]

The protocol, likeBlueTrace and theGoogle / Apple contact tracing project, useBluetooth Low Energy to track and log encounters with other users.^[19][20][21] The major distinction between TCN and protocols like BlueTrace is the fact the central reporting server never has access to contact logs nor is it responsible for processing and informing clients of contact.^[22][23] Because contact logs are never transmitted to third parties, it has major privacy benefits over approaches like the one used in BlueTrace.^[24][25][26] This approach however, by its very nature, does not allow for human-in-the-loop reporting, potentially leading to false positives if the reports are not verified by public health agencies.^{[19]: p. 6}

The TCN protocol received notoriety as one of the first widely released digital contact tracing protocols^[15][27][28] alongside BlueTrace,^[29] the Exposure Notification framework, and thePan-European Privacy-Preserving Proximity Tracing (PEPP-PT) project.^[30][31] It also stood out for its incorporation ofblockchain technology,^[32] and its influence over the Google/Apple project.^{[33][20][34][35][36]}

The TCN protocol works off the basis of Temporary Contact Numbers (TCN), semi-random identifiers derived from a seed.^[37] When two clients encounter each other, a unique TCN is generated, exchanged, and then locally stored in a contact log.^[38] Then, once a user tests positive for infection, a report is sent to a central server. Each client on the network then collects the reports from the server and independently checks their local contact logs for a TCN contained in the report. If a matching TCN is found, then the user has come in close contact with an infected patient, and is warned by the client. Since each device locally verifies contact logs, and thus contact logs are never transmitted to third parties, the central reporting server cannot by itself ascertain the identity or contact log of any client in the network. This is in contrast to competing protocols like BlueTrace, where the central reporting server receives and processes client contact logs.^[39]

The entire protocol is based on the principle oftemporary contact numbers (TCN), a unique and anonymous 128-bit identifier generated deterministically from a seed value on a client device. TCNs are used to identify people with which a user has come in contact, and the seed is used to compactly report infection to a central reporting server. TCN reports are authenticated to be genuine by a secret held only by the client.

To generate a TCN, first areport authorization key (RAK) andreport verification key (RVK) are created as the signing and verification keys of a signature scheme (RAK-RVK pair). In the reference implementation this pair is created using theEd25519 signature scheme.^{[40]: line. 13} Then, using the RAK an initialtemporary contact key (TCK) is generated using the algorithm${\displaystyle tc{k}_0=H\mathrm{\_}tck(rak)}$, where${\displaystyle H\mathrm{\_}tck()}$ is theSHA-256hash function as${\displaystyle H\mathrm{\_}tck(s)=SHA256(\text{b'H}\mathrm{\_}\text{TCK'}||s)}$. This TCK is not used to generate any TCNs, but is used in the next TCK; where all future TCKs are calculated using the algorithm${\displaystyle tc{k}_i=H\mathrm{\_}tck(rvk||tc{k}_{i-1})}$. A 128 bit TCN is then generated from a given TCK using the algorithm${\displaystyle tc{n}_{i>0}=H\mathrm{\_}tcn(le\mathrm{\_}u16(i)||tc{k}_i)}$, where${\displaystyle le\mathrm{\_}u16()}$ formats a supplied number as alittle endian unsigned 2 byte integer,^[41] and${\displaystyle H\mathrm{\_}tcn()}$ is the SHA-256 hash function as${\displaystyle H\mathrm{\_}tcn(s)=SHA256(\text{b'H}\mathrm{\_}\text{TCN'}||s)[0:128]}$. The following diagram demonstrates the key derivation process:

TCNs are unique to each device encounter, and RAK-RVK pairs are cycled at regular intervals to allow a client to report only specific periods of contact.

When a client wishes to submit a report for the TCN indices${\displaystyle s>0}$ to${\displaystyle e}$, it structures the report as${\displaystyle report=rvk||tc{k}_{s-1}||le\mathrm{\_}u16(s)||le\mathrm{\_}u16(e)||memo}$. A signature is then calculated using the RAK, and it is transmitted to the server as${\displaystyle s\mathrm{\_}report=report||sig}$.

Because any given TCK can only be used to derive an equal or higher indexed TCNs, by submitting${\displaystyle tc{k}_{s-1}}$ no encounters prior to${\displaystyle tc{n}_{s-1}}$ can be calculated. However, there is no upper limit to encounters calculated using the same RAK-RVK pair, which is why they are cycled often. To prevent clients calculating unused TCNs,${\displaystyle e}$ indicates the last TCN index generated with the given RVK.^{[42]: lines. 49–61} Additionally, since the RVK is used to calculate a TCK, and${\displaystyle tc{k}_{s-1}}$ is provided, no valid TCNs in the reporting period can be derived from an illegitimate report. The only correct TCN calculable from a mismatched RVK and${\displaystyle tc{k}_{s-1}}$ is${\displaystyle tc{n}_{s-1}}$, the TCN before the start of the reporting period.

Once a report is received, clients individually recalculate TCKs and TCNs for a given period using the original algorithms:$${\displaystyle \begin{array}{l}tc{k}_s=H\mathrm{\_}tck(rvk||tc{k}_{s-1})\\ tc{n}_s=H\mathrm{\_}tcn(le\mathrm{\_}u16(s)||tc{k}_s)\\ tc{k}_{s+1}=H\mathrm{\_}tck(rvk||tc{k}_s)\\ tc{n}_{s+1}=H\mathrm{\_}tcn(le\mathrm{\_}u16(s+1)||tc{k}_{s+1})\\ ...\\ tc{k}_e=H\mathrm{\_}tck(rvk||tc{k}_{e-1})\\ tc{n}_e=H\mathrm{\_}tcn(le\mathrm{\_}u16(e)||tc{k}_e)\end{array}}$$This is used by client devices to check their local contact logs for potential encounters with the infected patient, but has the dual benefit of verifying reports since false reports will never produce matching TCNs.

In the report structure, the memo is a space for freeform messages that differ between TCN implementations. The section is between 2 and 257 bytes, and made up of a tag identifying the specific implementation, as well as a data and data length pair. It is formatted as${\displaystyle memo=tag||len(data)||data}$. The data is standardized for different tags, and can be as follows:

The protocol can be divided into two responsibilities: an encounter between two devices running TCN apps, and the notification of potential infection to users that came in contact with a patient. For the purposes of this specification, these areas are named theencounter handshake, andinfection reporting. Theencounter handshake runs on Bluetooth LE and defines how two devices acknowledge each other's presence. Theinfection reporting is built onHTTPS and defines how infection notices are distributed among clients.

When two devices come within range of each other, they exchange a handshake containing TCNs. In order to achieve this the encounter handshake operates in two modes (both with two sub-modes), broadcast oriented and connection oriented. Broadcast oriented operates using the modes broadcaster and observer, while connection oriented operates using peripheral and central. The two modes are used to circumvent certain device limitations, particularly in regard to iOS restrictions in place before version 13.4.^[43] In both modes the protocol is identified with the 16 bitUUID0xC019.

In broadcast mode, a broadcaster advertises a 16-byte TCN using the service data field of the advertisement data. The observer reads the TCN from this field. In connection-oriented mode, the peripheral advertises using the UUID. The service exposes a read and writeable packet for sharing TCNs. After sharing a TCN, the central disconnects from the peripheral.

When a user tests positive for infection, they upload a signed report, allowing the past 14 days of encounters to be calculated, to a central server. On a regular basis, client devices download reports from the server and check their local contact logs using the verification algorithm. If there is a matching record, the app notifies the user to potential infection.

On 5 April 2020, the globalTCN Coalition was founded by Covid Watch and other groups that had coalesced around what was essentially the same approach and largely overlapping protocols, with the goal to reduce fragmentation, and enable global interoperability of tracing and alerting apps, a key aspect of achieving widespread adoption.^[44] The TCN Coalition also helped establish theData Rights for Digital Contact Tracing and Alerting framework, which functions as a bill of rights for users of such apps.^[45]

Currently the protocol is used by TCN Coalition membersCoEpi^[46][47] andCovid Watch,^[48][22] and was likely a source of inspiration for the similarGoogle / Apple contact tracing project.^[35][34]

• BlueTrace
• Google / Apple contact tracing project
• Pan-European Privacy-Preserving Proximity Tracing

• Covid WatchArchived 2020-04-17 at theWayback Machine
• TCN CoalitionArchived 2021-07-04 at theWayback Machine
• Specification and reference implementation

• Application layer protocols
• Software associated with the COVID-19 pandemic
• Bluetooth software
• Medical software
• Android (operating system) software
• IOS software
• 2020 software
• Software using the MIT license
• Digital contact tracing protocols
• Digital contact tracing protocols with decentralized reporting

• CS1: unfit URL
• CS1 maint: multiple names: authors list
• All articles with dead external links
• Articles with dead external links from March 2023
• Articles with permanently dead external links
• Articles with short description
• Short description matches Wikidata
• Webarchive template wayback links