eIDAS: Building Trust or Invading Privacy?
epicenter.works
We analysed the new technical framework for the European Digital Identity Wallet, revealing severe shortcomings that threaten user privacy and contradict the regulation's intent.

cross-posted from: https://feddit.org/post/317047

in February 2024, the EU Parliament adopted the eIDAS regulation, creating the framework for a "European Digital Identity Wallet". This digital Wallet will enable citizens to identify themselves in a legally binding manner, both online and offline, sign documents, login into websites and share personal data about them with others. Recently, the European Commission published the Architectural Reference Framework (ARF) 1.4 for the technical implementation of the Wallet.

The success of the EU Digital Identity Wallet depends on its ability to gain citizens' trust and establish a resilient infrastructure in our current data-driven economy.

"However, after our analysis, we believe that this goal has been missed," says the digital rights group Epicenter Works.

"We see severe shortcomings in the ARF that either contradict the regulation or ignore important elements of it. These issues, if left unaddressed, could significantly undermine user rights and privacy."

  • originalfrozenbanana@lemm.ee
    ·
    5 months ago

    No you’re right. The ARF just ignored that constraint and intentionally built in a back door here. From the linked article:

    However, the current ARF stipulates that law enforcement authorities can retroactively trace pseudonyms back to their legal identity. The provisions therefore „strongly contradicts the legal requirements,“ epicenter.works writes.

    • huginn@feddit.it
      ·
      5 months ago

      Agreed that law enforcement should not be involved but the quote I posted was also from the article and it seems impossible.

        • huginn@feddit.it
          ·
          5 months ago

          It's impossible to do without exposing a private signing cert to everyone, yes. That's the issue.

          You can't do asymmetric key signing anonymously and with a central issuer.

          So either you have to just trust the assertions (0 security) or you have to have a trusted issuer (not anonymous)

          A pseudonym issuer is a trusted issuer. There's no way to do it otherwise. You have to trust someone to make this kind of system work.