EUDI Wallet: A pockets beefy of loopholes

The digital pockets is a carried out deal. The eIDAS reform came into power in Also can fair. By autumn 2026, all EU member states have to offer their electorate a so-known as „European Digital Identity Wallet“ (EUDI pockets), which they can employ to name themselves online and offline.

Primarily primarily primarily based on the EU law, the pockets have to level-headed be voluntary, free of sign, and above all, stable. Users have to level-headed also procure a diagram to transparently settle which data they fragment with whom. But how can this be implemented technically? And how can a data protection-compliant replace between electorate, authorities, and corporations protect shut place?

An authority personnel is at the second looking for answers to these questions as segment of the European Digital Identity Project. They are rising an Architecture and Reference Framework (ARF) in shut coordination with the EU Commission. The framework is segment of a „toolbox“ that the member states are rising together. The closing ARF model defines technical specifications, pointers, and procedures for the implementation of the eIDAS reform. Just a few weeks ago, the mission published model 1.4 of the ARF.

The updated specifications hang met with big criticism from the civil rights organisation epicenter.works. They accuse the mission of ignoring and thus undermining key provisions of the eIDAS Law. The framework threatens to undo the achievements in predominant rights that hang been painstakingly negotiated in the political course of.

Namely, epicenter.works criticizes recent loopholes in data replace, an eroded noble to pseudonymity, and gaps in unobservability and unlinkability.

Extra data outflow than permitted

The ARF itself states: „This memoir itself is no longer legally binding.“ Absolute most practical the regulations adopted, comparable to eIDAS and linked noble acts, are binding.

The eIDAS reform strictly regulates employ cases to guard customers‘ data from unauthorised gain entry to by others. To illustrate, relying parties have to level-headed most tremendous procure a diagram to retrieve the tips from the wallets that they are authorised to gain by law.

This entails the client’s contact facts or the member country in which they are residing. In addition, the relying gain together must be clear with the client about which data it’s a long way retrieving from the pockets and for what purpose. Upfront, relying parties have to register in the respective EU member states and expose which data they’ll search data from from customers. Here’s supposed to make certain that customers never expose more data than required by the law.

Though the text of the eIDAS Law is unambiguous here – epicenter.works refers to Articles 5a and 5b of the Law – the ARF would now not at the second present any technical specifications that would prevent corporations from soliciting for more data from customers than they are allowed to. In truth, the framework would „merely ignores“ the linked paragraphs, primarily primarily based on epicenter.works. Nonetheless, if the sure noble necessities are most tremendous implemented inadequately, it’s a long way unnecessary for relying parties to have to register upfront, the NGO criticises.

Pseudonymity eroded

In expose to manual sure of overidentification, the reformed eIDAS Law also stipulates that customers can repeatedly employ a pseudonym if they don’t appear to be obliged to expose their noble identity. This permits customers to substantiate an identity with the pockets with out disclosing private data. Identifying themselves with their noble identity is then most tremendous well-known to commence a checking myth, as an example.

Nonetheless, the brand new ARF stipulates that law enforcement authorities can retroactively sign pseudonyms abet to their noble identity. The provisions therefore „strongly contradicts the noble necessities,“ epicenter.works writes.

„The noble to pseudonymity protects us from corporations like Facebook or Schufa forcing us to expose our civil identity,“ says Thomas Lohninger from epicenter.works to netzpolitik.org. „Nonetheless, when enforcing this noble, a backdoor used to be built in that permits law enforcement authorities to sign every pseudonym abet to a unswerving person.“

Commission eliminates tips on pseudonyms

The categorical specifications that the expert personnel will impact listed below are at the second hidden from the public. The Commission has removed the so-known as Pseudonym Rule Ebook from the repository. It contains teach necessities on how pseudonyms are to be outdated college all the diagram thru the EUDI pockets.

In accordance to an enquiry from netzpolitik.org, the Commission announced that it had agreed with consultants from the Member States in the eIDAS Professional Neighborhood that the pseudonym rule guide have to level-headed be additional developed sooner than publication on GitHub. This course of is at the second underway.

In expose to facilitate a public discussion on the necessities of the ARF, we are publishing the deleted model of the Pseudonym Rule Ebook in beefy text.

Experts invent „Pseudonym Provider“

The ARF also deviates severely from the noble text in diverse respects by inventing the thought of a pseudonym provider with out additional ado, as epicenter.works writes. Such an occasion is no longer equipped for in the law. As a substitute, pseudonyms are to be created and saved in the community on customers‘ discontinue gadgets. Nonetheless, primarily primarily based on ARF, an external entity is now to impact pseudonyms for customers – which authorities can then resolve to a unswerving title.

Nonetheless, the ARF „would impact the EUDI pockets to a instrument for indiscriminate mass surveillance and authoritarian alter, incompatible with the Charter of Major Rights and the eIDAS Law,“ writes epicenter.works in its prognosis. „Every employ of the pockets would possibly perhaps be monitored by the pronounce,“ fears Thomas Lohninger. „It affords the affect of a conceal-up, because we most tremendous know about it thru a leak. The linked memoir ‚Pseudonyms Rule Ebook‘ used to be half-heartedly removed from the Commission’s online page.“

Any point out of a pseudonym provider must be removed from the principles and regulations, demands epicenter.works. In addition, most tremendous in the community generated pseudonyms which would possibly perhaps possibly be saved in encrypted invent in the pockets and can not be linked to the noble identity of a consumer have to level-headed be outdated college.

Unobservability would now not occur

In expose to guard the rights of pockets customers, the eIDAS Law also affords for the principles of „unobservability“ and „unlinkability“ of data.

Unobservability skill that pockets companies are no longer allowed to leer or procure the tips saved in the wallets. Absolute most practical the customers have to level-headed procure a diagram to appear from the pockets which transactions they’ve implemented.

Nonetheless, this requirement is no longer talked about wherever in the ARF, criticizes epicenter.works. The framework also contains „contains no safeguard of any form to forestall the tracking, linking, correlating or otherwise acquiring facts about concrete employ behaviour,“ primarily primarily based on the NGO.

Insufficient unlinkability

The second theory of „unlinkability“ states that diverse identification processes would possibly perhaps additionally fair no longer be blended. In concrete phrases, this means that if an particular person time and all every other time purchases alcohol in the similar store and proves their age the employ of a pockets, as an example, the seller would possibly perhaps additionally fair no longer hyperlink the a form of transactions together in expose to be conscious the shopping behavior of this person over a longer time frame.

From epicenter.works‘ point of leer, the ARF has main gaps. The law is terribly sure. The ARF must „enable privacy keeping ways which make certain unlinkability, where the attestation of attributes would now not require the identification of the client.“

The ARF would now not meet this requirement, criticises epicenter.works. The precautions envisaged by the ARF would „neither unlinkability with admire to Identity Provider and Relying Event, nor across presentation to the similar Relying Event.“

A world personnel of cryptographers made a similar criticism of the ARF a few days ago. They criticised the indisputable truth that the brand new proposal affords for encryption techniques that can not meet the necessities of the eIDAS reform. Primarily primarily primarily based on the consultants, the danger can not be solved speedily. As a substitute, mainly diverse cryptographic solutions are wished to guard customers‘ data.

For Thomas Lohninger, the considerations now wander a long way beyond technical factors. „Our trust in the total eIDAS course of has been severely shaken by this proposal. The legally enshrined rights of the population hang merely been neglected by the Commission and the Member States,“ says Lohninger. „If the technical implementation of the pockets is no longer very a lot improved, we’ll be forced to protect shut noble action against it sooner than the European Court of Justice and urgently warn the public against the pockets.“

Das „Pseudonym Rule Ebook“ in Volltext:

Pseudonym Rule Ebook
for the EUDI Wallet ecosystem

• Author Ni-Scy
• Version: 1.0
• Date: 2023-10-17
• Build: Draft
• Classification: Proprietary

Version history

Alternate history  

Table of Contents

1 INTRODUCTION
1.1 Context and scope
1.2 File structure
1.3 Key words
1.4 Terminology
2 USE CASES, REQUIREMENTS, AND IMPLEMENTATION
2.1 Use cases
2.2 Requirements
2.2.1 Requirements for a User pseudonym
2.2.2 Requirements for a User alias
2.3 Pseudonymization draw
2.4 Barriers
2.5 Risks
3 PSEUDONYM ATTRIBUTE SCHEMA
3.1 Pseudonym attestations and Pseudonym Issuers
3.2 File form and namespace
3.2.1 EU-large memoir form and namespace for pseudonyms
3.2.2 Home pseudonym namespaces
3.3 Pseudonym attributes
3.3.1 Introduction and overview
3.3.2 Attribute user_pseudonym
3.3.3 Attribute user_alias
3.4 Attribute encodings
3.4.1 Introduction
3.4.2 ISO/IEC 18013-5-compliant encoding
3.4.2.1 Encoding principles
3.4.3 SD-JWT-compliant encoding
3.4.3.1 Encoding principles
4 TRUST INFRASTRUCTURE DETAILS
4.1 Introduction
4.2 ISO/IEC 18013-5-compliant Pseudonym attestations
4.2.1 OIDs to be used in Pseudonym-linked certificates
4.2.2 Depended on Issuer Checklist
4.3 SD-JWT-compliant Pseudonym attestations
5 REFERENCES

1 Introduction

1.1 Context and scope

This memoir is the Pseudonym Rule Ebook for the EUDI Wallet ecosystem. It contains necessities teach to the Pseudonym attestations all the diagram thru the EUDI Wallet. These necessities are additional to the necessities in the Architecture Reference Framework (ARF), procure out about [ARF]. Requirements in the ARF capture for all attestations in the EUDI Wallet.

This memoir specifies a single invent of pseudonym, which would possibly perhaps be issued by a Pseudonym Issuer to a User having a Wallet Instance. In theory, there are many diverse parties which would possibly perhaps possibly procure a diagram to offer a pseudonym to a citizen; as an example, a Relying Event would possibly perhaps additionally very well procure a diagram to impact so, or a Wallet Instance would possibly perhaps possibly. Nonetheless, the added price (to Users and Relying Events) of the employ of a pseudonym attestation as outlined in this memoir is that the Issuer have to verify the identity of the User throughout the issuance course of of the pseudonyms. Seek allotment 3.1 for the necessities on pseudonym attestations and Pseudonym Issuers.

There are many diverse employ cases for which a Relying Event would possibly perhaps additionally fair employ a pseudonym. As a , there are many purposeful and security necessities that a pseudonym (or the pseudonymization draw) would possibly perhaps additionally fair have to be conscious in expose to meet these employ cases. The pseudonymization draw outlined in this memoir is no longer designed to fit all that you would additionally recall to mind employ cases and to appear the least bit that you would additionally recall to mind necessities. Quite, it’s a long way supposed to beef up a customary employ case, particularly allowing a Relying Event to acknowledge a User as somebody about whom the Relying Event already is conscious of one thing, or with whom the Relying Event has interacted sooner than. Chapter 2 discusses this employ case in extra ingredient and describes the necessities the pseudonym outlined in this memoir complies with. Member States (or diverse attestation Issuers) MAY specify and implement additional pseudonyms and pseudonymization techniques, possibly with diverse traits, and add these to their domestic pseudonym namespace; procure out about allotment 3.2.2. The necessities in this memoir impact no longer apply to such domestic pseudonyms.

Member States SHALL make certain that every person Users of a salubrious Wallet Instance, if they so need, are able to gain a pseudonym attestation as outlined in this memoir and are able to open their pseudonym values to Relying Events.

1.2 File structure

This Pseudonym Rule Ebook contains the following subject issues:

• Chapter 2 describes that you would additionally recall to mind employ cases for pseudonyms, as well as the necessities for the pseudonymization draw specified by this memoir.
• Chapter 3 specifies the pseudonym attribute schema:
  • Explanations and necessities for pseudonym attestations and Pseudonym

Issuers o File form and namespace for the EU-large pseudonyms discussed in this memoir.

• Two pseudonym attributes and encodings, one compliant with [ISO18013-5], the assorted compliant with [SD-JWT].

• Chapter 4 specifies some facts on the trust infrastructures wished for issuing and verifying pseudonym attestations.

Extra subject issues can be added to this Rulebook if and after they are identified.

1.3 Key words

This memoir uses the capitalized key words ‘SHALL’, ‘SHOULD’ and ‘MAY’ as specified by RFC 2119, i.e., to existing necessities, solutions and choices specified by this memoir.

In addition, ‘have to’ (non-capitalized) is outdated college to existing an external constraint, i.e., a requirement that is no longer mandated by this memoir, however, as an example, by an external memoir comparable to [ARF]. The note ‘can’ signifies a ability, whereas diverse words, comparable to ‘will’, and ‘is’ or ‘are’, are supposed as statements of truth.

1.4 Terminology

This memoir uses the terminology specified by [ARF]. In addition, this memoir specifies the following phrases:

2 Use cases, necessities, and implementation

2.1 Use cases

Pseudonyms would possibly perhaps additionally fair also be outdated college in many diverse employ cases. Customarily talking, these form of employ cases draw all the diagram down to a invent of User recognition. Recognition in this context skill matching an identifier for a User with (or linking it to) an existing document, possibly as a consequence of a outdated interaction. If User recognition succeeds, the document is alleged to belong to the User presenting the identifier.

A pseudonym is an identifier for a User, the price of which would now not recount one thing in regards to the unswerving-world traits of the User. Here’s what makes it diverse from identifiers comparable to title, date of starting up, nationality or gender, which clearly impact possess data in regards to the unswerving world. A pseudonym is a meaningless price, the most tremendous purpose of which is that a Relying Event would possibly perhaps additionally fair look it up in a database^[i].

One more vital facet of a pseudonym is that it’s a long way usable for User recognition in a exiguous arena most tremendous. In the context of this memoir, the price of a pseudonym is diverse for every Relying Event that receives it. Furthermore, the pseudonym values obtained by two diverse Relying Events for the similar User can not be linked. This means that the pseudonym price would possibly perhaps additionally fair also be outdated college most tremendous at the Relying Event that obtained it. Here’s what makes a pseudonym diverse from the authentic continual identifier in the PID of a Wallet Instance. The price of that identifier is autonomous from any Relying Event, and thus it’ll additionally fair also be outdated college for User recognition by all Relying Events (and diverse parties) that know its price.

Since the price of the pseudonym outlined in this memoir is diverse for every Relying Event, the Wallet Instance SHALL name and authenticate the Relying Event that requests the pseudonym. Relying Event authentication is specified by [RPAuth].

2.2 Requirements

2.2.1 Requirements for a User pseudonym

The pseudonymization draw specified by this memoir SHALL be conscious the following necessities:

1. At some stage in the issuance course of of the pseudonyms, the Pseudonym Issuer SHALL name the User the employ of an identity skill on Stage of Assurance High, as specified by the

Commission Enforcing Law (EU) 2015/1502, [2015/1502].^[ii]

• Rationale: As outlined in allotment 1.1 already, that is mainly its necessary added price when put next to pseudonyms issued by diverse parties, either all the diagram thru the EUDI Wallet ecosystem or commence air it.

2. A Relying Event SHALL NOT procure a diagram to web the User’s honest identity, or any data figuring out the User, from the pseudonym price obtained by the Relying Event.
   • Rationale: Here’s what makes a pseudonym a pseudonym, reasonably than an identifier.
3. The Wallet Instance SHALL repeatedly open the similar price for the pseudonym of a given User to a given Relying Event, except the User chooses to hang more than one pseudonyms for the similar Relying Event^[iii], or chooses to deactivate a pseudonym^[iv]. In diverse words, the pseudonym price SHALL NOT trade from presentation to presentation with out User intervention^[v],^[vi].
   • Rationale: Here’s well-known for allowing the Relying Event to make employ of the pseudonym for User recognition.
4. The Pseudonym Issuer SHALL make certain that pseudonyms possess passable entropy to impact the chance of colliding pseudonyms (this skill that two Users having the similar pseudonym price for the similar Relying Event) is negligible, even between pseudonyms issued by diverse Pseudonym Issuers.
   • Rationale: If pseudonym collision would possibly perhaps possibly occur in prepare, User recognition by the Relying Event would fail, since the bad User would be matched to an existing document.
5. The Wallet Instance SHALL allow the User to make employ of more than one pseudonym values at a given Relying Event. In diverse words, if desired by the User⁷, the Wallet Instance SHALL give the User the diagram to open one amongst the present pseudonym values already linked to this RP, or to open a ‘unused’ pseudonym price.
   • Rationale: A User would possibly perhaps additionally fair are desirous to hang more than one pseudonymous accounts with the similar Relying Event, as an example a industry myth and a private one.
6. The Wallet Instance SHALL allow the User to deactivate the pseudonym price for a given Relying Event. After the User has deactivated a pseudonym price, the Wallet

Instance SHALL NOT open that pseudonym price to any Relying Event anymore.
The Relying Event SHALL NOT be taught about this trade.

• Rationale: The User has the noble to be forgotten.

7. The Wallet Instance SHALL repeatedly open an even price for the pseudonym of a given User to diverse Relying Events^[vii].
   • Rationale: Here’s vital to make certain that colluding Relying Events can not employ the pseudonym values to be conscious the User.
8. It SHALL NOT be that you would additionally recall to mind to correlate pseudonym values primarily primarily based on their price ^[viii], this skill that that colluding Relying Events are no longer able to impact that pseudonyms released by a User to diverse Relying Events belong to the similar User.
   • Rationale: If this used to be that you would additionally recall to mind, it would possibly perhaps well probably defeat the aim of the employ of diverse pseudonym values and would allow colluding Relying Events to be conscious the User.
9. The Pseudonym Issuer SHALL procure a diagram to advise a pseudonym price to the Wallet Instance of a User with out radiant the identity of the Relying Event to which the Wallet Instance will open that price.
   • Rationale: This simplifies the issuing course of very a lot, as otherwise either
     • each and each recent pseudonym would need be issued factual-in-time; at the second the User uses their Wallet Instance for the first time at a teach Relying Event. The Wallet Instance would decide to talk about the Relying Event identifier to the Pseudonym Issuer, who would employ it to calculate the recent pseudonym price. The kind of course of would possibly result in longer transaction instances and is no longer usable if the Wallet Instance is offline.
     • or, alternatively, the Pseudonym Issuer would decide to advise a pseudonym to the User for a Relying Event with out radiant if the User will work alongside side that Relying Event. This would possibly perhaps possibly be that you would additionally recall to mind in some cases, however no longer customarily. It goes to additionally fair also result in the issuance of many pseudonyms that is no longer going to ever be outdated college.

10. The pseudonymization draw SHALL be openly specified, at the side of the enter data it takes and the cryptographic derivation functions outdated college.
    • Rationale: This permits any gain together, at the side of academia, to analyze the pseudonymization draw and procure vulnerabilities in it. If vulnerabilities are chanced on, they can additionally fair also be mounted. If they don’t appear to be chanced on, trust in the pseudonymization draw can be reinforced.

This memoir would now not specify a mechanism for associating a pseudonym to a Relying Event. It’s a long way as a lot as each and each Wallet Provider to define this kind of mechanism, as lengthy as the necessities above are complied with.

2.2.2 Requirements for a User alias

Besides the core necessities for pseudonyms specified by the outdated allotment, this allotment specifies a series of necessities for a User alias.

11. A Wallet Instance SHALL enable the User to freely capture a User alias for every and each pseudonym released to a Relying Event. An alias SHALL be a text string. Environment an alias SHALL be no longer obligatory for the User. The User SHALL procure a diagram to trade the alias for any pseudonym.
    • Rationale: Environment an alias helps the User to acknowledge and distinguish pseudonym values, which otherwise are meaningless sequences of symbols. Also, a Relying Event can employ the alias to, as an example, handle the User.
12. The Wallet Instance SHALL affiliate each and each pseudonym to at most one alias, however the User SHALL procure a diagram to make employ of the similar alias for more than one pseudonyms.
    • Rationale: Allowing more than one aliases for the similar pseudonym appears to be like pointless and confusing. It also begs the quiz how a Relying Event have to level-headed search data from more than one aliases.
13. A Relying Event SHALL NOT employ an alias for recognizing the User. o Rationale: Since it’s a long way freely chosen by the User, the alias is no longer guaranteed to hang any of the properties which would possibly perhaps possibly be required for the pseudonym in allotment 2.2.1.
14. The Wallet Instance SHALL NOT open an alias with out the corresponding pseudonym price.
    • Since the alias is no longer usable as a pseudonym, it’s a long way ineffective by itself.

This memoir would now not specify a mechanism for associating a pseudonym to an alias. It’s a long way as a lot as each and each Wallet Provider to define this kind of mechanism, as lengthy as the necessities above are complied with.

2.3 Pseudonymization draw

User pseudonyms as outlined in this memoir SHALL be issued by a Pseudonym Issuer, reasonably than the Wallet Instance. Here’s a of the requirement that the (honest) identity of the User is verified sooner than the pseudonyms are issued, the employ of an identity skill on Stage of Assurance High. A Wallet Instance can not impact that. One more purpose to no longer allow a Wallet Instance to generate pseudonyms and signal pseudonym attestations is that at the second it’s a long way complicated to evaluate whether or no longer a Wallet Instance is stable enough to impact this. Within the scope of this memoir, the linked security property would primarily possess the (pseudo) random number generator available in the market to the Wallet Instance, as the UUID specified by this memoir is randomly generated, and no longer derived from an underlying secret. Random number generation is difficult, in particular in constricted gadgets. Whether or no longer a Wallet Instance can securely impact this, would possibly perhaps additionally fair depend upon the chosen security structure. It appears to be like better to head away pseudonym generation and signing to an Issuer, who impact this securely no subject the properties of the Wallet Instance and the mobile software.

User pseudonyms as outlined in this memoir SHALL be pseudo-randomly generated UUIDs as outlined in RFC 4122, [RFC4122]. Pseudonym Issuers SHALL space the variant of each and each UUID to ‘10x’b, as specified by allotment 4.1.1 of [RFC4122], and SHALL space the model to 4, as specified by allotment 4.1.3. Pseudonym Issuers SHALL make certain the tremendous of the pseudorandom numbers generated to be used in the pseudonyms by the employ of a Cryptographically Stable PseudoRandom Number Generator (CSPRNG)^[ix].

Pseudonym Issuers SHALL advise one or more pseudonym attestations (procure out about allotment 3.1) to a

Wallet Instance upon search data from, the employ of an issuance interface as outlined in [Issuance]. Once a Wallet Instance contains a pseudonym attestation, the Wallet Instance SHALL repeatedly procure a diagram to open a recent pseudonym to a Relying Event. To that discontinue, except technically infeasible^[x], the Wallet Instance and the Pseudonym Issuer SHALL make certain that the Wallet Instance repeatedly contains as a minimal one unused pseudonym price. The Wallet Instance and the Pseudonym Issuer SHALL apply the suitable necessities for attestation administration. A Wallet Instance SHALL NOT restrict the total series of diverse pseudonym values it supports, instead of any technical barriers.

A Wallet Instance SHALL open each and each pseudonym price to at most one Relying Event. A Wallet Instance SHALL make certain that a routine Relying Event repeatedly receives the similar pseudonym price, except the User decides to make employ of a recent pseudonym price, either as a additional price or in substitute of the present price. So as to impact so, the Wallet Instance SHALL authenticate the Relying Event as described in [RPAuth].

A Wallet Instance SHALL existing all pseudonym values it contains to the User upon search data from, alongside side their association with a Relying Event, if such an association exists. A Wallet Instance SHALL allow the User to deactivate a pseudonym price. Afterwards, if the Relying Event with which that pseudonym used to be linked all every other time requests a pseudonym, the Wallet Instance SHALL open a recent, unused pseudonym price.

2.4 Barriers

Below is a non-exhaustive list of barriers of the pseudonymization draw specified by this memoir. This list is offered here most tremendous for data functions:

• The pseudonym for a given User at a given Relying Event is no longer continual between diverse Wallet Cases belonging to the User. To illustrate, if the User has two diverse Wallet Cases, a given Relying Event will gain an even pseudonym price from each and each of these. Equally, if the User loses a Wallet Instance and sets up a recent one, the pseudonym price for a given Relying Event in the recent Wallet Instance can be diverse. This means that the User can be unable to gain entry to their myth, except they’ve space up an myth restoration mechanism commence air the scope of this memoir. Here’s honest except the Wallet Provider has a draw for synchronizing or backing up and restoring the contents of Wallet Cases, at the side of the association between a teach pseudonym price and a teach Relying Event, which is saved by the Wallet Instance. Backup and restore probabilities can be discussed in Epic 33. If technically that you would additionally recall to mind, any mechanism for backing up and restoring Wallet Instance contents SHALL consist of the associations between pseudonyms values and Relying Events.
• There is no longer such a thing as a remark that every and each User has most tremendous one pseudonym price for a given Relying Event.
• The pseudonym can not be outdated college for nameless authentication. An nameless authentication resolution permits a Relying Event to verify that the User uses a salubrious Wallet Instance, with out finding out the rest in regards to the User. In the case of the pseudonym outlined in this memoir, the Relying Event learns the price of the pseudonym for this teach User at this teach Relying Event. Though the usefulness of that pseudonym is exiguous to that Relying Event most tremendous, the User can not be said to be basically nameless.

These barriers would possibly perhaps be resolved in the extinguish by introducing a cryptographically more evolved pseudonymization draw.

2.5 Risks

After a pseudonym price is issued to a Wallet Instance of a User, the Pseudonym Issuer would possibly perhaps possibly serve a document of the pseudonym price and the linked User. This would possibly perhaps possibly be wished, as an example, in case the Pseudonym Issuer wants so as to re-advise the pseudonym price to the similar User, as an example if the User’s software is lost, stolen or modified. If the Pseudonym Issuer would now not beef up re-issuance, the User will lose gain entry to to the parable(s) represented by the pseudonym price.

Nonetheless, conserving the issued pseudonym values implies that the Pseudonym Issuer is fascinating to appear up the User’s honest identity (as an example, the authentic continual identifier in the PID) from the pseudonym price obtained by a Relying Event. The Issuer would procure a diagram to web the User’s honest identity from a pseudonym that a Relying sends to the Issuer. Here’s a privacy threat for the User.

On the assorted hand, this skill would possibly perhaps be considered as a feature as well, reasonably than as most tremendous a threat. It would possibly perhaps possibly be wished, as an example, in case a Relying Event affords a service to a User primarily primarily based on the User’s pseudonym, and a noble struggle arises between the User and the Relying Event. The

Relying Event would possibly perhaps possibly then quiz the Pseudonym Issuer to expose the User’s honest identity. One more circumstance in which this skill would possibly perhaps be wished is when a law enforcement agency requests the honest identity of the User that used to be serious a pair of transaction with the Relying Event.

Lastly, but every other purpose to capture a document of issued pseudonym values would possibly perhaps be a noble requirement in European Union or national law to protect such data.

In regards to this threat, this memoir specifies the following:

A Pseudonym Issuer SHOULD operate a policy referring to whether or no longer it keeps a document of pseudonym values issued to Users, smitten by as a minimal the abovementioned advantages and (privacy) risks. In spite of every thing, the Pseudonym Issuer SHALL NOT serve the pseudonym values for longer than allowed by the linked felony pointers and SHALL NOT employ them for any purpose diverse from what these felony pointers impose.

3 Pseudonym attribute schema

3.1 Pseudonym attestations and Pseudonym Issuers

A pseudonym attestation as specified by this memoir SHALL be an Digital Attestation of Attributes (EAA), as outlined in the eIDAS v2 Law. A Pseudonym Issuer SHALL be conscious all necessities for a PID Provider or a QTSP issuing QEAAs.

Requirements 7, 8 and 10 in allotment 6.3.1 of [ARF] specify that EAAs (comparable to pseudonym attestations) must be issued primarily primarily based on either ISO/IEC 18013-5: 2021 [ISO18013-5] or with [SD-JWT], and that this skill that, data parts must be encoded in CBOR or JSON. In diverse words, a pseudonym attestation SHALL either be in the mdoc structure specified by [ISO18013-5] or in the SD-JWT structure specified by [SD-JWT] and [SD-JWT-VC]. This means that a pseudonym attestation has largely the similar properties as any diverse invent of attestation all the diagram thru the EUDI Wallet ecosystem. To illustrate,

• the authenticity and integrity of the attributes in the attestation is stable thru a signature of the Issuer (or, in case of the alias attribute, the mobile software).
• pseudonym attestations are certain to the software on which they live thru a public key in the attestation (proof of possession, key binding).
• particular person attributes in the attestation are selectively disclosable.
• a Wallet Instance have to search data from client consent sooner than releasing a pseudonym attribute, procure out about [RPAuth].
• the Issuer can revoke pseudonym attestations the employ of one amongst the techniques specified by [AttestRevoc].

Nonetheless, pseudonym attestations are diverse from diverse forms of attestations in one admire: every Relying Event that requests the user_pseudonym attribute (procure out about allotment 3.3.1) will receives an even price. On the similar time, a routine Relying Event will repeatedly gain the similar price for the user_pseudonym attribute.

To permit these properties, there are two ways in which a Pseudonym Issuer can advise pseudonyms:

1. First, the Pseudonym Issuer can advise each and each pseudonym price as an even attestation, at the side of its have MSO or SD-JWT. This means that the Wallet Instance have to prepare an even private key for every and each pseudonym price^[xi]. When a Relying Event requests a pseudonym for the first time, the Wallet Instance releases an ‘unused’ attestation. Each subsequent time that identical Relying Event requests a pseudonym, the Wallet Instance releases the similar attestation. Nonetheless, diverse Relying Events will gain an even attestation, at the side of an even MSO or SD-JWT. Thus, the Wallet Instance treats pseudonym attestations in an even system than diverse forms of attestations, which (in theory) would possibly perhaps additionally fair also be issued more than one instances to more than one Relying Events^[xii].

2. Secondly, the Pseudonym Issuer can advise a single pseudonym attestation containing more than one pseudonym values. These diverse pseudonym values can be incorporated in the attestation in the similar system as diverse attributes are in diverse attestations (as an example the attributes in the PID): the MSO or SD-JWT will possess a digest for every and each pseudonym price, and the series of digests is signed by the Pseudonym Issuer. This ensures that every and each pseudonym price would possibly perhaps additionally fair also be disclosed selectively. A fascinating thing about this draw is that it limits the series of attestation private keys to be managed by the Wallet Instance.

When a Relying Event requests a pseudonym for the first time, the Wallet Instance releases the pseudonym attestation, however discloses most tremendous one ‘unused’ pseudonym price, which this would possibly perhaps possibly additionally fair therefore repeatedly employ for the similar Relying Event. A particular Relying Event will gain the similar attestation, however with an even pseudonym price being selectively disclosed. Thus, like diverse forms of attestations, a pseudonym attestation MSO or SD-JWT can (in theory) be released to more than one Relying Events. This means that there’s a threat that the signature price or digest values in the MSO or SD-JWT can be outdated college to be conscious the User. The Wallet Instance and the Pseudonym Issuer have to counter this threat by limiting the series of instances a pseudonym attestation would possibly perhaps additionally fair also be released to a Relying Event; procure out in regards to the discussion in allotment 3.3.4 of [AttestRevoc].

3.2 File form and namespace

3.2.1 EU-large memoir form and namespace for pseudonyms

Pseudonym Issuers SHALL employ the memoir form “eu.europa.ec.eudiw.pseudonym.1” for Pseudonym attestations. The model number “1” in this memoir form MAY be outdated college to differentiate between the first model of the pseudonym attestation (outlined in this memoir) and any future model. Equally, Pseudonym Issuers SHALL employ the price

“eu.europa.ec.eudiw.pseudonym.1” for the namespace of the first model of the Pseudonym attributes specified by allotment 3.3.

3.2.2 Home pseudonym namespaces

As outlined in allotment 1.1, Pseudonym Issuers (Member States) are free to specify additional pseudonyms and pseudonymization techniques, as an example if they are desirous to make employ of a pseudonym having teach properties which would possibly perhaps possibly be no longer supported by the pseudonymization draw specified by this memoir.

To permit Relying Events to search data from this kind of domestic pseudonym, the Pseudonym Issuer SHALL specify attribute identifiers within their domestic pseudonym namespace. If a Pseudonym Issuer chooses to define a domestic namespace for pseudonyms, it SHALL append the suitable ISO 3166-1 alpha-2 country code or the ISO 3166-2 space code, separated by a interval, to the EUwide pseudonym namespace outlined in the outdated allotment, instead of the model number. The Pseudonym Issuer MAY consist of a model number in the domestic namespace.

EXAMPLE: The first model of the domestic pseudonym namespace for Denmark would possibly perhaps be “eu.europa.ec.eudi.pseudonym.dk.1”.

for such attestations. Nonetheless, a Pseudonym Issuer MAY level-headed capture to employ one amongst the approaches described in that allotment, as an example so as to treat every form of attestations it factors in the similar system.

3.3 Pseudonym attributes

3.3.1 Introduction and overview

So as to appear at the necessities in allotment 2.2, Table 1 specifies two diverse attributes for the Pseudonym attestation. Table 1 possess the following data:

• The first column specifies the identifiers of the attributes. These identifiers SHALL be outdated college in requests and responses primarily primarily based on [ISO18013-5] or [OpenID4VP], as appropriate. There SHALL be at most one data ingredient with the similar attribute identifier in each and each pseudonym attestation.
• The second column describes the this skill that of the tips ingredient.
• The third column specifies whether or no longer the presence of the ingredient in a Pseudonym attestation is obligatory (M), or no longer obligatory (O).

NOTE: If Table 1 signifies a data ingredient as obligatory, this exclusively skill that the Pseudonym Issuer SHALL make certain that this ingredient is existing in the pseudonym attestations.

• The fourth column signifies how the tips parts SHALL be encoded, the employ of the CDDL illustration forms outlined in [RFC 8610]. Share 3.4 specifies how these illustration forms SHALL be serialized into CBOR and JSON data constructions, respectively. Recent that tstr and bstr are CDDL illustration forms outlined in [RFC 8610]. All data parts having encoding structure tstr SHALL hang a maximum length of 150 characters.

Table 1 Pseudonym attributes

3.3.2 Attribute user_pseudonym

The attribute user_pseudonym SHALL be a pseudonym, complying with the necessities in allotment 2.2.1 and generated as specified by allotment 2.3 of this memoir.

This attribute SHALL be signed by the Pseudonym Issuer. For ISO/IEC 18013-5-compliant Wallet Cases, this means that the Wallet Instance SHALL open this data ingredient as an IssuerSigned Merchandise. For OpenID4VP-compliant Wallet Cases, this means that the Wallet Instance SHALL open this data ingredient in a VP Token.

3.3.3 Attribute user_alias

The attribute user_alias SHALL be freely chosen by the User, the employ of functionality equipped by the Wallet Instance. Which skill that, this attribute SHALL be signed by the Wallet Instance, the employ of the non-public key comparable to the public key in the MSO or SD-JWT of the Pseudonym attestation. Please display mask the following:

• As specified by [TrustModel] allotment 4.2.1, this attribute is (at the second) the most tremendous one who is signed by the Wallet Instance reasonably than the Issuer.
• For ISO/IEC 18013-5-compliant Wallet Cases, this means that the Wallet Instance SHALL open this attribute as a Tool-Signed Merchandise. For OpenID4VP-compliant Wallet Cases, this means that the Wallet Instance SHALL open this attribute in an ID Token.
• For ISO/IEC 18013-5-compliant Wallet Cases, the Pseudonym Issuer SHALL authorize the public key in the MSO to signal this attribute.
• The Wallet Instance SHALL signal this attribute the employ of the attestation private key that can be outdated college for mdoc authentication (ISO/IEC 18013-5) or Key Binding (SD-JWT). This ensures that no additional keys and certificates must be outdated college by the Wallet, this skill that that there’s no longer any additional threat of colluding Relying Events the employ of these to impact that the aliases belong to the similar User.

3.4 Attribute encodings

3.4.1 Introduction

This allotment specifies two separate encodings for the pseudonym attribute schema, an ISO/IEC 18013-5-compliant encoding in CBOR, and a SD-JWT-compliant encoding in JSON.

3.4.2 ISO/IEC 18013-5-compliant encoding

3.4.2.1 Encoding principles

If data parts specified by in Table 1 are encoded with CBOR, they SHALL be encoded as specified by [RFC 8949].

The CDDL illustration forms outdated college in Table 1 are specified by allotment 3.3.1. Rules to encode CDDL illustration forms with CBOR are specified [RFC 8610] and [RFC 8949].

3.4.3 SD-JWT-compliant encoding

3.4.3.1 Encoding principles

If data parts are encoded with JSON, they SHALL be encoded as specified by [RFC 8259].

The CDDL illustration forms outdated college in Table 1 are specified by allotment 3.3.1. Rules to encode CDDL illustration forms with JSON are specified by [RFC 8949] allotment 6.1 Given the CDDL illustration forms outdated college in the brand new edition of this memoir, the following principles are linked:

• A CDDL bstr (i.e., a byte string) is encoded in faulty64url with out padding and turns into a JSON string.
• A CDDL tstr (i.e., a UTF-8 text string) turns into a JSON string^[xiii].

4 Have faith infrastructure facts

4.1 Introduction

To trust the signature over a pseudonym attestation, the Relying Event wants a mechanism to validate that the public key it uses to verify that signature is depended on. Each ISO/IEC 18013-5 and OpenID4VP present such mechanisms. Nonetheless, in each and each cases, additional facts decide to be specified to fully specify these mechanisms for pseudonym attestations all the diagram thru the EUDI Wallet ecosystem.

4.2 ISO/IEC 18013-5-compliant Pseudonym attestations

4.2.1 OIDs to be used in Pseudonym-linked certificates

ISO/IEC 18013-5 specifies an X.509-primarily primarily based PKI for the aim of trusting public keys. This PKI has more than one roots; there’s an autonomous (self-signed) root certificate for every issuer. Annex B of the customary specifies the formats of the X.509 certificates for all contributors in the ecosystem.

These certificate formats are mDL-teach, however most tremendous because they employ some mDL-teach Object Identifiers (OIDs), procure out about Annex B.1.1 of ISO/IEC 18013-5. All diverse aspects of these certificate profiles would possibly perhaps additionally fair also be outdated college for any invent of attestation complying with the safety mechanisms outlined in ISO/IEC 18013-5, at the side of a Pseudonym attestation all the diagram thru the EUDI Wallet ecosystem.

To impact the certificate profiles appropriate for Pseudonym attestations in ISO/IEC 18013-5compliant EUDI Wallets, a series of pseudonym-teach OIDs have to be outlined.

There are ongoing discussions on the OID values specified by [PIDRulebook]. Specification of the well-known pseudonym teach OIDs is postponed except after these discussions hang been resolved.

These OIDs SHALL be outdated college in certificates outdated college for pseudonym attributes all the diagram thru the ISOcompliant EUDI Wallet ecosystem, in exactly the similar system as the corresponding OIDs specified by ISO/IEC 18103-5 are outdated college all the diagram thru the mobile driving license ecosystem. These recent OIDs will have to be officially registered.

4.2.2 Depended on Issuer Checklist

Share 4.2.2. of [TrustModel] describes the thought of a depended on list of Issuers. This memoir specifies that for pseudonym attestations, this kind of depended on list SHALL be outdated college. Relying Events SHALL most tremendous trust Pseudonym Issuers which would possibly perhaps possibly be incorporated in a depended on list of Pseudonym Issuers. Additionally, there SHALL be most tremendous a single depended on list (or list-of-lists) of Pseudonym Issuers, which SHALL be generated and maintained by a but-to-be-certain gain together. This list SHALL also possess the (root) certificate(s) of each and each Pseudonym Issuer. The similar list MAY be outdated college for PID Suppliers and diverse forms of (Q)EAA Issuers as well.

Referring to the structure of this depended on list, the structure specified by ETSI TS 119 612 v2.1.1 SHALL be outdated college.

4.3 SD-JWT-compliant Pseudonym attestations

Critical functions on the trust infrastructure for SD-JWT and OpenID4VP-compliant Pseudonym attestations can be detailed in a future model of ARF.

5 References

[i] If User recognition succeeds, the Relying Event would possibly perhaps additionally fair gain important data in regards to the User – as an example the closing time the User interacted with the Relying Event and what came about throughout that interaction. However the price of the pseudonym itself would now not give the Relying Event any data in regards to the User. Furthermore, any important data obtained this form by definition used to be already existing in the Relying Event’s records.

[ii] Recent that this requirement implies that the Pseudonym Issuer is conscious of the User’s honest identity. Nonetheless, Relying Events impact no longer know this identity.

[iii] Seek requirement 5.

[iv] Seek also requirement 6.

[v] Recent that the pseudonym outlined in this memoir would now not be conscious this requirement for diverse Wallet Cases belonging to the similar User, either in parallel or consecutively, except the Wallet Provider affords a synchronization or backup mechanism for data in the Wallet Instance. Seek allotment 2.4.

[vi] These necessities are security necessities. The implementation of these necessities by Wallet Cases SHALL be in scope of Wallet Solution certification.. ⁷ This MAY be a configuration atmosphere of the Wallet Instance.

[vii] This requirement is a security requirement. The implementation of this requirement by Wallet Cases SHALL be in scope of Wallet Solution certification..

[viii] Colluding Relying Events would possibly perhaps additionally fair try to correlate pseudonyms primarily primarily based on seen traits of the User, reasonably than on pseudonym price. Examples consist of time, place and frequency of employ, or estimated age, height and gender of the User. Such makes an try hang no relationship to the pseudonym values themselves and are no longer supposed in this requirement.

[ix] Recent that this requirement ensures that requirement 4 in allotment 2.2.1 is complied with. A pseudorandom UUID primarily primarily based on RFC 4122 contains 122 random bits. Primarily primarily primarily based on https://en.wikipedia.org/wiki/Universally_unique_identifier#Collisions, 2.7 x 10^18 random UUIDs must be generated to hang an different of 50% of as a minimal one duplicate UUID to be generated. Since there are 448 million EU electorate, this corresponds to roughly 6.0×10^9 UUIDs per EU citizen. Assuming the series of pseudonyms per citizen is no longer going to exceed 100, this means a security margin of 6×10^7. This security margin is factual enough, in particular given the indisputable truth that for any fascinating danger to arise, the two colliding pseudonym values must be identified by the similar Relying Event. One more illustrative system to appear at that is that, in expose to generate 2.7 x 10^18 UUIDs, 1 billion UUIDs must be generated per second for approximately 86 years.

[x] To illustrate, since the closing unused pseudonym price is outdated college in a transaction throughout which the Wallet Instance is offline. In such cases, recent pseudonym values SHALL be issued to the Wallet Instance as rapidly as the Wallet Instance is fascinating to connect with the Pseudonym Issuer all every other time.

[xi] Recent that allotment 2.3 requires that a Wallet Instance is fascinating to serve watch over as a minimal 100 pseudonym values, so the series of non-public keys to serve watch over can was worthy.

[xii] On account of the MSO or SD-JWT of each and each pseudonym attestation is released to at least one Relying Event most tremendous, there’s no longer any threat that the signature price or digest values in the MSO / SD-JWT can be outdated college to be conscious the User. Which skill that, there’s no longer any decide to restrict the series of instances a pseudonym attestation would possibly perhaps additionally fair also be released to a Relying Event, and the discussion in allotment 3.3.4 of [AttestRevoc] is in theory no longer linked

[xiii] Recent that JSON requires escaping certain characters ( ): citation trace (U+0022), reverse solidus (U+005C), and the „C0 alter characters“ (U+0000 thru U+001F). All diverse characters are copied unchanged into the JSON UTF-8 string.

[xiv] The categorical model to be referenced is to make certain. [ARF] references v0.2. v0.4 is the newest model available in the market at the time of writing of this memoir. The level of interoperability between these variations is no longer identified. As [SD-JWT] is level-headed beneath pattern, presumably later variations will was available in the market over time. ¹⁶ The categorical model to be referenced is to make certain. [ARF] references v0.14 of 30 December 2022. Draft 17 is the newest model available in the market at the time of writing of this memoir. The level of interoperability between these variations is no longer identified. As [OpenID4VP] is level-headed beneath pattern, presumably later variations will was available in the market over time.