Abstract
The European Digital Identity Wallet (EUDI Wallet) is the flagship
initiative under the novel eIDAS1 regulation, aiming at enhancing
digital identification by providing all EU citizens with a universal and
secure digital ID. This ID will facilitate a wide range of activities,
including travel, work, cross-border education, access to online
services, payments, document signing, and more. Current efforts
concentrate on specifications for Person Identification Data
(PID) and other attribute attestations via Verifiable Credentials
(VC) and the requirements for PID Providers, Qualified and Electronic
Attribute Authorities (QAA and EAA), EUDI Wallet Providers, Relying
Parties, and other actors within the EUDI Wallet ecosystem. This paper
delves into further essential requirements of the eIDAS 2.01 regulation
and proposes the FIDO framework as a solution for central aspects such
as strong customer authentication, user sole control and
device attestation. FIDO is not only an efficient framework for
Strong User Authentication (SUA), but has also been recognized by
the EU Cybersecurity Agency (ENISA)2 and the ETSI TR 119 460 report3 as
compliant with eIDAS eID schemes. In this paper, we first briefly state
the requirements of the EUDI Wallet Architecture and Reference Framework
(ARF) for online and proximity identification and authentication, and
propose leveraging the FIDO framework for authentication in the EUDI
Wallet (section 1). Next, we highlight the potential complementarity of
the current ARF design effort and the FIDO framework, explaining how the
use of FIDO can achieve economies of standardization and accelerate the
adoption of the EUDI Wallet by service providers that rely on additional
security guarantees for LoA High, such as financial institutions and
critical infrastructure operators (section 2). In section 3 we outline
the technical details for seamlessly integrating a FIDO authenticator
into the EUDI Wallet architecture. Finally, we introduce the need for
protected confirmation, as a means to enable EUDI Wallet users to
“reliably control what they confirm on their device”, and recommend to
also leverage protected confirmation for selective
disclosure (section 4).