EU Digital Wallet Framework Gets an Upgrade

On the heels of its regulatory framework coming into force, the European Union’s emerging digital ID system has now seen an upgrade to its open source architecture.

The latest version of the European Digital Identity Wallet Architecture and Reference Framework (ARF), v. 1.4.0, brings several significant updates and changes aimed at enhancing the framework’s usability, security, and interoperability.

eSIMs, SCDs, and Other Acronyms

One notable change is the explicit inclusion of eSIM and SIM as Secure Elements (SE) for storing and managing cryptographic keys. This change addresses concerns about market distortion by ensuring that the most widely deployed SEs in smartphones are recognized and utilized within the EUDI Wallet framework.

The aim is to leverage the existing infrastructure of eSIM and SIM cards, which are already well-integrated into mobile networks across Europe, in order to provide a secure environment for keys and data.

The framework has also enhanced its security mechanisms by detailing the use of Secure Cryptographic Devices (SCD) and Qualified Signature Creation Devices (QSCD) for managing cryptographic keys. This ensures that high-level security requirements are met, particularly for use cases involving electronic identification and trust services (eIDAS). The inclusion of hardware-based security solutions such as Trusted Execution Environments (TEEs) and Hardware Security Modules (HSMs) further strengthens the security posture of the EUDI Wallet.

The Role of Biometrics

Biometrics are also addressed in the updated framework. The ARF underlines the importance of strong biometric authentication methods to enhance the security of digital identity verification, and outlines standards and requirements for implementing biometric systems within the EUDI Wallet, ensuring they comply with privacy regulations and provide high levels of security.

The use of biometrics, such as facial recognition and fingerprint scanning, is seen as a critical component in ensuring the authenticity and integrity of digital identities. But the framework also stresses the need for privacy and data protection in biometric systems, ensuring that biometric data is handled with the highest standards of security to prevent unauthorized access and misuse.

Managing Compliance and Credentials

More generally, the framework includes enhanced guidelines to ensure compliance with the General Data Protection Regulation (GDPR) and other relevant regulations. These guidelines focus on minimizing data collection, providing users with control over their personal information, and implementing strong consent mechanisms to protect user privacy.

The framework’s guidance on lifecycle management has been updated too, emphasizing the need for robust processes for the issuance, update, revocation, and recovery of digital credentials. This is meant to ensure that digital identities can be managed securely and efficiently throughout their lifecycle, maintaining trust and reliability.

Finally, the certification and compliance processes have been refined to ensure that entities participating in the EUDI ecosystem adhere to the highest standards. This includes detailed criteria for accreditation and ongoing monitoring, which help maintain a high level of trustworthiness and security among all participants.

The update comes after European Union’s Digital Identity Regulation took effect earlier this week, which formally sets EU nations down the path to digital ID. The EU Digital Identity Wallet is expected to be available by 2026.

Source: EUDI Wallet Architecture and Reference Framework

–

May 23, 2024 – by Cass Kennedy