09 Sep 2024 European Digital Identity Wallet – implementing regulations
No Wallet Security and Privacy Without Certified Secure Hardware
Eurosmart welcomes the European Commission’s decision to allow the ecosystem to provide feedback on the eIDAS implementing acts. Given the complexity and technical nature of the digital identity topic, consultation period would have deserved an extended period.
Considering that eIDAS and its implementing acts will define the digital identity for 450 million European citizens, and the political promise to ensure a highly secure and privacy-by-design implementation, Eurosmart emphasizes that privacy and security cannot be achieved without the use of high-quality cryptographic mechanisms. Cryptography has historically been a key challenge in Europe, and it is crucial to avoid a scenario where citizens may lack trust due to potential vulnerabilities or backdoors in the system. The digital security industry is deeply concerned about the treatment of secure hardware in this text, as it contradicts the EU’s political commitment to supporting this sector through the Cybersecurity Act (CSA) and the Chips Act.
To build this level of trust, the inclusion of hardware systems into reliable and harmonized security certification processes is essential.
Eurosmart raises several major concerns that are further developed in the document:
- Certification WSCD, WSCA
- WSCD shall only be security certified in accordance with the EUCC scheme or the SOG-IS recognition agreement at least at level EAL4+ AVA_VAN.5
- WSCA(s) utilizing wallet cryptographic operations on critical assets shall only be certified under EUCC or shall be certified under a national schema based on EN 17640 (FITCEM)
- The scope of the national security certification scheme:
- Should be clarified with regards with the object of certification (process or product, or both? Preference would be both).
- Is not clear if it only covers wallet solutions, or also includes electronic identification scheme?
- Wallet unit attestation (technical structure is missing)
- The private key (cryptographic binding) of the wallet unit attestations shall be unique per WSCD for privacy and ease of revocation reasons.
- The proposed definition of “wallet unit attestation” seems to not include one technical structure which is instrumental for the operation of a wallet unit.
- Clarification if the Wallet Trust Evidence (WTE) which seems to be described by the wallet unit attestation, and Wallet Instance Attestation (WIA) which seems not covered by the definition of wallet unit attestation are the same or not. The preference is that it should not be the same due to loss of privacy and complexity of revocation.
- Proposal: refer to a definition to be provided in an annex/additional document.
- Trust model is not sufficient, the root of trust should be quoted
- When referring to the security properties which should be met, the draft Implementing Regulations seem to either miss some key security properties (e.g. authentication, authentication of relying party)
- Consideration on LoA criteria (far too limited criteria) – this one could relate to the trust model
- The criteria of the Level of Assurance (LoA) which should be considered for enrolling user shall not be limited to “enrolment” but shall also include the “Electronic identification means management” and “Management and organization”
