av-doc-technical-specification

This is an excellently written article & an excellent bookmark to keep saved & reshare in future discussions around authentication. It comprehensively summarises a lot of thoughts I had had myself about Passkeys, much more eloquently than I could have. I am a big Passkey advocate, but like many things these days - as pointed out here - they are a double-edged sword that have been very effectively "poisoned" by the same groups responsible for much of the recent DRM-ification of a lot of web tech. A close parallel of this is the EU's efforts to build "digitally sovereign" software but ending up increasing reliance on Apple & Google in the process[0]. https://github.com/eu-digital-identity-wallet/av-doc-technic...

In the page: "This can be done via the EU age verification tool or other third-party solutions that offer reliable, secure and privacy-preserving means to verify the user’s age". It's well demonstrated by now "third-party solutions" do not work, and do not have any privacy guarantees. Even banks that must abide to supposedly the most strict regulations will surrender all your personal data to anyone asking with a government email, see the latest Revolut leak. What about this "EU age verification tool?"? It's the one you may have heard about that requires you to use an Android device passing Play Integrity or iOS [0]. What would be the rationale for the EU to research and implement a truly anonymous, transparent age verification system? Even ZPKs cannot do that, and most likely won't ever. [1] This insane proposal that has now been approve

The EU age verification system requires tying yourself to Google/Apple [0] (ie will not work with GrapheneOS) which is a non-starter. This means you will need a mandatory Google/Apple account. What if your Google account gets banned? [0] https://github.com/eu-digital-identity-wallet/av-doc-technic...

More information here about how the implementation enforces a Google/Apple duopoly: https://github.com/eu-digital-identity-wallet/av-doc-technic...

> We would prefer the Play Integrity API being banned by regulators but this is good enough for now. Unfortunately, the EU is currently developing their age-verification-app, and it mandates hardware attestation[1], and it seems that their reference implement those requirements using Play Integrity[2]. [1]: https://news.ycombinator.com/item?id=49148128 [2]: https://github.com/eu-digital-identity-wallet/av-doc-technic...

Digital sovereignity is when we're forcing everyone to use Android or iOS in order to access online services? <https://github.com/eu-digital-identity-wallet/av-doc-technic...>

From what I can gather from the linked discussion it was started as a pull request or a issue and was transferred to a discussion later. Perhaps some data was lost there? If you expand the comments fully there is also mention of a nuked merge request, I assume it was related to this text. Edit it was not visible from the discussion link but it is visible from the issue link below. Also it seems to be transferred over from a totally different repo? https://github.com/eu-digital-identity-wallet/av-doc-technic...

I'm afraid you're wrong. Whitelabel/demo implementation specifically pushes FOR Google Play Integrity after being explained why that's a bad idea: https://github.com/eu-digital-identity-wallet/av-doc-technic... Via: https://discuss.grapheneos.org/d/24452-eu-might-enforce-goog... which specifically quotes the law that should forbid such approach (Article 6(4) DMA) - so EU initiative and engineers consciously and intentionality breaking EU law in the prototype that is supposed to be replicated later.

https://github.com/eu-digital-identity-wallet/av-doc-technic... has an overview of the protocol so far. Annex B has the details on using ZKPs.

I’m not sure what you are saying I am mixing up. The article links to the source code repository here: https://github.com/eu-digital-identity-wallet/av-app-android... That links to the tech spec: > The solution leverages the existing eIDAS infrastructure, including eIDAS nodes and the trust framework for trusted services, to ensure a high level of security and reliability. By aligning with the technical architecture of the EU Digital Identity Wallet ARF, the solution delivers secure, reusable, and interoperable proofs of age. > The solution enables users to present their Proof of Age attestation to Relying Parties, primarily for online use cases. The system is optimised for secure and privacy-preserving online presentation, allowing users to prove their eligibility without disclosing unnecessary personal information. — https://github.com/

I wholeheartedly concur (see also: Linux phones), but what about device attestation requiring iOS or Google Play Integrity? That's my main worry, as age verification seems poised to making us dependent on those. Example: the EU Digital Identity (EUDI) wallet, discussed in multiple GH issues e.g. https://github.com/eu-digital-identity-wallet/av-doc-technic...

https://github.com/eu-digital-identity-wallet/av-doc-technic... https://www.forbes.com/sites/federicoguerrini/2025/08/10/who...