eudi-doc-architecture-and-reference-framework

> the sponsor of Louisiana's HB-570, publicly confirmed that a Meta lobbyist brought the legislative language directly to her. The bill as drafted required only app stores (Apple, Google) to verify user ages. It did not require social media platforms to do anything. Thing is, when these “make the websites collect your ID” proposals come up, the overwhelming sentiment here is “this is terrible and we need to do it lower in the stack”. I think the OS is a better place than the website. (Let security conscious folks use a standalone device too if desired.) The astroturfing stuff is obviously sus, I don’t have a feel for whether this is egregious by the standards of $T companies or just par. Of course, the EU option of using proper ZK proofs etc sounds way better as portrayed in the OP. But when you actually dig in, doesn’t the EU effectively

EUDI has had various criticism with its approach for not supporting unlinkability (with the same attestation used across verifiers they can be traced to the same user). There are some long Github threads in the official repo along with a PDF[1] of cryptographer's feedback about the privacy issues. Also covered in this[2] article. This is unlike BBS+ which supports unlinkability and which was even recommended by GSMA Europe to such address downsides. In the Github discussions there seems to be pushback by those officially involved that claim BBS+ isn't compatible with EUDI[3] and there seems to be some plateauing of any progress advancing it. [1] https://github.com/eu-digital-identity-wallet/eudi-doc-archi... [2] https://news.dyne.org/the-problems-of-european-digital-ident... [3] https://github.com/eu-digital-identity-wallet/eudi-doc-archi

Apologies that I'm latching onto your post for visibility, but for the sake of discussion - the European Identity Digital Wallet project specification and standardisation process is in the open and lives on github (yeah, the irony isn't lost on me :) ): https://github.com/eu-digital-identity-wallet https://eudi.dev/latest/ Everything's very much WIP, but it aims to provide a detailed Archictecture and Reference Framework/Technical Specifications and a reference implementation as a guideline for national implementations: https://github.com/eu-digital-identity-wallet/eudi-doc-archi... https://github.com/eu-digital-identity-wallet/eudi-wallet-re... https://github.com/eu-digital-identity-wallet/eudi-doc-stand... You'll find several (still evolving) Technical Specifications regarding ZKPs (including a discussion area) in the latter.

The Italian digital ID wallet is already in fact banning GrapheneOS and other ROMs [1], the EU doesn't mandate that member states have to allow non-Android/iOS apps [2] [1] https://github.com/eu-digital-identity-wallet/eudi-app-andro... [2] https://github.com/eu-digital-identity-wallet/eudi-doc-archi...

The current reference design is not compatible with existing law. eIDAS regulation that is the legal basis for digital wallet mandates unlinkability. GDPR has a general requirement for technical controls to be state of the art. Inherent reliance on American monopolies is incompatible with Digital Markets Act. The current design and usage of cryptographic primitives does not allow for unlikability (it is actually quite easy to for verifiers and relying parties to collude) and it certainly is not state-of-the-art. BBS signatures would achieve actual unlinkability, but those have been outright rejected by the designers. Current implementation is poised to not comply with the regulation that established the mandate for the wallet and it violates GDPR. The best one could hope for is for CJEU to strike down the whole project. The GitHub organiz

What I'm gathering from that description is a flow that would involve three parties: Me, the restricted resource, and an ID validator. When I wanted to access the restricted resource, they'd ask for a valid token that I would then go to my ID validator to get since they've already identified me, they'd then pass that valid token back to me which I could pass to the restricted resource. They'd presumably then save that token as proof that they did their legally required validation. Is that roughly correct? I think that's the model they're working on in the EU using Bitstring Status List, OpenID for Verifiable Presentations, and ISO 18013-5. If you want to know more there's a reference implementation: https://github.com/eu-digital-identity-wallet/eudi-doc-archi...

Someone opened an issue about changing the wording https://github.com/eu-digital-identity-wallet/eudi-doc-archi...

See https://github.com/eu-digital-identity-wallet/eudi-doc-archi... for a reference to the nuances on all these topics, at least in the context of the European Union. Other locales have different problems and different solutions. If you think you have a better idea shoot me an email.

The problem that needs to be solved is, how can a government give you an identity document in a way that you cannot give the document to somebody else. Whether or not this problem needs to be solved is a political question, but it seems like the majority thinks that identity documents should be hard to forge, in the same way as dollar bills should be hard to forge. The only practical solution is to have some sort of hardware that the user cannot forge, and relying parties will insist that the document be bound to such hardware. So yes, the something else could be software, but nobody will accept signatures from an emulated TPM. I had in mind a government-issued yubikey that can be identified as such, or maybe a plastic card with embedded secure chip with the same functionality. See https://github.com/eu-digital-identity-wallet/eudi-d

Also via the EU "Digital Identity Wallet" as a mobile app when it's ready https://github.com/eu-digital-identity-wallet/eudi-doc-archi... The problem will probably be adoption by services. It's a lot more tempting to get more information than just age, if you go through the hassle in the first place.