The European Union’s regulation on Digital Identity, eIDAS, is currently being overhauled to adopt decentralized identity principles. The goal is to provide all citizens and residents across the EU with highly secure and privacy preserving digital wallets that can be used to manage various digital credentials, from eIDs to diplomas to payment instruments. Decentralized identity principles aim at giving freedom of choice and control to the end-user. Ensuring security and interoperability, however, will be challenging — especially in the enormous scale in terms of users and use cases the EU is aiming at. The choices made in eIDAS will have a huge impact on digital identity in the EU and beyond. The so-called “Architecture and Reference Framework” (ARF) defines the technical underpinnings of eIDAS v2. Many experts from the member states and the Commission have been working on this framework over the last year, trying to select the best combination of technologies and standards out of the enormous number available in the market today. This talk will introduce the ARF and explain what architectural patterns and technical standards are adopted and how the challenges mentioned above are addressed in order to leverage on the vision of the eIDAS v2 regulation.

1. The European Union goes Decentralized
Standards and Technical Architecture
behind eIDAS v2

2. Kristina
Identity Standards Architect
Yasuda
Microsoft
Giuseppe
Open Source Project
Leader
De Marco
Presidency of the Council of
the Minister, Italy
Dr. Torsten
Managing Director
Lodderstedt
yes IDP GmbH

3. The electronic IDentification Authentication and
Signature Regulation (eIDAS)
● Introduced a framework for electronic identification (eID) and trust services in
2014.
● It enables EU citizens, companies and public administrations to safely access
services and carry out transactions online and across borders.
● In 2020 a revision has started by European Parliament, taking into account
technological, market and legal developments in relation to the paradigms of
Decentralised Identity and Self-Sovereign Identity. The regulation is not definitive
yet.
The goal is an harmonized European digital identity infrastructure, based on the
concept of European digital identity Wallet, the EUDI Wallet.

4. ● Authenticate themself when using
Digital Public and Private Services →
“open a Bank account”.
● Proving the age when Logging into
Social Networks.
● Obtain Medical Prescriptions.
● Store and present digital documents
and membership cards.
● Sign contracts.
● Authorize payments.
The EUDI Wallet will allow users to …

5. The EUDI Wallet at glance
PID Provider
(Q)EAA Provider
QES Provider
<
Authentication
Attestation of Attributes
PID (VC Type1)
QEAA (VC Type1)
EAA (VC Type1)
EAA (VC Type2)
QEAA (VC Type2)
Qualified Signature
Relying Parties
over the Internet
ISO/EIC 18013-5
OpenID4VP
SIOPv2
Trust
OpenID4VCI*
OpenID4VCI
Signature services
*For PID it’s up to the Member State to define the issuance protocol …

6. Streams and Timeline
Legislation
Expert Group / eIDAS Architecture and Reference Framework (ARF)
Trilogue
Reference Wallet Application
DC4EU
NOBID
POTENTIAL
EWC
Large Scale
Pilots
Adoption In Effect
2023 2024 2025

7. The eIDAS ARF
Along with the regulation, European Member States were asked to
define a technical architecture, standards and technical
specifications, common guidelines and best practices.
The first document elaborated by the experts of the Member States,
the eIDAS Expert Group, was published on On January 26, 2023, this
is called
“eIDAS Architecture and Reference Framework”

8. The eIDAS ARF
The eIDAS ARF defines:
• Five Use cases
• Roles of the ecosystem
• Technical specifications references
• Four Authentication flows
• Two Credential types
ARF supports the development of a reference implementation of an EUDI Wallet. The code
will be available as open source for re-use by Member States.

11. Technologies
Credential Format / Protocols OpenID for Verifiable
Credentials (Online)
ISO 18013-5 (Proximity)
Selective Disclosure JWTs
(SD-JWT) 〇 ×
ISO mdoc (ISO 18013-5)
〇 〇
• Person Identification Data (PID) MUST be issued in both formats.

12. ARF has … Ongoing work …
• References to technical
specifications and standards
• Roles of the ecosystem
• Terms, acronyms and definitions
• Requirements
• Trust Model
• Revocations
• Privacy and Security Considerations
• Legal Persons Identities
• Additional requirements

13. Questions & Answers