HDK support in Implementing Acts

[sander]

Given the current state of the Toolbox, the drafts of the Implementing Acts might go into a direction in which HDK cannot be implemented. What do we know about the legislation process? Should we start providing input early, based on the Toolbox feedback document feedback.md?

[sander]

Discussed 2024-06-03. Sander asks David what is the best way and moment to engage.

[sander-cb]

Planned for 2024-06-24

[sander]

Discussed 2024-06-24 with David and 2024-07-01 with the working group. We’d like to communicate soon. A prerequisite is #33

[sander]

Shared 0.1.0 today with EC for first feedback.

[sander]

Possible HDK issues, to discuss at weekly:

• 005 - 5a - Protocols & Interfaces - Art. 3(5)(b): wallet units shall enable authentication and validation of the wallet unit components by presenting the wallet unit attestations to those providers;
  • Modify: “by optionally presenting”. There are technical solutions that require less provision of personal metadata, such as Hierarchical Deterministic Keys. So while the presentation should be possible, it should only happen if necessary. References: HDK Feedback: Make trust evidence provision to Attestation Providers optional eu-digital-identity-wallet/eudi-doc-architecture-and-reference-framework#285 HDK Feedback: Enable asynchronous remote generation of WSCD-bound keys eu-digital-identity-wallet/eudi-doc-architecture-and-reference-framework#284
• 007 - 5a - Protocols & Interfaces - Annex: ISO 18013-5:2021
  • Add: with at least ECDH-MAC for mdoc authentication. The standard allows for several cryptographic algorithms. For interoperability, it is necessary to profile these. The ISO specification recommends ECDH-MAC. The de-facto standard would be ECDSA, but this poses patent risks. See: HDK Feedback: Encourage cryptographic algorithms that avoid patent risks eu-digital-identity-wallet/eudi-doc-architecture-and-reference-framework#286
• 010 - 5a - Integrity & Core Functionalities - Art. 5(3): wallet secure cryptographic applications are able to generate new cryptographic keys;
  • The legal scope of the WSCA needs to be clarified to enable proper standardisation. There are distributed key management technologies available that apply the WSCA for only a single key protected at LoA High, performing additional key blinding logic in the wallet unit for privacy purposes. For example, see: HDK Feedback: Enable distributed key management eu-digital-identity-wallet/eudi-doc-architecture-and-reference-framework#283
• 014 - 5a - PID & EAA - Art. 3(9): Before issuing person identification data to wallet units, providers of person identification data shall authenticate and validate the wallet unit attestations of those wallet units
  • Modify: “Before issuing person identification data to wallet units for the first time”. Enable periodic issuance of batches of one-time-use PID documents without requiring user presence. HDK Feedback: Enable asynchronous remote generation of WSCD-bound keys eu-digital-identity-wallet/eudi-doc-architecture-and-reference-framework#284

[sander]

See #16 to address point 010.