So I'll just introduce myself and the jealous of them will kind of give you that kind of what
we're going to cover today.
So just for context I'm Connor Fitzmaris, I'm a Ciconda National Expert working in
DG Connect H4, which is a unit responsible for the European Digital Identity Wallach initiative.
I'm on the technical team where my main responsibility is around the large scale pilot projects
that we're currently funding on the digital Europe program.
Thank you.
Thank you, Connor.
And my name is Angeli Sam with the contractors that actually implement the parts of the
open source, the libraries that we are going to see today and you will be able to reach
them.
And we have also people with the team technical team here, like Bobby's and Nico's
around.
So we can all get questions as well for the representatives.
So, Connor.
Thank you.
So what we're going to cover today?
So, I'm going to set out the overall context for the initiative and some of the kind
of policy goals.
I will take too much time as I know we want to get kind of the meter of the matter in terms
of the RF to technical specifications and the reference implementation which we're developing.
So yeah, what I've furthered do, I'll just kick into kind of the context of the wallet.
Some of it might be quite familiar to you, but just a kind of cover.
So one of the kind of, so the motivation for the European Digital Identity Wallach kind of
came around 2020, obviously then going into 2021, we had COVID, the European Digital
Cova, it's certificate, but in general around 2020 there was kind of an assessment around
the existing EID schemes following the original EIDS regulation which was from 2014.
And frankly, it wasn't a huge success in many parts, particularly in terms of usage of
European Digital Identity's cost borders.
Only I think it was 14% of public services were actually accessible, regard it via
EEU, yeah, an identity scheme that was kind of recognized and notified at level of assurance
high.
And this was, that was one challenge, things were moving increasingly mobile and so there was
a need to kind of update and upgrade a lot of digital identity solutions to kind of adapt
for that reality in general.
And then at the same time came kind of COVID and then the digital documents in terms of
COVID certificates and that was kind of another context at the time.
So we kind of, that in mind there was kind of the digital decade program which kind of
governs a lot of what the European Commission does in terms of ejectors kind of governs
what my DG, DG Connectors, which is responsible for a lot of the European Digital Policy
and kind of tech initiatives.
And so there's a couple of of course, one was kind of increasing skills, predictor on new
technologies such as AI blockchain, infrastructure kind of building a kind of sustainable
and secure infrastructure in which Europe, you kind of see that with data centers but also
a lot of other aspects in terms of just making sure everyone has access to internet
with Europe.
So a lot of programs in terms of rolling out about 5G and internet access that we have
business in terms of digitalizing companies of all sizes and to the use of digital tools.
That one has become obviously increasingly important in terms of European competitiveness
and you can see it is a big focus with the European Union.
It was kind of mentioned multiple times about leveraging digital to essentially make Europe a
bit more competitive because frankly we're kind of following both behind, particularly
in the digital space.
I find that there's kind of more my area which is kind of key public services but also
private services.
So the idea is that 100% of public services should be available online so people should
have to choice whether to access a service in person but also online because currently
a lot of public services someone might want to access online are still only available
in a physical format and this would be supported to basically bringing health records
online and essentially secure EIDs which is where the European digital identity will
come in.
So the kind of key concept or kind of let's say line for the European digital identity
identity of a personal digital wallet for all EU citizens residents and businesses and
kind of just to kind of set out what are the kind of key characteristics over European digital
identity wallet.
First it's free for use for all EU citizens so there's no charge model around it so
there's an obligation for a member states to make essentially European digital identity
wallets within essentially two years of the first implementing acts coming into place which
just kind of long story short happened in November so within two years of November but
kind of end in twenty twenty six members states should start make available the first
European digital identity wallets in line with the regulation and it's voluntary so
there's no mandate or obligation on European citizens to use it but there's a right
for you as the European citizen to have access to European digital identity wallets
so it's kind of a very much a choice and there in terms of the next key characteristics
it has to be accepted to a European union so that's by cross all public services but
also private services where there's an obligation on their law of kind of strong customer
authentication so you see that a lot of the context of buying some payment providers.
And finally there was kind of a focus around security privacy orientation orientation which
is a kind of put basically users a bit more in control of the personal data first you
choose to get to your pinch of identity wallet and now the pit data set which will go
into bit later you you need it to be a European digital identity wallet but beyond that
you essentially elect what documents you bring in there basically by interacting so you
can put your driving license you can university qualifications and other documents in
there but it's very much you choose what documents go in and then essentially it supports
selected disclosure so what you're releasing when you're accessing different services.
To kind of go into the functionality of European digital identity wallets there's kind
of tree kind of key pillars and so first we have identification on authentication this
is quite similar to what you see with existing EID schemes nowadays just bringing it
into a very much mobile package. It's kind of leveraging what exists right and pre with
the previous EID as regulation 2014 around kind of level of assurance high which is kind of
identity assurance to make sure that you're very sure if someone's identity and just make
a very secure kind of process there. The next which is the new element with the European
digital identity wallet which is the storing and presenting of what is called in the regulation
attestation of attributes which we think of them as digital documents or credentials so just
could be your driving license it could be a loyalty card it could be diplomas and it could be
different your health records if you also wanted. The final kind of functionality is the
ability to sign and see electronically so with both kind of technical validity so it's
verifiable but also legal recognition try to European union so this is what's called a qualified
electronic signature so the ability basically to sign a document or sign a transaction even
and that would kind of have legal recognition. Maybe one king to keep things explained is that
there just won't be one model it. European digital identity wallet across Europe or even maybe
one in one member's age it's kind of it's very much up to a member's age so there will be
multiple European digital identity wallets there'll all be built to a common set of specifications
which is something we'll get into a lot of kind of detail today and essentially it's up to
each member's state to decide the model so they can either develop it themselves with an
internal digitization agency or such or they can give a mandate or recognition to a private
sector company but there is to essentially issue a wallet in their country and there's no
limitation on the numbers so they can choose to do one one is the obligation because they have to
make one available or they can do many. In terms of kind of the obligation so they all need to be
aligned with the kind of technical specifications which are set down for the European digital
identity wallet and this is just to ensure interoperability and they all need to be certified
to this essentially right now in Niza the European cybersecurity agency is developing a dedicated
cybersecurity schema for European digital identity wallets and so they'll need to be certified
in line with that when it's in place in the future in the meanwhile basically there's kind of
transitionary measures in terms of different certifications gives in member states and that's the
big expected to be in line. So yeah the technical specifications so it's been an open source
process and we originally published the ARF outline in I think it was February 2022 and since it's
standard there's been a lot of work to flesh it out and there's been a lot of discussions but
with member states of what was called the IDISX group but also in terms of the GitHub community
in terms of the feedback we received from private companies large scale pilots and just the kind
of range of stakeholders in the identity space. Essentially the technical specifications we published
among GitHub or currently on version 1.5 I kind of go into a bit of that right now but they're given
legal impairment by basically being set down in implementing acts which are adopted under the
IDISX regulations so that's really where the mandate kind of comes in terms of making it
mandatory for all wallets across the year and so that's one technical kind of workstrand we have
ongoing so we have the regulation we have the technical specifications then we have the reference
implementation which is essentially to provide a kind of reference technical implementation of
European digital identity wallet in line with the technical specifications and there's kind of a
couple of goals behind this one is the providers feedback to see kind of what's working or what
doesn't work we don't kind of want to avoid the scenario where you which kind of happens
in terms of regulations where you kind of write the regulation then you do the implementing acts
and then you realize something you put in the implementing acts doesn't really work but then you'll
have to come to it in five years time and it's kind of a bit late then because you've tried to launch
the thing and it hasn't worked so this was kind of provide feedback towards the technical specifications
which then in fact obviously into what goes in the implementing acts it was also to provide
something to those member states as well as part of projects that didn't want to necessarily
develop their own European digital identity wallet so the idea being they could take this
either as a fully fledged solution and then just re-badget put their own colors make their own
adoptions or they could take certain components certain functionality and integrate it with their
national implementation and we have kind of seen a variation some some members they
are taking a fully summer taking just parts of it others don't want to because they have
very successful solutions and that's kind of to be honest what we were hoping for.
The final kind of technical work strand is the large scale pilot projects which is kind of
my wheelhouse so essentially these are funded under the digital your program and the idea of
it was to kind of pilot and test the usage of European digital identity wallets across kind of
a range of different use cases and so we have two waves of pilot projects so we've had the
first wave which started in April 2023 and they essentially run for two years and it's basically
four consortia involving over 350 entities so it's a huge involvement for public and private sector
in terms of it has almost all member states are included as well as the likes of Ukraine Iceland
and Norway and they're just piloting a range of very interesting use cases so we have for example
nobody which is very coming from the Nordic Baltic identity kind of cooperation and its focus
very much on payments from in terms of the current account separate in some payments then we have
potential which is focused on kind of a range of public service more related use cases we have
WC which is coming more from kind of a business context looking at the leverage usage of wallet
for businesses and then we have DC4U which is kind of coming from the social security slash education
perspective and there's been a lot of activity in these pilot projects so I'd encourage you
to look them up because I regularly publish and on their own GitHub as well as there are deliverables
to work they've done white papers and so there's a lot of interesting material coming out from them
we do have essentially a new round of pilot projects but so which will we hope to start basically
in the future of this year and so we had a kind of call open from May 2024 till essentially November
2024 number of kind of proposals were submitted we're currently going through the grant evaluation
process around them and essentially we'll then move into kind of notifying them of the results and then
essentially hopefully they'll get up and running by kind of Q3 and then we expect them to kind of
take kind of the work that was on in the first pilots a bit further in terms of and also maybe
focus on some new use cases that are quite important at the moment
and I think that's it for me I hope that was informative and I didn't write all too quickly
to everything but I'll hand over to you guys. Thank you. Thank you corner. So from the let's say more
technical side my name is Angelis Center we have Barbies Nichols Center Simo for the product from
the in-skid team and we have a presentation with a lot of information for you I'm going to focus
only on some of them but you will have the chance to see the slides if you like plus the GitHub
that we have. So what we do is we create a representation that is done in open development that
not just open source so we just we do not just release open source versions we keep working on it
and you can see it live. The same goes practically more or less for the architecture reference
framework that is also released in open source in the same way. The main challenges that we face
are the fact that we try to make this right so we go along with the law and the regulation
and the implementing acts. So we code together with the law so that the law is sure that what
can be done will be done in the best possible way and in the meantime we do a lot of let's say
R&D we devise and we standardize protocols because we do not want to break interoperability.
Remember this is about identity and the main let's say way of having identities today
it's when you travel with a passport. It took 15 years to align the passport's worldwide
but today you can go anywhere in 200 countries and you don't afraid of showing your passport
and being rejected that's how important it is it's more important than money because you can exchange
money into something else you cannot exchange yourself into something else when you enter another region
or another service and we want to make this digital for Europeans very fast on the right
on the right hand side you can see several stacks and protocols that we use some of them the most important
ones are coming from the OpenID Foundation OpenID for VP for remote presentation
OpenID for VCI for issuing to standardize how you can connect to and say your identity to
relying parties and how you can connect to issues and retrieve an identity and also in proximity
and I also standard that is there for device to device extends. Of course in the blend in
remote qualified electronic signatures it's the most successful part of VCI that's 1.0
allow me to say it has been done also in open source development that's why it's accessible
these design experiences are being kept and maintained with European Commission effort
more than 10 years now and that's why we can always sign a contact electronically today
okay yes the adoption is low but it's there and it's legally bound if we use it and of course
we recently released a new UI we are by no means the final product but we release everything for those
that are let's say license let's say more savvy and we release everything in Apache 2.0 in
terms of the libraries and the code in order to one or let's say the EU licensing we also
released the the binaries of the apps in the UPL 1.2 but everything is open source and you
can use it and when I walk you through the latest release that is now done end of January
so you can find code for all of these components in the GitHub we have more than
70 repositories out there with modules libraries core modules or the app itself so we have
three and more layers of abstraction in terms of colors here you can see from top to bottom
this is the wallet plus all the ecosystem so in the middle column from top to bottom you can see
the wallet it's the app it's also the connectors to the relying parties to the web browser or
directly to a mobile app in the bottom the pink one is how you connect to the trust anchor whatever it
is it can be on the device it can be on a key that you hold it can be on a remote cloud provider
sorry to say but the regulation says that the member states can choose and this means that
people that vote in the member states can choose whatever they want so yes you can choose to have
your keys on the side of a server if you like and on the left hand side we can see the issues
you see that the issues have been let's say more or less regulated using open ID for this
Y for issuing this helps into the probability meaning I have a wallet from a certain member state
X and then I can issue a new credential from a bank from another member state without doing nothing
on the wallet that's the goal at least that's the mission and the same goes for the right
hand side if you one of the two important things for the presentation the first was what Conor said
about the regulation the second is this Github page so we publish everything in this
Github organization by the EU for this identity wallet you can find there the architecture
and the code so meaning all the legally bound technical descriptions and the repositories
of course the final version of the architecture is not here we are in 1.5 today but we are getting
why is that the regulation gives us several months to create the so-called implementic acts and
therefore find and analyze the details and we are cautious in doing that so that we don't have
a regulation that we cannot implement technically or we have to invent and the clothes that will take
three years from now to to do it and let me show you sorry yeah five ways of approaching this
one you can download an executable for the wallet and use it as a demo you can have it for iPhone
you can have it for Android and the repositories are the ones here if you die for all our repositories
and then you can see either an app or an SRV for a server or a library depending on our
way of naming conventions this is the wallet solution you can download the app you can change it
you can if you like to customize it for your university for your company for your organization
for your member state and then you have a wallet that is based on the UDI that's the first approach
another approach is if you have already a wallet for any reason that works in any way
centralized decentralized doesn't matter and you want to use all the libraries that we have
you we have a little some little it's the case that try to work as a black box
for qualified electronic signatures or for the wallet itself we call them core and kit
these are naming conventions that you know kit is very popular in the IOS world for those
that know about it they launched it so we said it kit and we have a core and it's useful for
a bunch of libraries so instead of learning all the underlying technologies that are there the
PVCI that people are painfully coding them in our team and painfully working with the
writers to find the best way of writing them we have this middle layer here
the third way is yes you are very welcome to navigate towards the repositories they are
I told you like 70 of them one of them a block of them is about the issuing
we have actually two implementations of the issues one is a Kotlin based it's a default
can work with Java things like key cloak etc that exists out there the other one is Python based
you can find them as running them also you can connect to them to test your wallet
you don't have to install anything but you can also download them and create your own instance
and we have a quite a documentation for that that can help you to run it they are
implementing open ID for VCI they have more than 14 different other stations for different verticals
practically we have most of the attestations that the large scale pilots have not all of them
we're getting there but we're trying to have samples for that right these are all samples
we don't have loss for that rule all these attestations yet in those that we have rules we have
rule books that we can have rule books that can demand how an attestation is made for example
a driving license across Europe across the world it has a specific rule book the passport again
but how you make your diploma in the university it doesn't or the prescription to give you an
idea so we give you a way to accommodate anything that an attestation can be
the support for both attestation formats is there for SDJOT VCI and DM doc
now a second block of repositories have to do with the connection to the service providers
I want to book a ticket I want to rent a house I want to lease a car
you call them service providers
technically we call them also relying partners parties or verifires
now we have the code for the verifires we have a verifire that is in verifire.edu.dev
up and running so you can test your wallet with a verifire without actually setting up a verifire
if you want to set up a verifire we have also the projects for that in the backend and the web
if you want to change that web it's a separate project so it's easier for you you don't have to
change the backend code you use it as an API so it's quite modular I'm trying to say
we also have a registration facility where in case you have a verifire or you want to run a verifire
from our site and you want to be compatible with others that run our wallet you can register it
so that the wallets can use also your verifire the idea behind the regulation is that the wallets
cannot sell data to anyone in order to protect people this means that if a bank asks you for
something the bank needs to somehow get a permission from the member state to allow them to ask for that
it's like not not anyone should be able to get your others for example and we also have the
fifth part block for electronic signers so there is digital signature services yes but we made them
into the wallet so that we want to make signing easy so we want to put it in one place because now
there are wallets and apps that help you for signing there are other wallets for payments and there are
a wallets where you can put your passports and the else probably in the United States but we here
we're trying in you to make them all together in one in an open way so you will see all the code
we have the signers for both wallet centric let's say I have a PDF on my phone I want to sign
that centric somewhere that's the idea we have it full stock wallet service and a sharing
I have a PDF in my server and I want to use my typical qualified electronic provision
enterprise is have that so imagine that okay then the prices do not have the documents in
their wallets right they have them in the server the contracts with the customers the contracts with
other people that they'll business with and they want to sign them and they see you or I don't know
somebody wants to sign this thing he gives the command and gets it back
we have all of these online
a step-by-step for local installation of the apps is available and also guidelines
to choose your configuration option you can see on the left our newest UI
that's available for you and you can this is modular you can use the system to change it
another way to do of course elected disclosure select disclosure is actually possible in any
at a station format that we use it's a thing that we need to have privacy by design therefore
we cannot choose that an at a station in this implementation that will not do select the
disclosure so the users can choose what to share and how of course this is an ongoing endeavor
and it's being improved on the protocol side how to run it in the front end how to run it in the
back end for a component that are using Docker compose links to the GitHub ways of running this
these squares we run in these squares so that you don't have to run it and it has already
all of the self samples that you can use but also sample forms where you can test your new
at a stations or like the idea behind this form is the following is not just to create a PID that
is for Batman or for Santa Claus the idea is to get this and extend it to use it for your new
at the station so for example you're student idea I don't know or you know something else
yeah actually the ARF as I said is ongoing thing we try to formulate an ARF architecture and
therefore we talk to protocols and we change them and we have a photographers group under
in this other checks that we need to get a feedback officially let's say or in a more organized way
to do this but remember we're trying to build something for the next and within the next framework
of three years we're not going to solve things that will come up during that period or after that period
so correct correct I understand I completely understand that the decision is on the member states
so the cryptographers need
but we do we do blog it says the decision of the member states again it's a policy thing
so this must is given by the member states we don't we don't propose this we don't propose anything
I don't want to talk about any kind of policy