Self-Sovereign Identity and eIDAS 2.0: An Analysis of Control, Privacy, and Legal Implications
This paper analyzes the compatibility of Self-Sovereign Identity (SSI) models with the European eIDAS 2.0 regulation and its Architecture and Reference Framework through a systematic legal and policy review, aiming to identify current limitations and opportunities for enhancing the framework's support of decentralized identity paradigms.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine your digital life is like a backpack.
In the old days (and currently in many places), this backpack didn't belong to you. It belonged to a giant company or a government office. They held the keys, decided what you could put inside, and could even lock the backpack shut if they didn't like your behavior. This is how most of our current digital identities work (like logging into Facebook or a bank). You are just a guest in their house.
Self-Sovereign Identity (SSI) is a new idea: You own the backpack. You hold the keys. You decide what goes in, who gets to peek inside, and you can take the backpack with you anywhere, even if the original store that sold it goes out of business.
eIDAS 2.0 is the European Union's new set of traffic laws for digital identity. It's trying to make sure that when you travel from Italy to Germany, your digital ID works seamlessly.
This paper is like a mechanic inspecting a new car (the EU's new digital identity wallet) to see if it actually runs on the engine of "Self-Sovereignty" (SSI), or if it's just a fancy car with an old, restricted engine.
Here is the breakdown of their findings using simple analogies:
1. The Main Conflict: The "Master Key" vs. Your Key
- The SSI Dream: You generate your own ID (like creating your own unique username and password) and prove who you are without asking permission from a boss.
- The eIDAS 2.0 Reality: The EU says, "To use our official digital wallet, you must first get a Master Key from the government (a government ID)."
- The Problem: The paper argues this is like saying, "You can own your own house, but you can't open the front door unless the landlord gives you a specific key." It creates a bottleneck. If the government decides to revoke your key, your whole digital life stops working, even if you have your own private keys.
2. The "Selective Disclosure" Magic Trick
- The Goal: Imagine you need to buy alcohol. You need to prove you are over 18.
- Old Way: You show your whole ID card. The shopkeeper sees your name, address, birth date, and height. They now know way too much about you.
- SSI Way: You use a magic trick. You show a glowing badge that says "Over 18: YES" but hides your name and address.
- The Paper's Verdict: The new EU laws allow for this magic trick (called "Selective Disclosure"), but they don't force it. It's like a restaurant saying, "You can order a salad, but you don't have to." The paper argues that for privacy to be real, the law should require the salad option to be the default, not just an option.
3. The "Trust Anchor" (The Middleman)
- The SSI Dream: You, the Issuer (who gave you the ID), and the Verifier (the shop) talk directly to each other. No middleman needed.
- The eIDAS 2.0 Reality: The system still relies heavily on a "Notary" or a "Trust Anchor" (a government-approved server) to verify that the ID is real.
- The Analogy: In a true SSI world, you show your driver's license, and the cop checks the hologram on the card. In the EU's current plan, the cop has to call the DMV on the phone to ask, "Is this card real?" before letting you go. This makes the system slower and gives the DMV (the government) total control over your ability to move.
4. The "Black Box" Problem
- The Issue: The paper points out that while the EU wants to be transparent, the software running these wallets is often a "Black Box." You can't see inside the code to check if it's spying on you.
- The Fix: The authors suggest the code should be Open Source (like a recipe anyone can read) so the public can verify that the wallet isn't secretly tracking your movements.
5. The "Lost Wallet" Dilemma
- The Issue: If you lose your physical wallet, you can go to the bank and get a new card. If you lose your digital SSI keys (your "seed phrase"), your identity is gone forever.
- The EU Approach: The EU wants to make sure you can recover your identity if you lose it, but they want the government to be the one helping you recover it.
- The Paper's View: This creates a conflict. If the government helps you recover it, they have a backdoor into your identity. The paper suggests we need a way to recover your identity using a group of trusted friends (like a "social recovery" system) rather than just the government.
The Final Verdict: "A Good Start, But Not Fully Free"
The authors conclude that eIDAS 2.0 is a massive step forward compared to the old laws. It recognizes new technologies like Blockchain and allows for better privacy tools.
However, it is not "Self-Sovereign" yet.
- It's like a hybrid car: It has an electric engine (SSI/Blockchain) but it's still tethered to a gas tank (Government IDs and Centralized Servers).
- The Tether: As long as you need a government-issued ID to unlock the wallet, you aren't truly "Sovereign" (in charge of yourself).
What needs to happen?
The paper suggests the EU needs to loosen the rules:
- Let people create their own IDs without needing a government ID first for non-critical things.
- Make "hiding your data" (Selective Disclosure) a mandatory rule, not an optional feature.
- Stop relying on a central "phone call to the DMV" for every check; let the math (cryptography) do the work directly between people.
In short: The EU is building a very secure, high-tech digital passport system. The paper is saying, "Great job on the security! But please, let the passengers hold the steering wheel, not just the government."
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.