Passports, identity cards and travel visas are examples of machine readable travel documents (MRTDs) or eMRTDs for their electronic variants. The security of the data exchanged between these documents and a reader is secured with a standardized password authenticated key exchange (PAKE) protocol known as PACE. A new world-wide protocol migration is expected with the arrival of post-quantum cryptography (PQC) standards. In this paper, we focus on the impact of this migration on constrained embedded devices as used in eMRTDs. We present a feasibility study of a candidate post-quantum secure PAKE scheme as the replacement for PACE on existing widely deployed resource-constrained chips. In a wider context, we study the size, performance and security impact of adding post-quantum cryptography with a focus on chip storage and certificate chains for existing eMRTDs. We show that if the required post-quantum certificates for the eMRTD fit in memory, the migration of existing eMRTD protocols to their post-quantum secure equivalent is already feasible but a performance penalty has to be paid. When using a resource constrained SmartMX3 P71D600 smart card, designed with classical cryptography in mind, then execution times of a post-quantum secure PAKE algorithm using the recommended post-quantum parameter of the new PQC standard ML-KEM can be done in under a second. This migration will be aided by future inclusion of dedicated hardware accelerators and increased memory to allow storage of larger keys and improve performance.
Discovering, managing, and reporting on cryptographic assets is a critical step for the transition to quantum-safe systems and applications. Cryptography Bills of Materials (CBOMs) have been proposed as an aid to cryptographic inventory, agility, and compliance with guidelines to create more secure software and services. Writing policies and automating compliance checks for cryptography is a valuable but complex task. We present a prototype framework for automated evaluation of cryptographic compliance extending existing CBOM tools with a policy-driven engine that classifies cryptographic assets according to customizable rules and compliance levels. Machine-readable policies enable flexible adaptation to different guidelines while supporting analysts in performing semi-automatic assessments. The prototype is validated through experiments on both synthetic and real-world software. Results show that the system correctly identifies deprecated and disallowed primitives, producing clear compliance reports. While we highlight some difficulties common to automating compliance checks, our findings demonstrate the potential of CBOM-based approaches to enhance visibility, governance, and readiness for the post-quantum cryptography transition.
eIDAS 2.0 (electronic IDentification, Authentication and trust Services) is a very ambitious regulation aimed at equipping European citizens with a personal digital identity wallet (EU Digital Identity Wallet) on a mobile phone that not only needs to achieve a high level of security, but also needs to be available as soon as possible for a large number of citizens and respect their privacy (as per GDPR - General Data Protection Regulation). In this paper, we introduce the foundations of a digital identity wallet solution that could help move closer to this objective by leveraging the proven anonymous credentials system BBS (Eurocrypt 2023), also known as BBS+, but modifying it to avoid the limitations that have hindered its widespread adoption, especially in certified infrastructures requiring trusted hardware implementation. In particular, the solution we propose, which we call BBS# , does not rely, contrary to BBS/BBS+, on bilinear maps and pairing-friendly curves (which are not supported by existing hardware) and only depends on the hardware implementation of well-known digital signature schemes such as ECDSA (ISO/IEC 14888-3) or ECSDSA (also known as ECSchnorr, ISO/IEC 14888-3) using classical elliptic curves. More precisely, BBS# can be rolled out without requiring any change in existing hardware or the algorithms that hardware supports. BBS# , which is proven secure in the algebraic group and random oracle models (AGM+ROM), retains the well-known security property (unforgeability of the credentials under the (gap) q-SDH assumption) and anonymity properties (multi-show full unlinkability and statistical anonymity of presentation proofs) of BBS/BBS+. By implementing BBS# on several smartphones using different secure execution environments, we show that it is possible to achieve eIDAS 2.0 transactions which are not only efficient (around 70 ms on Android StrongBox), secure and certifiable at the highest level but which would also provide strong (optimal) privacy protection for all European ID Wallet users.
Accessing online services requires users to choose from a growing set of identity providers, including social logins (e.g., Google), national eID providers (e.g., CIE), and recently, under the revised electronic Identification, Authentication and Trust Services regulation (eIDAS 2.0), “Log in with Digital Wallet”. In self sovereign identity settings, this choice worsens the “NASCAR problem”: users must select among many wallets, while relying parties face significant integration and maintenance costs. The W3C Digital Credentials API shifts selection from the wallet to the specific credential required by the relying parties, enabling a simpler and more interoperable user journey. To achieve this, the API mediates requests and responses through both web and operating system interfaces. Yet this multi-party, cross layer architecture, which spans user agents, operating systems, and wallets, expands the attack surface. This paper presents a preliminary threat model for the Digital Credentials API to identify and mitigate potential threats, thereby supporting a secure, privacy preserving, and interoperable self sovereign identity ecosystem.
Digital identity wallets are currently being developed around the globe, aiming to provide user-centric and secure authentication. Realizing this in a privacy-preserving manner is paramount, and even mandated in Europe which is developing the European Digital Identity Wallet with planned release in 2026. Current proposals to build these wallets are based on classic signature schemes such as ECDSA, but would benefit greatly from the use of anonymous credentials. Thus, there is currently a strong interest in developing the necessary standards to bring these cryptographic concepts into the real world. This work aims to inform ongoing standardization efforts by providing an overview of the most prominent solutions, and the remaining open challenges. We split our overview among two fundamental architectural approaches: (1) dedicated multi-message signature schemes that allow for efficient ZKPs, and (2) general-purpose ZKPs used on top of legacy ECDSA. We also provide a comprehensive summary of the broad feature set that anonymous credentials can provide for identity wallets, in order to demonstrate that upgrading to these systems is a worthwhile endeavor and help to design standards that can leverage the rich existing body of work.
