eIDAS

From Wikipedia, the free encyclopedia
The EU trust mark for qualified trust services
The EU digital single market and the facilitation of public services across borders

eIDAS (for "electronic IDentification, Authentication and trust Services") is an EU regulation with the stated purpose of governing "electronic identification and trust services for electronic transactions". It passed in 2014 and its provisions came into effect between 2016 and 2018.[1][2]

In 2023, a proposed change to the law would allow any EU government to perform man-in-the-middle attacks and spy on all internet messages, including encrypted communications.[3] The proposal was condemned by groups of cyber security researchers, NGOs, and civil society, as a threat to human rights, privacy, and dignity.[4][5][6]

Description[edit]

eIDAS oversees electronic identification and trust services for electronic transactions in the European Union's internal market. It regulates electronic signatures, electronic transactions, involved bodies, and their embedding processes to provide a safe way for users to conduct business online like electronic funds transfer or transactions with public services. Both the signatory and the recipient can have more convenience and security. Instead of relying on traditional methods, such as mail or facsimile, or appearing in person to submit paper-based documents, they may now perform transactions across borders, like "1-Click" technology.[2][7]

eIDAS has created standards for which electronic signatures, qualified digital certificates, electronic seals, timestamps, and other proof for authentication mechanisms enable electronic transactions, with the same legal standing as transactions that are performed on paper.[8]

The regulation came into effect in July 2015, as a means to facilitate secure and seamless electronic transactions within the European Union. Member states are required to recognise electronic signatures that meet the standards of eIDAS.[2][9]

Timeline[edit]

The law was established in EU Regulation 910/2014 of 23 July 2014 on electronic identification and repealed 1999/93/EC from 13 December 1999.[1][2]

It entered into force on 17 September 2014 and applies from 1 July 2016 except for certain articles, which are listed in its Article 52.[10] All organizations delivering public digital services in an EU member state must recognize electronic identification from all EU member states from September 29, 2018. It applied to all countries in the European Single Market.[11][12]

Vision[edit]

eIDAS is a result of the European Commission's focus on Europe's Digital Agenda. With the commission's oversight, eIDAS was implemented to spur digital growth within the EU.[13]

The intent of eIDAS is to drive innovation. By adhering to the guidelines set for technology under eIDAS, organisations are pushed towards using higher levels of information security and innovation. Additionally, eIDAS focuses on the following:[9][14]

  • Interoperability: Member states are required to create a common framework that will recognize eIDs from other member states and ensure its authenticity and security. That makes it easy for users to conduct business across borders.
  • Transparency: eIDAS provides a clear and accessible list of trusted services that may be used within the centralised signing framework. That allows security stakeholders the ability to engage in dialogue about the best technologies and tools for securing digital signatures.

Regulated aspects in electronic transactions[edit]

The Regulation provides the regulatory environment for the following important aspects related to electronic transactions:[2]

  • Digital identity: a European-wide framework (European Digital Identity Wallet, EDIW)[15] for digital authentication of citizens, with legal validity. Nine principles of European digital identity have been defined:[16] user choice, privacy, Interoperability and security, trust, convenience, user consent and control proportionality, counterpart knowledge and global scalability.
  • Advanced electronic signature (AdES): An electronic signature is considered advanced if it meets certain requirements:
    • It provides unique identifying information that links it to its signatory.
    • The signatory has sole control of the data used to create the electronic signature.
    • It must be capable of identifying if the data accompanying the message has been tampered with after being signed. If the signed data has changed, the signature is marked invalid.
    • There is a certificate for electronic signature, electronic proof that confirms the identity of the signatory and links the electronic signature validation data to that person.
    • Advanced electronic signatures can be technically implemented, following the XAdES, PAdES, CAdES or ASiC Baseline Profile (Associated Signature Containers) standard for digital signatures, specified by the ETSI.[17]
  • Qualified electronic signature, an advanced electronic signature that is created by a qualified electronic signature creation device based on a qualified certificate for electronic signatures.
  • Qualified digital certificate for electronic signature, a certificate that attests to a qualified electronic signature's authenticity that has been issued by a qualified trust service provider.
  • Qualified website authentication certificate, a qualified digital certificate under the trust services defined in the eIDAS Regulation.
  • Trust service, an electronic service that creates, validates, and verifies electronic signatures, time stamps, seals, and certificates. Also, a trust service may provide website authentication and preservation of created electronic signatures, certificates, and seals. It is handled by a trust service provider.
  • European Union Trusted Lists (EUTL)

Evolution and legal implications[edit]

The eIDAS Regulation evolved from Directive 1999/93/EC, which set a goal that EU member states were expected to achieve in regards to electronic signing. Smaller European countries were among the first to start adopting digital signatures and identification, for example the first Estonian digital signature was given in 2002 and the first Latvian digital signature was given in 2006. Their experience has been used to develop a now EU-wide regulation, that became binding as law throughout the EU since the first of July, 2016.[18] Directive 1999/93/EC made EU member states responsible for creating laws that would allow them to meet the goal of creating an electronic signing system within the EU. The directive also allowed each member state to interpret the law and impose restrictions, thus preventing real interoperability, and leading toward a fragmented scenario.[19] In contrast with the 1999 directive, eIDAS ensures mutual recognition of the eID for authentication among member states,[20] thus achieving the goal of the Digital Single Market.

eIDAS provides a tiered approach of legal value. It requires that no electronic signature can be denied legal effect or admissibility in court solely for not being an advanced or qualified electronic signature.[21] Qualified electronic signatures must be given the same legal effect as handwritten signatures.[22]

For electronic seals (legal entities' version of signatures), probative value is explicitly addressed, as seals should enjoy the presumption of integrity and the correctness of the origin of the attached data.[23]

In June 2021, the Commission proposed an amendment and published a recommendation.[24][25][26]

Man-in-the-middle attacks and mass surveillance[edit]

In 2023, a change was proposed to eIDAS that would allow any EU government to surveil all internet communication, even when encrypted.[5][3] The proposal worked via the same mechanism as a 2019 attempt at mass surveillance in Kazakhstan.

The proposal would force browser vendors to place a backdoor in web browsers to let them perform a man-in-the-middle attack, deceiving users into thinking that they were communicating with a server they requested, when, in fact, they would be communicating directly with a government server. The government server could then read and change their messages before passing the possibly modified message on to the intended recipient.[27]

If passed, EU governments would in principle be able to intercept any information transmitted in encrypted form by those browsers, reading any sensitive or encrypted contents without the user's knowledge, and changing information at will.[28][29] This was considered particularly concerning in countries with weaker rule of law, where state and state-connected actors would be able to use the law to spy on their own citizens for political repression and personal gain. There was additional concern that this allow private actors with state connections to gain access to and misuse the power of mass surveillance for their own purposes.[4][6]

While the main language of that text remains in the final draft, provisions have been made in the text that enable browser vendors to continue to implement security provisions that in practice would make this type of interception difficult to perform without being discovered.[30] Specifically, the final draft text states that:

By way of derogation to paragraph 1 and only in case of substantiated concerns related to breaches of security or loss of integrity of an identified certificate or set of certificates, web-browsers may take precautionary measures in relation to that certificate or set of certificates.

which has been interpreted as allowing browser vendors to continue to use mechanisms such as certificate transparency to maintain browser security.[30]

Identity number[edit]

Database information has to be linked to some kind of identity number. To certify that a person has the right to access some personal information involves several steps.

  • Connecting a person to a number, which can be done through methods developed in one country, such as digital certificates.
  • Connecting a number to specific information, done in databases.
  • For eIDAS it is needed to connect the number used by a country having information, to the number used by the country issuing the digital certificates.

eIDAS has as minimum identity concept, the name and birth date. But in order to access more sensitive information, some kind of certification is needed that identity numbers issued by two countries refer to the same person.[31]

Vulnerabilities[edit]

On October, 2019, two security flaws in eIDAS-Node (a sample implementation of the eID eIDAS Profile provided by the European Commission[32]) were discovered by security researchers; both vulnerabilities were patched for version 2.3.1 of eIDAS-Node.[33]

European Self-Sovereign Identity Framework[edit]

The European Union started[when?] creating an eIDAS compatible European Self-Sovereign Identity Framework (ESSIF),[citation needed] but in many countries, users need to be Google or Apple customers to use eIDAS services.

EUTL[edit]

The European Union Trusted Lists (EUTL) is a public list of over 200 active and legacy Trust Service Providers (TSPs) that are specifically accredited to deliver the highest levels of compliance with the EU eIDAS electronic signature regulation.[34]

See also[edit]

References[edit]

  1. ^ a b Turner, Dawn. "Understanding eIDAS". Cryptomathic. Retrieved 12 April 2016.
  2. ^ a b c d e "Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC". EUR-Lex. The European Parliament and the Council of the European Union. Retrieved 18 March 2016.
  3. ^ a b https://blog.mozilla.org/netpolicy/files/2023/11/eIDAS-Industry-Letter.pdf
  4. ^ a b https://last-chance-for-eidas.org/
  5. ^ a b https://nce.mpi-sp.org/index.php/s/cG88cptFdaDNyRr
  6. ^ a b https://www.internetsociety.org/resources/doc/2023/qualified-web-authentication-certificates-qwacs-in-eidas/
  7. ^ van Zijp, Jacques. "Is the EU ready for eIDAS?". Secure Identity Alliance. Archived from the original on 22 November 2016. Retrieved 18 March 2016.
  8. ^ Turner, Dawn M. "eIDAS from Directive to Regulation - Legal Aspects". Cryptomathic. Retrieved 18 March 2016.
  9. ^ a b Bender, Jens. "eIDAS Regulation: EID - Opportunities and Risks" (PDF). Bunde.de. Fraunhofer-Gesellschaft. Retrieved 18 March 2016.
  10. ^ eIDAS in force, applies and exceptions on Europa.eu
  11. ^ Info on eIDAS, Connectis.
  12. ^ Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014
  13. ^ "A Digital Agenda For Europe". EUR-Lex. The European Commission. Retrieved 18 March 2016.
  14. ^ J.A., Ashiq. "The eIDAS Agenda: Innovation, Interoperability and Transparency". Cryptomathic. Retrieved 18 March 2016.
  15. ^ "European Digital Identity Wallet | Shaping Europe's digital future". digital-strategy.ec.europa.eu. 2022-06-13. Retrieved 2024-01-27.
  16. ^ "Towards principles and guidance for eID interoperability on online platforms" (PDF). Europa.eu. European Commission. Archived (PDF) from the original on 24 June 2019. Retrieved 29 August 2021.
  17. ^ Turner, Dawn M. "The Difference Between an Electronic Signature and a Digital Signature". Cryptomathic. Retrieved 21 April 2016.
  18. ^ "Regulations, Directives and other acts". Europa.eu. The European Union. Archived from the original on 12 December 2013. Retrieved 18 March 2016.
  19. ^ "Understanding eIDAS – All you ever wanted to know about the new EU Electronic Signature Regulation". Legal Technology. Archived from the original on 17 January 2018. Retrieved 1 March 2016.
  20. ^ "A Big Step Toward the European Digital Single Market" (PDF). Inside Magazine. Archived from the original (PDF) on 27 March 2019. Retrieved 27 March 2019.
  21. ^ Articles 25 (1) and definitions in article 3 (10) to 3 (12)
  22. ^ Article 25 (2)
  23. ^ Article 35 (2)
  24. ^ "Commission proposes a trusted and secure Digital Identity for all Europeans" (Press release). European Commission. 3 June 2021.
  25. ^ Procedure 2021/0136/COD on EUR-Lex, Procedure 2021/0136(COD) on the ŒIL
  26. ^ Commission Recommendation (EU) 2021/946 of 3 June 2021 on a common Union Toolbox for a coordinated approach towards a European Digital Identity Framework on EUR-Lex
  27. ^ https://www.eff.org/deeplinks/2021/12/eus-digital-identity-framework-endangers-browser-security
  28. ^ https://www.eff.org/document/eidas-letter-2022
  29. ^ https://mullvad.net/en/blog/2023/11/2/eu-digital-identity-framework-eidas-another-kind-of-chat-control/
  30. ^ a b Hoepman, Jaap-Henk (2023-11-20). "Some observations on the final text of the European Digital Identity framework (eIDAS)". blog.xot.nl. Retrieved 2023-11-25.
  31. ^ Hur skapar du en koppling mellan svenska och utländska eID:n? (in Swedish. Title translation: How to connect Swedish and foreign eID?)
  32. ^ "eIDAS-Node integration package". European Commission. Archived from the original on 10 June 2019. Retrieved 29 October 2019. The eIDAS-Node software contains the necessary modules to help Member States to communicate with other eIDAS-compliant counterparts in a centralised or distributed fashion.
  33. ^ Cimpanu, Catalin (29 October 2019). "Major vulnerability patched in the EU's eIDAS authentication system". ZDNet. Archived from the original on 29 October 2019. Retrieved 29 October 2019. Vulnerability would have allowed attackers to pose as any EU citizen or business.
  34. ^ https://helpx.adobe.com/document-cloud/kb/european-union-trust-lists.html

External links[edit]