Regulatory options for integrating zero-knowledge proofs into the European Digital Identity Wallet

Abstract

ABSTRACT On 30 April, Regulation (EU) 2024/1183 amending Regulation (EU) 910/2014 as regards establishing the European Digital Identity Framework, known as eIDAS 2.0, was published in the Official Journal of the European Union. This amendment introduces zero-knowledge proof (ZKP) privacy-enhancing technologies to support two key innovations: the European Digital Identity Wallet (EUDIW) and the electronic attestations of attributes ((Q)EAA). In parallel, the European Digital Identity Wallet Architecture and Reference Framework (EUDIW ARF) provide a common set of standards and best practices for the technical implementation of eIDAS 2.0. This paper analyses how the EUDIW can rely on ZKPs since neither the eIDAS 2.0 Regulation nor the EUDIW ARF does so. We propose a software product regime for the cryptographic derivation of data in a ZKP format through three mutually compatible regulatory options: zero-knowledge issuance by default through the EUDIW, through a software product extension of the EUDIW, or a private standalone wallet. These schemes provide the legal basis for the secure use of ZKPs, ensure effective compliance with the GDPR, and contribute to the debate on the value that electronic ledgers introduced by eIDAS 2.0 bring to digital identity.