Skip to content

Home > Resources > papers > Egg25-Swiss-eID-Security

Security Analysis of the Swiss e-ID & Trust Infrastructure (Egger 2025)

Last modified: 2026-10-23
URL: https://github.com/user-attachments/files/21157739/Security_Analysis_of_the_Swiss_e_ID___Trust_Infrastructure.pdf

Summary

EPFL master's thesis (HexHive, supported by FOITT and the Cyber Defence Campus) presenting a systematic security analysis of the Swiss e-ID trust infrastructure (swiyu), a nationwide SSI deployment with a centralised registry. It builds a threat model per ecosystem component and attack trees for the key security goals, uses them to guide source-code review, and reports more than 90 vulnerabilities, more than half of which were already fixed or accepted in collaboration with the development team. Useful context on the concrete system into which ZKP-based credential presentations would have to be integrated.