Skip to content

Home > eID > eID-Open-Questions

e-ID Open Questions

Last modified: 2026-10-28

Description

Open research and engineering questions for privacy-preserving e-ID, collected from the follow-ups of the taxonomy (GHE25-Taxonomy) and the remaining challenges identified in the eid-privacy reports (GHE26-MS2, DHG26-MS4).

From the taxonomy follow-ups

The taxonomy is a glossary and the first step of a systematisation. The planned next step is to define evaluation criteria and apply them to higher-order constructions and complete systems: - Longfellow (FS24-Longfellow): ZKPs over ECDSA-signed mdoc. - zkattest-rs (heidiverse-zkattest-rs): blinding ECDSA holder-binding signatures using the Tom-256 curve. - Crescent (PPZ24-Crescent): privacy features for existing JWT and mDL credentials. - swiyu (swiyu-Technical-Documentation): the Swiss e-ID. - The EUDI ARF (EUDI-ARF): the reference for the European Digital Identity.

Cryptography

  • Post-quantum unlinkable credentials that work with phone hardware: discrete-log based backends (e.g. Spartan) are not post-quantum, and phone secure elements only offer ECDSA P-256 (Post-Quantum-and-eID).
  • Assurance of complex ZKP constructions: the security of Longfellow, Crescent and similar systems relies on audits rather than formal proofs; how many independent reviews are enough (eID-Threat-Models)?
  • Fold-and-reuse circuits (Vega) to amortise SHA-256 over credential blocks, and how to express folding in a circuit DSL such as Noir (DHG26-MS4).
  • Linking credentials from different issuers to the same person without a linkable identifier (name and birth date? social-security number?) (Predicate-Proofs).
  • Verifier-exclusive and deniable proofs suitable for e-ID (Predicate-Proofs).

Post-quantum migration

  • BBS+ and other pairing-based anonymous credentials are not post-quantum and are not available in HSMs or phone secure elements (GHE25-Taxonomy). If regulation requires hardware-backed non-transferability, any scheme not supported by hardware may need years of standardisation and roll-out, during which post-quantum security may become necessary.
  • NIST plans to deprecate non-post-quantum algorithms by 2030 and disallow them by 2035 (NIST-IR-8547, cited in GHE26-MS2). Standardising a new non-PQ scheme such as BBS at NIST would run counter to that plan.
  • Phone hardware today offers ECDSA P-256 only (Hardware-Security-for-eID), so Holder-Binding is not post-quantum either, regardless of the proof system.

Revocation and metadata

Ecosystem and deployment

  • Circuit distribution and versioning: a trusted channel for circuits and acceptable public parameters, so that a verifier cannot distribute a circuit that over-asks, and so that circuit updates do not enable downgrade attacks; it should complement the verifier registry (DHG26-MS4).
  • Standardisation: how OpenID4VP and other protocols will integrate multiple proof systems; ETSI work on BBS, Longfellow, Vega and OpenAC (Communication-Protocols).
  • Performance on phones: reaching 1 s for a full SD-JWT proof on mid-range phones (currently 4.5 s with pre-computation) and storing sensitive pre-computation data safely (ZKP-on-Mobile).
  • Cost of server-side proving for cloud wallets, which differs between high-volume / low-margin and low-volume / high-margin use cases (DHG26-MS4).
  • Auditability of the toolchain, e.g. of Noir and of the proving backend (DHG26-MS4).
  • Where ZKPs help at all: many e-ID uses (bank account, mobile subscription) legally require full identification; KVRSCLT26-EUDIF-Harms argues that some harms of digital identity cannot be mitigated by PETs; see also ECZJG24-Need-ZKP.
  • Usability: privacy mechanisms are rarely evaluated with users (IES25-SoK-Unusable-Privacy).

Resources