The EUDI Wallet's privacy architecture, six months from the deadline
How the unlinkability requirement is being engineered, and the layered cryptographic schemes that may carry it into production
Anything deployed today has a shelf life of six to seven years before you have to swap it out for a post-quantum state. That's a short time to amortize.
Among the architectural commitments in the European Union's eIDAS 2 regulation, the strictest is a requirement that wallet credentials be unlinkable, so that neither one verifier nor a colluding set of verifiers should be able to determine that two presentations came from the same person, and the issuer of a credential should not be able to link it to any later use.
The regulation is binding, and the deadline by which every member state must offer a citizen-facing wallet meeting is December 2026. Six months from that date, the conversation about how to deliver the unlinkability property has moved.
A lot of countries will be delayed, Leif Johansson said when asked about the state of the rollout. Johansson is the executive director of the SIROS Foundation, the Stockholm-based nonprofit that maintains SIROS ID, one of the European Digital Identity Wallet implementations now competing for member-state certification. The certification machinery the regulation depends on is not yet finalized. "I'm not surprised they are delayed because they are extremely complex."
There has been a move within the EUDI Wallet community away from hardware-based approaches to delivering unlinkability and toward cryptographic ones. There are good reasons driving this due to hardware economics at high-assurance certification levels, post-quantum migration timelines, and the operational cost of one-use credential issuance at member-state scale. So, which cryptographic schemes will carry the requirement into production?
What unlinkability is, and why eIDAS demands it
Most digital credentials today are designed for a model in which the verifier sees the credential, sees the cryptographic signature on it, and uses that signature to confirm authenticity. The signature is the same every time the credential is presented. In aggregate, this means any two relying parties who check the same credential see the same signature, and can correlate the presentations to a single person. For a national identity wallet that hundreds of millions of citizens will use to prove age at bars, residency to landlords, and employment status to platforms, without unlinkability, the wallet functions effectively as a state-issued tracking token.
eIDAS 2 anticipated this. The regulation requires that wallet implementations prevent both verifier-to-verifier and issuer-to-verifier linkability, so no observer should be able to correlate two presentations of the same credential, and the credential's issuer should not be able to identify when the credential is being used by its holder.
How the architecture has moved
Delivering unlinkability cryptographically can be approached in more than one way. A signature-side approach uses signatures that produce a different verifiable output on every use; schemes in the BBS family are designed for this and have been studied in the cryptographic literature for two decades. They are not currently supported in the secure-element hardware that government identity programs rely on at the assurance levels eIDAS demands. The wallet-side approach proves the validity of a signed credential without revealing the signature itself using zero-knowledge proofs.
The pragmatic middle that the EUDI Wallet community settled on early was neither of these, because issuers would sign many short-lived credentials in advance, one for each anticipated verification use case, and the wallet would present whichever credential matched the query. Each credential is used once, then discarded; the issuer regenerates the supply on a rolling basis. Johansson and others have described this as "structured selective disclosure via credential multiplication." The advantage is that it uses conventional cryptography that runs on existing hardware. The constraint is that at nation-state scale, the issuer carries the cost of continuous credential generation, and the wallet has to track and rotate a continuously-replenished population of one-use objects.
Engineers at Yubico, Emil Lundberg and John Bradley, have been specifying a more architecturally elegant path in an IETF draft. The scheme, Asynchronous Remote Key Generation (ARKG), descends from a lineage that traces to BIP-32, Bitcoin's hierarchical-deterministic wallet specification: a WebAuthn account-recovery construction borrowed BIP-32's privacy-preserving key derivation, which Frymann and colleagues then generalized and named. It lets a hardware authenticator derive a different unlinkable key for every relying party from a single root. In principle, a single signing root in a YubiKey or equivalent hardware element could deliver per-presentation unlinkability cryptographically, without the issuer-side credential factory. ARKG drafts have been working through the IETF Crypto Forum Research Group, and Yubico has produced prototypes interoperable with SIROS ID.
What ARKG turned out to do, according to Johansson, was complicate the certified secure-element factor. To deliver ARKG at the certification level eIDAS demands for high-assurance credentials, the hardware must hold a digital signature key, complete a per-presentation key-derivation operation, and produce the output within the latency budget of a real-world verification like a passport check or a bank login. The HSMs that currently hold credentials at that assurance level are slow. At certification grade, Johansson said, ARKG-capable HSMs operate well below their specification performance and require four to eight times the hardware to compensate. The result, in his words, is a "latency-bound performance profile" and a provisioning cost most member states have limited appetite for.
Several member states are reconsidering how strictly the unlinkability requirement can be delivered at the highest assurance levels in time for the December deadline. That's why there has been a surge of interest in cryptographic unlinkability via zero-knowledge proofs, along with a more layered conception of how the requirement might actually be met.
The cryptographic conversation
A zero-knowledge wallet proves to the verifier that the holder has a valid credential meeting a stated property that they are old enough, a resident of the right country, or a holder of the right professional license, without revealing the credential or the signature on it. Two presentations produce two proofs that share no correlatable structure. ZK moves the cryptographic complexity to the wallet side, which has compute headroom, and pulls cost away from the issuer side.
The BBS family, the cryptographic approach that originally seemed the natural answer to the unlinkability requirement, is in active development. The German EUDI Wallet team is pursuing an approach that combines BBS with other primitives, including ZK. The SIROS Foundation, he said, is "heavily involved in trying to kind of make all of those things happen."
The post-quantum subtext
Behind these choices is the constraint of post-quantum security. The cryptographic schemes that current eIDAS deployments rely on, like ECDSA over P-256, RSA, and the BBS family, are vulnerable to a sufficiently powerful quantum computer running Shor's algorithm. The US National Institute of Standards and Technology has ratified a first wave of replacement algorithms designed to resist quantum attack, including ML-DSA, the lattice-based signature standard.
"Anything you deploy today has a shelf life of six to seven years before you have to swap it out for a post-quantum state," Johansson said. "That's a short time to amortize. Everybody wants to find a ZK solution that is credible for a post-quantum state."
Longfellow has a structural property others are working to develop: its zero-knowledge layer relies only on the hardness of SHA-256, which Shor's algorithm does not threaten, so the proof system is already post-quantum even when the credential underneath is not. The scheme combines two well-studied cryptographic building blocks, Ligero and sumcheck, and is adaptable to lattice-based signature schemes such as ML-DSA. "The fact that you can run Longfellow over existing P-256 credentials that are working in hardware today and ML-DSA tomorrow," Johansson said, "that's very effective."
The wallet design
SIROS ID is unusual among EUDI Wallet candidates. Where most member-state wallets are mobile-native applications written for iOS or Android with platform-specific security primitives, SIROS ID is a web wallet, a browser application anchored to a passkey or hardware security key.
The advantage of this is portability, since a browser-based wallet runs on any device with a modern browser, and sidesteps the platform-specific quirks of iOS and Android secure enclaves, and inherits the FIDO/WebAuthn passkey infrastructure that has been the focus of authentication standards work for a decade. The disadvantage is the hardware-bound key gap. On a mobile device, the wallet can ask the operating system to generate and hold cryptographic keys in a hardware secure element.
Yubico has proposed a closing primitive, implemented in beta on the YubiKey 5.8 firmware: an extension to the FIDO standard that allows hardware-bound key attestation through a passkey on a non-mobile device. With that extension, Johansson said, the web-wallet design can match the security properties of a mobile-native wallet for nearly every workflow. The residual gap is the integrity of the wallet code itself, the question of how a verifier knows it is talking to a legitimate wallet rather than a malicious imitation running in a compromised browser.
One answer modern browsers offer is Isolated Web App attestation, a Chromium-specific feature that lets the browser cryptographically attest to the verifier that the wallet code is unmodified.
The deployment ground
Six months before the regulation's deadline, the European Commission's own published assessment is that fewer than a quarter of member states have wallet-enabled applications in flight. ENISA, the agency the regulation tasks with certifying wallet implementations, was still in public consultation on the certification scheme through April 2026. Johansson's reading of the delay was sympathetic, because the certification scheme itself is not yet final, and member states cannot certify their wallets against a scheme that does not yet exist. "That would be the stated bottleneck," he said. "There will be other things that aren't quite ready, but that's a good focus."
Revocation in zero-knowledge wallets is an active research area. Johansson is firm that revoking a ZK credential is itself a solved problem, "You can revoke those ZKs just fine." Accumulators or status lists the wallet keeps synced with the issuer handle most operational cases. The open question is scale: at the size of the very largest population-identity systems, the data volumes strain what those methods do comfortably.
The architectural inheritance
SIROS itself is one of two products the foundation maintains. SIROS ID is the active wallet; wwWallet is the open-source precursor it was forked from.
The foundation's active partnerships extend well outside the EU. SIROS works with the Digital Identification and Authentication Council of Canada on cross-border interoperability, with a Finnish-Swedish research-data-access pilot that has drawn interest from Australia and New Zealand, and with the Organized Crime and Corruption Reporting Project on a digital press credential for investigative journalists, roughly ten thousand worldwide by Johansson's reckoning, operating across many jurisdictions and threat models.
The EU framework, Johansson observed, has chosen a different sequencing from the first generation of self-sovereign identity work. The earlier projects, including much of the Trust Over IP Foundation's decentralized-identifier and verifiable-credential work, focused on the distributed nature of the underlying infrastructure, like how identity claims could be issued, presented, and verified without a central party. The EU framework, in his telling, starts with securing the wallet architecture, and treats the distributed infrastructure as something to layer on top.
"You have to start by securing the architecture in the wallet," Johansson said. He framed it as an architectural preference rather than a judgment on the earlier work, much of which informed the standards the EU is now building on.
What the next jurisdictions inherit
The first generation of digital identity rollouts at scale, like Aadhaar in India, the Estonian e-Residency program, or Singapore's National Digital Identity, were designed by their home jurisdictions for their home populations. The EUDI Wallet, by contrast, is being designed under regulatory pressure to interoperate across twenty-seven member states whose populations, legal traditions, and existing identity infrastructures are different.
Beyond the EU, the same architecture is being watched by every country preparing to build its own wallet. Canada is one. Australia and New Zealand are evaluating. The DIACC partnership has produced a framework for cross-border verification. The genomic-data pilot has drawn inquiries from research networks on three continents. The OCCRP press-pass collaboration is, by design, transnational.
What the eIDAS rollout produces under deadline pressure, the choices settled soon will become at least part of what the next generation of national wallets inherits.
