Citizen-Centric Digital Identity Wallet: Cross-Border Authentication App for EU eIDAS 2.0 Compliance

Foundational Architecture: The eIDAS 2.0 Digital Identity Ecosystem & Cross-Border Authentication Data Transit Layer

The shift toward a unified European digital identity framework, driven by eIDAS 2.0, represents a fundamental re-architecting of how sovereign identity data traverses national borders. The core technical challenge is not merely creating a mobile wallet application, but engineering a decentralized, privacy-preserving authentication layer that can operate across 27+ distinct national identity infrastructures, each with their own legacy systems, cryptographic standards, and data protection interpretations. This requires a systems-level understanding of the European Digital Identity Wallet (EUDI Wallet) architecture, the interplay between the Person Identification Data (PID) providers, qualified electronic attestation of attributes (QEAA) issuers, and the relying parties (RPs) that consume these credentials.

The Four-Node Trust Model & Data Flow Dynamics

The foundational architecture of any eIDAS 2.0 compliant wallet hinges on a four-node trust model that must be engineered for both security and latency optimization. Unlike centralized OAuth providers (e.g., "Sign in with Google"), the EUDI Wallet operates on a peer-to-peer model where the user device acts as the authoritative data custodian. The four nodes are:

1. The User Wallet (Holder): The mobile application (iOS/Android) that securely stores cryptographic keys and credentials. This is the only node that can initiate a data release.
2. The PID/QEAA Provider (Issuer): A government or accredited private entity that cryptographically signs and issues identity attributes (e.g., "age over 18" or "nationality: German") to the wallet.
3. The Relying Party (Verifier): The service (e-commerce, healthcare portal, banking) that needs to verify an attribute. It must be registered and trusted.
4. The Trusted List & eIDAS Node (Registry): The decentralized network of national eIDAS nodes that publish trust anchors, certificate revocation lists (CRLs), and relying party authorization statuses.

Data Transit Execution Sequence:

| Step | Actor Action | Protocol/Data Element | Failure Mode | Mitigation Strategy | |------|--------------|------------------------|--------------|----------------------| | 1 | User initiates authentication at RP website | HTTPS request to RP server, wallet selection prompt (ISO 18013-7 proximity or OID4VP remote) | Wallet not installed on device; browser cannot detect wallet protocol handler | Universal link fallback to web-based QR code scanning; wallet deep link registration check | | 2 | RP generates a cryptographic presentation request | JSON payload containing requested attributes (e.g., "age_over_18": true), nonce, RP identifier, and return URI | Malformed request; missing required scope parameters | Schema validation against eIDAS Attribute Profile Registry; reject with invalid_request_uri error code | | 3 | Wallet receives the request and prompts user for consent | Local OS-level biometric authentication (Face ID/Touch ID/Android BiometricPrompt) | Biometric timeout; device compromised (jailbroken/rooted) | Enforce biometric-only consent (no PIN fallback for high-assurance attributes); device attestation via Google Play Integrity/DeviceCheck | | 4 | Wallet retrieves the requested credential from secure enclave | Encrypted credential package using ISO 18013-5 mdoc format or W3C Verifiable Credential (VC) with selective disclosure (BBS+ signatures) | Credential expired or revoked; issuer's OCSP responder offline | Implement local CRL caching with TTL; use issuer's HTTP-Signed Certificate Timestamps (SCT) for revocation freshness | | 5 | Wallet constructs and transmits the presentation | Signed JSON Web Token (JWT) containing the presented attributes, proof of possession (private key signature), and issuer's public key thumbprint | Network interruption; TLS handshake failure | Implement exponential backoff retry (max 3 attempts); use session resumption via TLS 1.3 0-RTT | | 6 | RP verifies the presentation against the Trusted List | Validate issuer's certificate chain against the eIDAS Trusted List XML (TSL); check CRL for revocation | Trusted List outdated; issuer certificate chain not in local trust store | RP must sync TSL daily; implement CRLite or OCSP stapling for real-time revocation checks | | 7 | RP completes authentication and establishes session | Returns 202 Accepted with session token or redirects user to authenticated dashboard | Session hijacking; token leakage via referrer header | Enforce short-lived session tokens (15 minutes); use SameSite=Strict cookies; implement token binding to TLS session |

Comparative Engineering Stack: BBS+ Signatures vs. CL Signatures for Selective Disclosure

The eIDAS 2.0 framework mandates support for selective disclosure—the ability to prove an attribute (e.g., "I am over 18") without revealing the underlying data (e.g., exact birthdate). Two competing cryptographic schemes dominate this space: BBS+ signatures (IETF CFRG draft) and Camenisch-Lysyanskaya (CL) signatures. The architectural choice profoundly impacts wallet performance, credential size, and verification overhead.

| Parameter | BBS+ Signatures | CL Signatures | |------------|-----------------|---------------| | Mathematical Foundation | Bilinear pairings over BLS12-381 curve | Strong RSA assumption; modular arithmetic over large composite | | Credential Size (single attribute) | ~1.2 KB (includes proof + signature) | ~4.5 KB (signature over hidden attributes) | | Credential Size (10 attributes) | ~1.8 KB (sub-linear scaling) | ~12 KB (linear scaling) | | Proving Time (1 attribute) | ~15 ms (mobile CPU) | ~180 ms (mobile CPU) | | Verification Time | ~8 ms (server CPU) | ~50 ms (server CPU) | | Revocation Support | Efficient accumulator-based (BBS+ accumulator) | Requires verifiable credential revocation list (VCRL) | | Aggregation Support | Multi-message aggregation via pairing math | Not natively supported; requires additional ZKPs | | Standardization Status | IETF CFRG draft; W3C VC Data Model v2.0 alignment | ISO/IEC 18370-1; legacy in hyperledger indy | | Key Management | Single issuer secret key; multiple public keys per domain | Single issuer secret key; per-credential blinding factor |

Architectural Recommendation: BBS+ signatures offer superior performance for mobile wallets due to sub-linear proof sizes and faster verification. However, they require careful pairing-friendly curve implementation (BLS12-381) which is not universally supported in legacy PKI infrastructure. Hybrid wallets should maintain a CL fallback for interoperability with older national eID systems that have not migrated.

Input/Output Data Models for Cross-Border Authentication

The wallet must translate between the ISO 18013-5 mdoc data model (commonly used for driving licenses and physical IDs) and the W3C Verifiable Credential data model (preferred for web-based authentication). This dual-format requirement is a direct consequence of eIDAS 2.0's ambition to support both proximity (NFC/BLE) and remote (HTTP/WebSocket) presentation modes.

Input Model (Credential Acquisition - User-to-Issuer):

CredentialRequest:
  type: object
  required:
    - issuer_id
    - credential_type
    - proof_of_identity
  properties:
    issuer_id:
      type: string
      format: uri
      description: "eIDAS-compliant issuer identifier from Trusted List"
    credential_type:
      type: string
      enum: ["eu.europa.ec.eidas.pid", "eu.europa.ec.eidas.qeaa"]
    proof_of_identity:
      type: object
      required:
        - auth_method
        - identity_assertion
      properties:
        auth_method:
          type: string
          enum: ["eID_card_chip_reading", "national_id_verification", "biometric_match"]
        identity_assertion:
          type: string
          description: "JWT signed by the national eID system asserting the user's PID"
    requested_attributes:
      type: array
      items:
        type: string
        enum: ["family_name", "given_name", "date_of_birth", "age_over_18", "age_over_21", "nationality", "identifier"]

Output Model (Presentation to Relying Party):

interface PresentationSubmission {
  // ISO 18013-5 mdoc format for proximity
  mdoc: {
    docType: string; // "eu.europa.ec.eidas.pid.1"
    issuerSigned: {
      issuerAuth: string; // COSE signed by issuer
      namespaces: {
        "eu.europa.ec.eidas.pid": {
          age_over_18: {
            value: boolean;
            random: string; // for selective disclosure blinding
            elementIdentifier: string;
          };
          // other disclosed attributes...
        };
      };
    };
    deviceSigned: {
      deviceAuth: string; // Ephemeral key signature proving possession
      deviceKeyInfo: {
        deviceKey: string; // Public key of the wallet
      };
    };
  };
  // W3C Verifiable Presentation for remote
  vp: {
    "@context": ["https://www.w3.org/2018/credentials/v1"];
    type: ["VerifiablePresentation", "EidasPresentation"];
    verifiableCredential: [{
      // Embedded credential with selective disclosure
      credentialSubject: {
        // Only disclosed attributes present
      };
      proof: {
        type: "BbsBlsSignature2020";
        proofPurpose: "assertionMethod";
        verificationMethod: string; // DID or URL of issuer
        proofValue: string; // Base64 encoded BBS+ proof
      };
    }];
    proof: {
      type: "Ed25519Signature2018";
      created: string; // ISO 8601
      proofPurpose: "authentication";
      verificationMethod: string; // Wallet's DID
    };
  };
}

Failure Mode Analysis for Data Model Translation:

| Failure Scenario | Detection Mechanism | Recovery Action | |------------------|---------------------|-----------------| | mdoc format requested but issuer only supports VC | RP sends presentation_definition with both format options | Wallet auto-selects VC format; adds _format_indicator field | | Missing deviceKeyInfo in mdoc | Signature verification fails at RP | Wallet must generate new ephemeral key pair and re-sign | | BBS+ proof invalid due to outdated issuer parameters | Proof verification returns invalid_signature | Wallet requests updated issuer parameters via .well-known/did-configuration | | Selective disclosure attribute mismatch (e.g., RP requests age_over_21 but wallet only holds age_over_18) | RP validates against credential schema | Wallet returns attribute_not_available error code; RP may fall back to date_of_birth verification |

State Machine for Wallet Session Lifecycle

The wallet must manage multiple concurrent sessions with different relying parties, each at different stages of the authentication protocol. A robust state machine prevents race conditions and ensures cryptographic nonce freshness.

States:
  IDLE
    |-- User scans QR or clicks "Sign in with eID"
    v
  REQUEST_RECEIVED
    |-- Validate presentation_definition schema
    |-- Timeout: 120 seconds (user must respond)
    |-- Failure: return invalid_request to RP
    v
  USER_CONSENT_REQUESTED
    |-- Display requested attributes to user
    |-- User approves via biometric
    |-- User rejects
    v
  CREDENTIAL_RETRIEVAL
    |-- Query secure enclave for matching credentials
    |-- Credential not found --> FAILED
    |-- Credential expired --> CREDENTIAL_EXPIRED
    v
  PROOF_CONSTRUCTION
    |-- Generate BBS+ proof
    |-- Build mdoc or VP payload
    |-- Sign with device key
    |-- Cryptographic failure --> FAILED_RECOVERABLE (retry x3)
    v
  TRANSMISSION
    |-- HTTP POST to RP /presentation endpoint
    |-- Network timeout (5 seconds) --> TRANSMISSION_FAILED
    |-- HTTP 4xx/5xx response --> RP_ERROR
    v
  VERIFICATION_WAIT
    |-- Wait for RP confirmation
    |-- Timeout: 30 seconds
    |-- RP sends redirect_uri with auth_code
    v
  COMPLETED
    |-- Clear session data
    |-- Optionally store transaction log in wallet audit

Cryptographic Key Hierarchy & Secure Enclave Integration

The wallet's security posture depends entirely on the key hierarchy stored within the device's secure enclave (Apple Secure Enclave or Android StrongBox). A three-tier key structure prevents a single point of compromise.

Level 1: Device Attestation Key (DAK)
  - Generated at wallet installation
  - Root of trust for all wallet operations
  - Used to sign the DeviceKey public key during registration
  - Never exported; only used for signing operations

Level 2: Wallet Master Key (WMK)
  - Derived from DAK + user biometric entropy
  - Key derivation: WMK = HKDF(DAK, biometric_template_hash, "wallet_master")
  - Used to generate per-credential DeviceKeys
  - Stored encrypted with DAK; decrypted only on biometric approval

Level 3: Ephemeral DeviceKeys (per session)
  - Generated for each authentication session
  - Hashed session ID + WMK
  - Deleted immediately after presentation submission
  - Stored in RAM only; never persisted

This hierarchy ensures that even if the secure enclave is compromised at Level 1, an attacker cannot derive the WMK without the user's biometric data. Conversely, a biometric-only compromise (e.g., deepfake) would yield only the WMK but not the DAK, preventing the attacker from creating new wallets.

Intelligent-Ps SaaS Solutions Integration: Continuous Compliance Monitoring

The engineering complexity described above—spanning multiple cryptographic schemes, state machines, and cross-border trust lists—creates a massive operational burden for wallet providers. Intelligent-Ps SaaS Solutions (https://www.intelligent-ps.store/) addresses this through a centralized compliance orchestration layer that monitors the eIDAS Trusted Lists across all 27 member states in real-time. The platform provides:

• Automated CRL Synchronization: Pushes revocation updates to wallet clients via WebSocket connections, reducing the 24-hour TSL sync window to near-real-time.
• Schema Version Management: Maintains a registry of all eIDAS attribute profiles and automatically updates wallet clients when a member state introduces a new attribute (e.g., "digital residence permit").
• Cross-Border Fallback Policy Engine: Defines routing rules for when a specific issuer's OCSP responder is unresponsive, allowing wallets to fall back to cached CRL data with appropriate risk scoring.

The platform's API-first architecture maps directly to the wallet's input/output models described above, providing pre-validated endpoint templates for both mdoc and VC formats.

Performance Optimization for Cross-Continental Verifications

When a user from Germany authenticates to a relying party in Spain, the verification chain must traverse: German wallet -> Spanish RP -> Spanish eIDAS node -> German eIDAS node (for issuer trust). This can introduce latency of 200-800ms. Engineering optimization strategies include:

1. Trusted List Content Delivery Network (CDN): Cache the TSL XML and CRL responses on edge nodes (Cloudflare Workers or Fastly) with 5-minute TTL. This reduces the RP's verification time from 2 seconds to 150ms for cache hits.

2. Presentation Blinding: Use the BBS+ proof construction to generate a "commitment" before the actual session begins. The wallet can pre-compute the BBS+ signature verification equations during idle time, storing the intermediate pairing values in a local cache. When the actual request arrives, only the final scalar multiplication is required, halving the proving time.

3. Session Resumption with Auth Tokens: For repeat verifications with the same RP, the wallet can issue a short-lived (24-hour) device-bound authentication token that bypasses the full credential presentation. This token is derived from the WMK and scoped to the specific RP's domain.

4. Protocol Negotiation Optimization: The wallet should implement HTTP/2 multiplexing and TLS 1.3 early data (0-RTT) for the presentation submission. This shaves one round trip from the transmission phase, critical for mobile networks with 100ms+ latency.

Long-Term Best Practices for eIDAS 2.0 Wallet Engineering

The architectural decisions made today must anticipate the next iteration of the regulation (eIDAS 3.0 likely by 2028). Key non-shifting principles include:

• Decouple Credential Storage from Issuer Format: The wallet's internal storage layer should use a generic credential abstraction (attribute name, type, value, issuer DID, expiration date). This allows seamless migration from mdoc to VC or future formats without data migration.
• Implement Post-Quantum Readiness: While eIDAS 2.0 uses classical elliptic curves (Ed25519, BLS12-381), the wallet must support hybrid signatures (classical + post-quantum) in its cryptographic abstraction layer. The National Institute of Standards and Technology (NIST) selected CRYSTALS-Dilithium for digital signatures in August 2024; the wallet should prepare for this transition by 2027.
• Offline Verification Capability: The wallet must support proximity authentication without internet connectivity (e.g., airport border control). This requires local caching of issuer public keys and CRLs, with a maximum offline validity window of 7 days. The wallet should expire offline capabilities if it has not connected to the issuer's CDN within 10 days.