eIDAS (Electronic Identification, Authentication and Trust Services) is a European regulation that regulates digital identity and trust services within the EU. eIDAS was amended in April of this year. The modified version is also referred to as eIDAS2. In this new version, several trust services are recognised:
Electronic signatures and seals
Timestamps
Electronic registered delivery
Website Authentication
Electronic archiving
Electronic attestation of attributes (new)
Ledgers (new)
Remote management of electronic signature and seal creation devices (new
These trust services aim to make digital interactions within the EU safer, more reliable and efficient, with the electronic attestation of attributes playing a crucial role in verifying specific attributes or qualifications of individuals or entities.
In this series of articles, we will discuss the different trust services. This article discusses the turn of 'Electronic attestation of attributes'.
What is an electronic attestation of attributes?
Electronic attestation of attributes makes it possible to electronically confirm specific traits, qualifications, or characteristics of a person or organisation in a reliable and standardised manner.
This service allows a trusted party (the attestation provider) to issue a digital certificate confirming a subject's specific attributes or properties. These may include, for example, age, nationality, level of education, professional qualifications, or other relevant information.
The primary purpose of electronic attestation of attributes is to create a secure and efficient way to share verified information about individuals or entities without disclosing unnecessary or sensitive personal data. This protects privacy and promotes trust in digital transactions and services within the European Union.
How do you encounter it in practice?
Electronic attestation of attributes occurs in different ways in practice. Here are some examples of implementations:
Digital diplomas and certificates: Educational institutions can issue electronic attestations confirming students' academic performance or qualifications. Potential employers or other educational institutions can easily verify these.
Age verification for online services: When using age-restricted online services (such as gambling sites or alcohol sales), an electronic attestation can confirm a user's age without revealing other personal information.
Professional Licenses: Professional organisations may issue electronic attestations confirming professionals' professional qualifications or licenses, such as for doctors, lawyers, or accountants.
Identity verification in financial services: Banks and other financial institutions can use electronic attestation to verify certain aspects of a customer's identity, such as address or income, without requiring full access to personal documents.
Government attestations: Government agencies can issue electronic attestations for citizenship, residency status, and voting rights, which can be used in various services or procedures.
These implementations contribute to a more secure and efficient data exchange, protect individuals' privacy, and reduce the administrative burden.
Today, any agency that holds personal data can share this information through apps, websites, and other digital platforms. The Dutch ‘Vakpaspoort van het Centraal Register Techniek’ (translated: Professional Passport of the Central Register of Technology) is a concrete example. With this digital passport, technical installers can demonstrate that they have the required competencies. The Professional Passport is an app published by the Central Register of Technology, meaning its reliability can be shown to a certain extent.
With eIDAS 2.0, it becomes legally possible to separate the facts that must be able to be shared as demonstrably 'true' from the environment in which they are managed. Moreover, the starting point is shifting: it is no longer the body responsible for the truth of the facts that share this information but the person to whom those facts relate. To this end, the eID Wallet is provided as an independent concept. Wallets should allow people to manage and use descriptive attributes about themselves and their electronic signatures against whomever they want.
The registers that have the facts are now seen as attribute providers and fulfil a different role than before.
An essential technical implementation that perfectly fits the concept of the eID Wallet and the electronic attestation of attributes is 'Verifiable Credentials' (VCs). Verifiable Credentials are digital, cryptographically secured pieces of evidence that can prove the facts mentioned above to be 'true'.
Verifiable Credentials fit perfectly with the eID Wallet concept from eIDAS 2.0 for several reasons:
User control: VCs allow users to decide what information they share, which aligns with the eID wallet's self-sovereign nature.
Privacy protection: VCs allow users to selectively share attributes without revealing unnecessary information, which supports the privacy-by-design principles of eIDAS 2.0.
Interoperability: The standard for Verifiable Credentials promotes the interchangeability of attestations between different systems and countries, which is essential for the cross-border functionality that eIDAS 2.0 pursues.
Trustworthiness: By leveraging cryptographic techniques, VCs provide high trustworthiness and integrity, which is crucial for the trust services under eIDAS 2.0.
By integrating Verifiable Credentials into the eID Wallet, a robust technical foundation is laid for implementing electronic attribute attestation, entirely in line with the objectives and requirements of eIDAS 2.0.
Why is trust important?
Trust is critical in the context of attribute attestation for several reasons:
Data integrity: Trust ensures that the attested attributes are accurate and unchanged, which is essential for trustworthy digital interactions.
Privacy protection: A trusted system guarantees that personal data is shared only when necessary and with the user's explicit consent.
Fraud prevention: Reliable attestation reduces the likelihood of identity fraud and misuse of personal data.
Efficiency in digital processes: Trust in attested attributes speeds up and simplifies online transactions and verifications.
Following the eIDAS guidelines is crucial to delivering reliability at the highest level:
Legal recognition: eIDAS provides a legal framework that guarantees the validity of electronic attestations across the EU.
Standardised procedures: Following eIDAS ensures consistent and reliable methods of attribute attestation.
Interoperability: eIDAS promotes compatibility between different systems and countries, which is essential for cross-border recognition.
Oversight and accountability: The eIDAS framework provides oversight and accountability mechanisms, further strengthening service trust.
Thus, by following the eIDAS guidelines, organisations can ensure a high level of trustworthiness, which is essential for the widespread adoption and success of electronic attribute attestation in the digital economy.
Conclusion
Electronic attestation of attributes is crucial in Europe's digital transformation under eIDAS 2.0. This trust service provides a secure, efficient, and privacy-friendly way to share verified information about individuals or entities. By following the eIDAS guidelines, organisations can ensure high trustworthiness, essential for this service's widespread adoption and success in the digital economy.
Are you interested in implementing the trust service attribute attestation to provide the highest level of reliability? Please contact us. Our experts are ready to advise you on integrating this service into your organisation and how to comply with the eIDAS guidelines.
We wrote a Vision Paper on the use of attested attributes in the context of vocational certificates. Download our vision paper ‘Professional certificates and attested professional qualifications’ here:
Comentarios