What new EU rules for digital identity wallets mean for cryptography

European Digital Identity Wallets are intended to give citizens and businesses a secure way to identify themselves online, store and share digital documents, and create electronic signatures. Their security therefore depends heavily on the cryptographic mechanisms used to protect identities, credentials and communications.

Recent changes to the EU rules governing these wallets make this issue particularly relevant. Under an amended Implementing Regulation linked to eIDAS 2.0, wallet providers must now use cryptographic mechanisms included in the Agreed Cryptographic Mechanisms published by ENISA and endorsed by the European Cybersecurity Certification Group. This means that what was previously mainly technical guidance now has direct legal relevance for European Digital Identity Wallets.

Hans Graux and Charlotte Gerbehaye from Timelex, a POSEIDON project partner providing legal and regulatory expertise, examine these changes in a new article. They explain how the updated rules affect the cryptographic choices available to wallet providers and what further developments may mean for post-quantum cryptography.

We recommend reading the full Timelex article for a detailed explanation of the new requirements and their implications for developers and providers of European Digital Identity Wallets.

From accepted cryptography to post-quantum mechanisms

One of the key points highlighted by the authors is that the currently applicable list of Agreed Cryptographic Mechanisms does not yet incorporate post-quantum cryptography. At the same time, ENISA and the European Cybersecurity Certification Group are already working on an updated version. The draft of Version 3 introduces several asymmetric post-quantum mechanisms, showing how the European cryptographic framework is beginning to adapt to the quantum threat.

The article also distinguishes between recommended mechanisms, intended to provide strong long-term security, and legacy mechanisms, which remain accepted for the time being but are expected to be phased out. This underlines an important challenge for organisations developing long-lived digital identity solutions: legal compliance today does not remove the need to prepare for future cryptographic requirements.

Why this matters for POSEIDON

The development is closely connected to the work of POSEIDON. The project focuses on supporting a secure and reliable transition to post-quantum cryptography, with digital identity management among its central application areas.

As the regulatory framework for European Digital Identity Wallets becomes more closely linked to specific cryptographic standards, research into practical and secure post-quantum mechanisms becomes increasingly relevant. The Timelex article shows how technical progress, standardisation and legislation are beginning to converge around the future security of European digital identities.

It also points to a possible longer-term pathway: results from research initiatives such as POSEIDON may contribute to the knowledge and evidence needed as accepted cryptographic mechanisms continue to evolve.

Read the full article by Hans Graux and Charlotte Gerbehaye on the Timelex website for a closer look at the new rules, the Agreed Cryptographic Mechanisms and their relevance to post-quantum cryptography.