# The eIDAS Regulation: A Survey of Technological Trends for European Electronic Identity Schemes
## 4 RQ2: Authentication Standards  
In this section, we will explore the authentication standards adopted by the notified eID schemes. To reach this goal, we investigate the solutions provided by eID means under analysis and, as a result, we identify the following features:  
**SSO Protocols:**: Single Sign-On (SSO) is an authentication method that lets users access multiple applications and services using a single login credential. The adopted SSO standards based on our analysis are the following:  
1. **SAML (Security Assertion Markup Language 2.0) [49]:**: is among the most widespread standards used to exchange authentication and authorization assertions (in XML formats). SAML requires that the User (called Principal) is registered with an Identity Provider (IdP), which, after receiving a request message from a Service Provider (SP), will respond with an authentication result (called assertion). An assertion contains information that SP uses to evaluate whether to give or deny the Principal access to a particular resource;
2. **OIDC (OpenID Connect) [3]:** is a most recent authentication standard for user authentication that is designed for the same purpose as SAML. In contrast to SAML, which uses heavyweight XML messages, the OIDC uses the lightweight JSON message format. OIDC is an authentication layer developed on top of the OAuth 2.0 standard. It requires that the User (called Resource Owner in the context of OIDC) is registered with an IdP, which after receiving a request message from a relying party (RP in the context of OIDC) will respond with an authentication result (called ID Token). An ID Token is one of the main features that is added by the OIDC and contains information about the authentication process that enables the RP to evaluate whether to give or deny the resource owner access to a particular resource. In addition to the ID Token, the OIDC  
Figure 4: Overview of Authentication Mechanisms based on LoAs adopted by MSs. adds the userInfo endpoint into the OAuth standard as well, which is a protected OAuth Resource Server that releases identity-related claims to RPs (e.g., the email and address). The terms RP in the OIDC and SP in the SAML refer to the same entity. Hereafter, we use the term SP;
3. **FIDO (Fast Identity Online) [50]:**: is a protocol that uses standard public key cryptography techniques to provide stronger authentication. During the registration with an SP, the user's device creates a new key pair. It retains the private key and registers the public key with the SP. Authentication is completed by the user's device proving possession of the private key to the SP by signing a challenge. The user's private keys can be used only after they are unlocked locally on the device. The local unlock is accomplished through a user-friendly and secure action, such as swiping a finger, entering a PIN, inserting a second-factor device, or pressing a button. **SP-IdP Federated:**: indicates whether a federation is required through the registration phase of SP at the IdP to obtain SP-specific credentials and IdP metadata, where federation can be expressed as an agreement between parties that trust each other. The SP-IdP federation applies only in the case of SSO protocols. **Direct Login:**: indicates whether the eID means under analysis does not use any federation mechanism, meaning that all identification and authentication communication occurs directly between the user and the SP. We report the main results per each eID means within columns 12-16 of Table 2. According to our investigation, 29 out of 40 notified eID means use at least one authentication standard (SAML, OIDC, FIDO) to provide an SSO service and 9 eID means use the direct authentication model.