# Privacy-Preserving Solution for European Union Digital Vaccine Certificates
## 9 Discussion  
The experimental results show that our solution is feasible to implement on current handheld devices, especially on Android smartphones and smartwatches. Applying cryptographic attribute-based credentials in digital vaccine certificates brings benefits in higher protection of citizens' privacy and is in line with current European legislations such as GDPR, the upcoming eIDAS 2.0, and its new tools that it envisages led by European digital identity ([[https://commission.europa.eu/strategy-and-policy/priorities-2019-2024/europe-fit-digital-age/european-digital-identity_en](https://commission.europa.eu/strategy-and-policy/priorities-2019-2024/europe-fit-digital-age/european-digital-identity_en)]([https://commission.europa.eu/strategy-and-policy/priorities-2019-2024/europe-fit-digital-age/european-digital-identity_en](https://commission.europa.eu/strategy-and-policy/priorities-2019-2024/europe-fit-digital-age/european-digital-identity_en)), accessed on 1 September 2023). This identity is intended to allow citizens to prove their identity to access online services, share digital documents, or simply prove specific personal characteristics such as age without revealing their identity or other personal information. We show that even in scenarios where certificates have a theoretical maximum of 500 attributes (which is a highly inflated value), the processing time remains under 300 ms on current smartphones. Consequently, our application can be practical even when dealing with certificates containing a high number of attributes. European Health Insurance Cards are free cards that grant EU citizens access to medically necessary, state-provided healthcare while temporarily staying in any of the 27 EU countries, Iceland, Liechtenstein, Norway, Switzerland, and the United Kingdom, under the same conditions and at the same price. Therefore, European Health Insurance Smart Cards can be used to store information about the citizen vaccination status in the form of our privacy-preserving digital vaccine certifications. Our experimental results show that deploying the implementation of our solution on a smart card platform within a real-world environment is possible. Even with a digital vaccine certificate containing 20 attributes, the verification of completed vaccination would take approximately 3 s.  
In our work, we consider various devices as secure storage of digital certificates (including smartphones/smartwatches and smart cards). Indeed, different devices bring different pros and cons, especially considering the security, time efficiency, and acquisition cost. Some works such as, for example [28], point out the problematic implementation of attribute-based credentials into real-world applications due to privacy and security risks. For instance, the identity disclosure risk allows a dishonest participant to start the conversation by requesting the entire set of attributes, resulting in a total loss of privacy and anonymity. This risk is caused, besides other reasons, by the use of smart cards. Smart cards do not have a user interface that allows users to directly control the attributes that are revealed and, if possible, stop the authentication protocol. Another disadvantage of smart cards is their computing power. As we have shown in our tests, the calculation of cryptographic proof is up to 1000\(\times\) slower on a smart card than on smartphones, and it is limited by a small number of attributes. In this work, we assumed these risks mitigated these shortcomings and demonstrated a practical implementation of attribute-based credentials in a real-world scenario. To do this, we developed an Android mobile application allowing users present and control the revealed attributes from the digital certificate.