# The eIDAS Regulation: A Survey of Technological Trends for European Electronic Identity Schemes
## 3 RQ1: Authentication Mechanisms Based on LoA
### Authentication Mechanisms: LoA Substantial  
The authentication mechanisms at this level provide substantial confidence that the subject controls an authenticator registered to the service. They require two different authentication factors. There are several alternatives, and the authenticator could be a combination of something the citizens know (e.g., a password) with something the citizens possess (e.g., a SIM or a physical document or device) or something the citizens possess (e.g., a mobile application) protected with something the citizens are (e.g., their fingerprint) or know (e.g., a PIN).  
In case of possession, to prove the control of an authenticator, usually the authentication protocol requires the exchange of a One Time Password (OTP), which is a password that is valid for a short time and can only be used once.  
The authentication mechanisms for LoA S based on our analysis results are:  
**PWD + SMS:**: username/password (knowledge factor) plus an OTP sent via SMS message to the registered phone number (possession factor) of the user;
**PWD + SW:**: username/password (knowledge factor) plus an OTP generated each time s/he requested it by an OTP software application (possession factor) installed on his/her phone;
**PWD + MAT:**: username/password (knowledge factor) plus a physical document (possession factor), also called \"matrix\", with the list of codes (OTPs) that s/he has to use to reply to the randomly generated challenge from the online service;
**PWD + HW:**: username/password (knowledge factor) plus a physical electronic device (possession factor) which generates an OTP each time the user requests it;
**PWD + QR:**: username/password (knowledge factor) plus the scan of a QR code from a registered application (possession factor) that then generates an OTP to the online service;
**PWD + PN:**: username/password (knowledge factor) plus the sending of a Push Notification directly to a secure application on the user's device (possession factor), alerting the user that an authentication attempt is taking place. Note that the user should provide a PIN (possession factor) or use biometrics (inherence factor) to complete the authentication after receiving the notification on the registered device;
**PWD + SK:**: username/password (knowledge factor) plus hardware security key (possession factor) that contains a private key (and the corresponding certificate) to send a signed OTP challenge to the authentication server. The user should provide a PIN (knowledge factor) or use biometrics (inherence factor) to complete the user authentication;
**QR:**: is an authentication capability that permits a registered device (possession factor) to scan a QR Code. Then, the user should provide a PIN (knowledge factor) or use biometrics (inherence factor) to complete the user authentication.  
Based on our analysis, 20 out of 40 notified eID means under analysis support the LoA Substantial. We report the main results per each eID means in columns 3-10 of Table 2. From the results, we have that:  
* Concerning the OTP implementation approaches, SMS (13 out of 20) is the most adopted approach, and PWD + Matrix, PWD + QR Code, and PWD + HW SK (1 out of 20 eID means) are the least adopted ones within the eID means;
* None of the eID means under analysis support the Email within their OTP implementation approach;
* Only 4 out of 20, and 10 out of 20 eID means under analysis support the push notification and Login with QR Code mechanism, respectively.  
Our latest analysis in September 2022 highlights a new technological trend within the implementation of eID schemes. Some solutions use the hardware security key (possessionfactor) as the second authentication factor to satisfy the requirement of LoA Substantial. As we will discuss later in Section 9, the usage of a hardware security key can increase the level of security and usability of an eID scheme.