# The eIDAS Regulation: A Survey of Technological Trends for European Electronic Identity Schemes
###### Abstract
For example, for a Low level of assurance, the document states: \"The authentication mechanism implements security controls for the verification of the electronic identification means, so that it is highly unlikely that activities such as guessing, eavesdropping, replay or manipulation of communication by an attacker with enhanced-basic  
Figure 1: eIDAS in action: opening a bank account. attack potential can subvert the authentication mechanisms\" [2]. GDPR (The complete list of identified elements for each level of assurance) is available in Appendix A. It is crucial to realize that such requirements can be satisfied using several different technologies, and a wrong design choice may result in a less secure, non privacy-preserving, and difficult to use solution within the MS's eID ecosystem. It is thus crucial to know how the technological choices within the eID scheme implementation can affect security, privacy, and usability. However, to the best of our knowledge, no available work in the literature investigates the aforementioned dimensions within the eIDAS-compliant eID schemes. This motivates our work to understand how to satisfy the requirements of eIDAS regulation by deploying MS eID schemes based on their own national digital identity infrastructures. More precisely, this work explores the technological choices underlying notified eIDAS-compliant eID schemes, identifies the trends of deploying such schemes that each MS adopts, and discusses how they satisfy the eIDAS regulation requirements. We do this by defining the following research questions along the security, privacy, and usability goals:  
* Security and Privacy:
* Which are the standard authentication protocols adopted by the eID schemes? * Which are the crucial implementation choices taken to deploy the identified standard authentication protocols in the previous question by the eID schemes? * Security and Usability:
* Which are the adopted authentication methods for three levels of assurance? The rapid development of mobile technologies has turned these devices from entertainment gadgets to popular and ever-present media. Nowadays, users can manage their banking accounts, control their personal health records, or access public administration services by installing a mobile application. Therefore, it is important to investigate their potential roles in the deployment of MS eID schemes. A key standard for mobile-based eID schemes is OpenID Connect that is an authentication standard [3] used to exchange authentication assertions of users. Furthermore, OpenID Connect is one of the most widely used protocols to support innovative authentication solutions due to the benefits that it provides (e.g., lightweight messages) in comparison with the other available standard authentication protocols. Based on these two observations, we further refine the above-mentioned research questions to investigate mobile- and OpenID Connect-based eID schemes. The refined research questions are detailed in Section 2.2. The results that we obtain through the investigation of these questions allow us to understand the correlations between security, privacy, and usability, and to provide a set of lessons learned that would be valuable to the security community as they can provide useful insights on how to more efficiently protect interoperable national digital identities. To summarize, this paper extends our work in [4] with the following main contributions:  
1. We extend our analysis regarding different authentication mechanisms chosen by MSs, adopted authentication standards and mobile-based authentication solutions by adding the recently notified eID schemes. More specifically, we add the eID schemes of the Czech Republic (MojeID, MEG), Austria (Austria ID), Sweden (BankID, Freja eID, EFOS), and Malta (Identity Malta);
2. We discuss two new research questions to identify the trends for the eID schemes that provide solutions based on the OpenID Connect. In particular, we investigate the adopted OpenID Connect profiles and implementation choices for these solutions;
3.