# The eIDAS Regulation: A Survey of Technological Trends for European Electronic Identity Schemes
## 3 RQ1: Authentication Mechanisms Based on LoA
### Authentication Mechanisms: LoA High  
The authentication mechanisms at this level provide high confidence that the subject controls an authenticator registered to the service, by requiring the proof of possession of a cryptographic authenticator. A cryptographic authenticator leverages a Public Key Infrastructure (PKI), by storing the user's private key (and the corresponding certificate). The authentication mechanisms are thus based on a challenge-response protocol. According to our analysis, the cryptographic authenticators used in the notified eID means are as follows:  
1. **Hardware Authenticator (HW Auth):** indicates the support of login by using hardware authenticators (e.g., smart cards) by the eID means under analysis. Note that the hardware authenticator in LoA H refers to a hardware device that can securely store a client certificate. In contrast, the PWD + HW in LoA S refers to a hardware device capable of generating an OTP. We detected the following HW Auths: * **Smart card** indicates the support of login by using a physical smart card (SC). In our analysis, we distinguish two types of SC, namely: dedicated SC (D-SC) and identity cards (ID-SC); * **SIM (Crypt SIM)** indicates the use of SIM as a secure element to store secrets and electronic certificates, which are used during the authentication process. The Crypt SIM embeds additional applets (w.r.t. the ones used by network operators) to provide the functionalities for storing authentication and signature certificates; * **Security Key (SK)** indicates the support of login by using a hardware security key (e.g., FIDO security key). The difference between SK in this category and the PWD + HW SK as defined in LoA S lies in the hardware requirements that the SK satisfies. To elaborate, let us consider the certification requirements defined for FIDO SKs in [48]. To be suitable for LoA H, the SK must have a restricted operating environment (e.g., Secure element), while this condition is not necessary for SKs that are recognized for LoA S; 2. **Software Authenticator (SW Auth)**: indicates the login support by using software authenticators storing the electronic certificate associated with the user's digital identity. To elaborate, let us consider the SPID Poste Italiane eID means. In this scenario, a key pair is generated in the citizens' device (PosteID app) that is protected by a user-selected 8-digit PIN during the setup phase.  
Our analysis shows that 25 out of 40 notified eID means, and the Baltic eID scheme under analysis support the LoA High. We report our findings per each eID means within columns 11-15 of Table 2. From the results, we have that:  
* 18 eID means under analysis adopt login with a smart card (identity or dedicated) within their solutions;
* 6 eID means under analysis adopt the login with a software authenticator within their solutions;
* 2 eID means under analysis adopt the login with SK within their solutions.  
We provide an overview of the authentication mechanisms adopted by MSs for each LoAs in Figure 4.  
Our updated analysis in September 2022 highlights a new technological trend toward using the security keys (e.g., FIDO keys) to satisfy the requirement of LoA H. As we will discuss later in Section 9, using security keys can increase the level of security and usability of the eID scheme.