# FIDO2 Facing Kleptographic Threats By-Design
### Legal and Technical Background  
#### 1.1.1 Legal Requirements  
The broad application of an authentication system implies security issues. Enforcing a proper security level by setting minimal requirements for IT systems is the current strategy of the European Union. The rules are tightened over time, and due to cyberspace globality, have a high impact on other countries.  
As authentication concerns an _identifiable_ individual, authentication systems fall into the scope of GDPR [3]. One of the basic principles of GDPR is _data minimization_: only those data should be processed that are necessary for a given purpose. This principle creates a challenge for authentication schemes: The real user identity should be used only if necessary; otherwise, it should be replaced by a pseudonym. Even if the real identity is to be linked with a user account, the link should be concealed in standard processing due to the need to minimize the data leakage risk and implement the _privacy-by-design_ principle: if no real identity is used, then it cannot be leaked. Today, many systems still do not follow this strategy, but FIDO2 authentication discussed in this paper is an example of automatic pseudonymization.  
Another European regulation significantly impacting authentication systems is eDAS 2.0. Its main concept is the European Digital Identity Wallet (EDIW), allowing individuals to authenticate themselves with an attribute and not necessarily with an explicit identity. The technical realization of this concept is an open question, given the member states' freedom to implement the EDIW and vague general rules. The mandate of European authorities to determine wallet standards does not preclude the diversity of low-level details.  
eIDAS 2 may influence many security services in an indirect and somewhat unexpected way. It defines _trust services_ and strict obligations for entities providing such services. Note that \"the creation of electronic signatures or electronic seals\" falls into the category of _trust services_ (Article 3, point 16c). Therefore, any service where electronic signatures are created on behalf of the user falls into this category. This rule may be interpreted widely, with electronic signatures created by devices provided by the service supplier. Signatures need not serve the classical purpose of signing digital documents; they may relate to any data, particularly to ephemeral challenges during challenge-response authentication processes. From the civil law point of view, such a signature is a _declaration of will_ to log into the system.  
Another stepping stone towards security in European cyberspace is the Cybersecurity Act (CSA) [4]. It establishes a European certification framework based on the Common Criteria for, among others, _ICT products_. An ICT product is understood here as _an element or a group of elements of a network or information system_. Any online authentication system falls clearly into this category. Although CSA introduces a framework of voluntary certification under the auspices of ENISA, we expect that once the framework reaches its maturity, there will be a trend to request authentication with certified IT products. So, it will be necessary to formulate relevant CC Protection Profiles. This stage is critical since omitting some aspects may result in dangerous products with certificates giving a false sense of security.