# The eIDAS Regulation: A Survey of Technological Trends for European Electronic Identity Schemes
###### Abstract  
The eIDAS regulation aims to provide an interoperable European framework to enable EU citizens to authenticate and communicate with services of other Member States by using their national electronic identity. While a number of high-level requirements (e.g., related to privacy and security) are established to make interoperability among Member States possible, the eIDAS regulation does not explicitly specify the technologies that can be adopted during the development phase to meet the requirements as mentioned earlier. To the best of our knowledge, there is no work available in the literature investigating the technological trends within the notified eIDAS electronic identity schemes used by Member States. To fill this gap, this paper analyzes how the different technological trends of notified schemes satisfy the requirements of the eIDAS regulation. To do this, we define a set of research questions that allow us to investigate the correlations between different design dimensions such as security, privacy, and usability. Based on these findings, we provide a set of lessons learned that would be valuable to the security community, as they can provide useful insights on how to more efficiently protect interoperable national digital identities. Furthermore, we provide a brief overview regarding the new eIDAS regulation (eIDAS 2.0) that aims to provide a more privacy-preserving electronic identity solution by moving from a centralized approach to a decentralized one. OAuth 2.0; SAML; OpenID Connect; digital identity; eIDAS +
Footnote †: journal: Accepted: 8 December 2022  
in Germany. The employee needs to create a bank account in Germany to be able to receive the salary. The employee does not need to travel to Germany to open a bank account, as s/he can utilize the trust services of eIDAS to open it remotely and securely by using their Italian national electronic IDentity (eID scheme). Figure 1 illustrates a general overview of the steps for opening a bank account by utilizing the trust services of eIDAS. In other words, eIDAS provides the foundation for the portability of national digital identities across borders in EU. To make an eID scheme recognizable within other MSs in EU, the European Commission must approve the MS's eID schemes through a notification process. The \"Cooperation Network\" is an entity which is responsible to perform the notification process and the aim of this process is to check whether the eID scheme meets the eIDAS regulation requirements [1]. Once a MS submits an eID scheme for analysis by the Cooperation Network, it becomes \"pre-notified\". After the Cooperation Network examines the eID scheme, it turns into \"peer-reviewed\" and if it passes the analysis successfully and meets the eIDAS regulation requirements, the Cooperation Network announces it as \"notified\". This means that the eID scheme is qualified and other MSs can integrate it within their services to enable cross-country user authentication. Although the eIDAS regulation defines a set of security and privacy requirements (e.g., level of assurance and minimal set of user personal data claims that a service can request to identify the user), it does not explicitly specify the technological aspects that developers can adopt during the development phase to meet the aforementioned requirements. While it is desirable that eIDAS is technology agnostic (to accommodate a wide range of current technology and to remain open to those that will be introduced in the future and avoid vendor lock in and related problems), it may make it difficult to understand how to exploit the currently available or new technologies to comply with the eIDAS regulation requirements. To elaborate on this point, let us consider the eIDAS implementation regulation 1501/2015 [2] that defines requirements regarding the three levels of assurance (namely, Low, Substantial, and High). These requirements identify a set of elements needed to reach the desired level of assurance.