Digital Identity Wallets

Digital identity wallets let people store official credentials, such as their national identity, driving licence, or diplomas, on their own phone, and present them to online and in-person services. Done right, a wallet can give users more control over their data than today’s identity solutions, since they can share only what is needed, for example proving that they are over 18 without revealing their name or date of birth. Done wrong, it can become a tool for tracking people across every service they use. Which of these we end up with depends to a large extent on the cryptography inside the wallet.

This page gives an overview of the European Digital Identity Wallet and the Norwegian work on a digital wallet, explains the privacy challenges in the cryptographic design of the wallet and how they can be addressed, and collects the standards, research, and projects that I find most relevant, including my own work.

Last updated: September 2026.

The European Digital Identity Wallet

The revised eIDAS regulation, Regulation (EU) 2024/1183, requires every EU member state to offer its citizens at least one European Digital Identity (EUDI) Wallet by the end of 2026. The wallet must be free for citizens, voluntary to use, and support selective disclosure of attributes, and the regulation requires that relying parties cannot link or track users beyond what is necessary for each transaction.

The technical baseline is the Architecture and Reference Framework (ARF), maintained by the European Commission together with the member states. It specifies the roles in the ecosystem (wallet providers, issuers of person identification data and attestations, relying parties, and trust lists), the credential formats (ISO mdoc and SD-JWT VC), and the protocols for issuing and presenting credentials (OpenID for Verifiable Credential Issuance and OpenID for Verifiable Presentations). The Commission’s reference implementation of the wallet, issuers, and verifiers is open source, and the ARF is developed in the open on GitHub, where anyone can comment on it.

Norway

Norway is part of eIDAS 2.0 through the EEA Agreement, so the regulation will also apply here. The Norwegian Digitalisation Agency (Digdir) coordinates the work on a Norwegian digital wallet together with public and private actors, including a national sandbox for testing wallets and services, pilots, and hackathons with municipalities and vendors.

The privacy challenge

Today’s design. Selective disclosure in the ARF is achieved with one-time credentials: the issuer signs a list of salted hashes of the user’s attributes with ECDSA, and the user reveals only the attributes (and salts) needed. Since the signature and the hashes are the same every time a credential is shown, relying parties that collude, or collude with the issuer, can link the presentations of a user across services. The wallet must therefore be issued a batch of single-use credentials and never reuse them, which is a burden for issuers and wallets and still does not protect against a colluding issuer. As a result, the current design does not satisfy the unlinkability requirement of eIDAS 2.0.

Already in June 2024, a group of cryptographers gave feedback on the ARF, arguing that the design relies on cryptographic methods that were never intended to meet the privacy requirements of the regulation, and recommending anonymous credentials, crypto-agility, and privacy-preserving revocation. The discussion, including the Commission’s response and alternative proposals, is a good introduction to the trade-offs involved.

Anonymous credentials. For proper privacy, we would like to see anonymous credentials implemented in the wallet, where users prove statements about their credentials in zero-knowledge, so that every presentation is unlinkable, even to the issuer. There are two main candidates:

BBS signatures allow efficient proofs of knowledge of a signature on a set of attributes, with short presentations of around a kilobyte that take milliseconds to compute. The scheme originates in the group signatures of Boneh, Boyen, and Shacham (CRYPTO 2004) and was turned into a credential scheme by Au, Susilo, and Mu (SCN 2006). Its security was recently revisited by Tessaro and Zhu (Eurocrypt 2023), and it is being standardized in the IRTF as The BBS Signature Scheme. The drawback is that BBS requires pairing-friendly curves, which are not supported by the secure hardware in today’s phones. The variant BBS# by Desmoulins, Dumanois, Kane, and Traoré (Orange) avoids pairings altogether: it works over standard elliptic curves and replaces the pairing-based verification with simple zero-knowledge proofs, so that it can be combined with the ECDSA keys already supported by phone hardware.
Zero-knowledge proofs for existing credentials keep today’s issuers and formats, and instead prove in zero-knowledge that the user holds a valid ECDSA-signed credential. Google’s Longfellow ZK does this for mdoc credentials, with an open-source implementation and an IETF draft. The proofs are larger and slower than BBS, but work with the hardware and credentials that already exist.

Deployment challenges. The main obstacles are that the wallet keys must be bound to secure hardware in phones, which today only supports ECDSA on the P-256 curve, and that new schemes must be standardized and certified. A modular design, where the issuer signature, device binding, pseudonyms, and range proofs can use different schemes that fit their constraints, is one way forward. At the same time, zero-knowledge proofs alone are not enough: metadata, the choice of issuer, revocation checks, and the policy around the system can still leak information and exclude people, and these issues must be dealt with as well.

Post-quantum security. A long-lived identity infrastructure should also be post-quantum secure. Neither ECDSA nor BBS is secure against quantum computers, and the EU expects a transition to post-quantum cryptography by 2030–2035, so the wallet must be designed with crypto-agility and a migration path in mind. Privacy should hold even against future quantum adversaries, since presentations collected today could otherwise be linked later. Longfellow is based on hash functions, and its authors have shown a proof of possession of an ML-DSA-44 signature, which points to a path to post-quantum credentials built on the NIST standard ML-DSA. Lattice-based zero-knowledge proofs and anonymous credentials are another promising direction.

The discussion above builds on the keynotes at the PrivCrypt 2026 workshop, whose slides give more details: Anja Lehmann’s EUDI Wallet & Anonymous Credentials: Status and Open Challenges, Stefano Tessaro’s A Tale of BBS Credentials, Gregor Seiler’s Post-Quantum Zero-Knowledge Proofs and Applications, and Sofia Celi’s When ZKPs aren’t enough and what it means for age verification policy.

Standards

New cryptography can only be deployed in the wallet once it is standardized, so the standardization bodies are where much of the work happens:

Credential formats: ISO/IEC 18013-5 specifies the mobile driving licence and the mdoc format, and the IETF specifies SD-JWT (RFC 9901) and SD-JWT VC. The W3C Verifiable Credentials Data Model 2.0 is an alternative format used outside the EUDI Wallet.
Protocols: The OpenID Foundation specifies OpenID for Verifiable Credential Issuance and OpenID for Verifiable Presentations, which are used to issue and present credentials.
Privacy-preserving cryptography: The IRTF Crypto Forum Research Group is standardizing BBS signatures, and Google has proposed Longfellow as libZK.
Trust services: ETSI’s committee on Electronic Signatures and Trust Infrastructures develops the standards for the trust infrastructure around the wallet under eIDAS 2.0.

Research

Anja Lehmann at the Hasso Plattner Institute leads the work on advanced cryptography in the German EUDI Wallet project, with the goal of enabling anonymous credentials in the wallet. Her group’s EUDI page and the paper SoK: Anonymous Credentials for Digital Identity Wallets by Christian Bormann and Anja Lehmann are excellent starting points.
The Dagstuhl Seminar Privacy-Preserving Authentication (April 2026), organized by Foteini Baldimtsi, Lucjan Hanzlik, Anna Lysyanskaya, and Stefano Tessaro, brought together researchers and practitioners working on anonymous credentials, blind signatures, revocation, and post-quantum security. I participated in the seminar.
The International Workshop on Foundations and Applications of Privacy-Enhancing Cryptography (PrivCrypt), which I co-organized with Lucjan Hanzlik and Daniel Slamanig as an affiliated event of IACR Eurocrypt 2026, is a venue for work on anonymous credentials and other privacy-enhancing cryptography.

My work

My research is on advanced digital signatures from lattices, including blind signatures and threshold signatures, with digital identity wallets as an important application: blind signatures are a building block for anonymous credentials, and threshold signatures can protect the keys of issuers and wallets by distributing them across several parties. See my research page for relevant papers, such as our work on blind signatures from Raccoon and on threshold lattice signatures. I currently supervise four master’s theses on these topics, three of which aim to test their prototypes in Digdir’s national sandbox:

Jakob Severin Gundersen, Cryptology and Social Life: Privacy in Digital Identity Wallets, studies how privacy is built into the EUDI Wallet technically, through selective disclosure and unlinkability, and compares this with the privacy that users perceive and expect, through interviews with users and stakeholders and a review of the standards. The thesis is part of the Cryptology and Social Life project.
Aleksander Thornes Vestlund, Post-Quantum Privacy-Preserving Credentials in the European Digital Identity Wallet: Schemes for Selective Disclosure, compares ways to build post-quantum and privacy-preserving credentials without large and complex zero-knowledge proofs, and tests them against the requirements for the wallet.
Jo Vassbotn Remvik, Practical Lattice-Based Zero-Knowledge Proof Systems, implements concrete lattice-based zero-knowledge proofs for credentials with the LaZer library, and measures their size, speed, and trade-offs, with the goal of a prototype for lattice-based credentials.
Sindre Holbek Sørbye, Practical Zero-Knowledge Proof Systems from Hash-Based Assumptions and Applications, studies zero-knowledge proofs that only rely on hash functions, the most conservative building blocks in cryptography. He implements and benchmarks systems such as Aurora, WHIR, and Flock, explores their use for anonymous authentication and credentials as in Longfellow, and evaluates other post-quantum signature schemes for digital wallets, with the goal of a prototype for hash-based credentials.

Digital identity wallets are not only a technical problem: whether they protect privacy and are trusted and used depends just as much on how they are regulated, governed, and designed for real people. In the Cryptology and Social Life project at NTNU, I work with Katrien De Moor (Department of Information Security and Communication Technology), Kristian Gjøsteen (Department of Mathematical Sciences), Eric Monteiro (Department of Computer Science), and Petter Grytten Almklov and Emil André Røyrvik (Department of Sociology and Political Science) to study cryptographic systems as sociotechnical systems. In 2026, the project was awarded four PhD positions, one in each participating department, to study secure, privacy-preserving, and democratically aligned digital identity wallets for Norway, with a focus on the EUDI Wallet. The project will address both the technical challenges, such as privacy-preserving and post-quantum credentials, and the social challenges, such as trust, governance, and inclusion.

Tjerand Silde