Skip to content

Commit 999caf0

Browse files
Release/1.6.1 (#991) (#428)
* typos and editorial changes * added Technical specification drafts
1 parent 6ddf9f7 commit 999caf0

23 files changed

+1336
-296
lines changed

.vscode/settings.json

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,10 @@
33
"AHWG",
44
"biometrically",
55
"Birkholz",
6+
"bitstring",
7+
"bitstrings",
68
"Bradner",
9+
"bstr",
710
"Caceres",
811
"Cappalli",
912
"CBOR",
@@ -13,34 +16,54 @@
1316
"COMMISSION",
1417
"CTAP",
1518
"deepfake",
19+
"disclosable",
1620
"DPIA",
1721
"ECCG",
1822
"EDICG",
1923
"EHIC",
24+
"eisvogel",
2025
"ENISA",
26+
"EPUB",
2127
"EUCC",
2228
"EUCS",
2329
"EUDI",
2430
"FITCEM",
2531
"GSMA",
2632
"HAIP",
2733
"IDAS",
34+
"ISSU",
2835
"Klyne",
2936
"Kooper",
3037
"Lodderstedt",
38+
"mkdocs",
39+
"OJEU",
3140
"OMAPI",
41+
"OOTS",
42+
"Pandoc",
43+
"pdflatex",
44+
"Prox",
3245
"QEAA",
3346
"QESRC",
3447
"QSCD",
3548
"QTSP",
49+
"QTSPAS",
50+
"Requestee",
51+
"Requestor",
52+
"RPACA",
53+
"RPRC",
3654
"Rulebook",
55+
"SCAL",
3756
"Sporny",
57+
"tdate",
3858
"Terbu",
59+
"tstr",
3960
"UICC",
4061
"UICCs",
4162
"unlinkability",
4263
"VCDM",
64+
"WIAM",
4365
"WSCA",
44-
"WSCD"
66+
"WSCD",
67+
"xelatex"
4568
]
4669
}

CHANGELOG

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@ All notable changes to this project will be documented in this file.
55
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
66
and this project adheres to [Semantic Versioning](https://semverdoc.org/).
77

8+
## [1.6.1] - 2025-03-10
9+
10+
Editorial changes and fixing typos.
11+
812
## [1.6.0] - 2025-03-03
913

1014
Added results of "Topic A - Privacy risks and mitigation"

LICENCE

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
The European Digital Identity Wallet Architecture and Reference
2-
Framework © 2023 by European Commission is licensed under Attribution
3-
4.0 International. To view a copy of this licence, visit
4-
http://creativecommons.org/licenses/by/4.0/
1+
# Licence
2+
3+
The European Digital Identity Wallet Architecture and Reference Framework © 2023
4+
by European Commission is licensed under Attribution 4.0 International. To view
5+
a copy of this licence, visit <http://creativecommons.org/licenses/by/4.0/>

Makefile

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ SOURCE_DOCS := $(MAIN_DOC) $(ANNEXES_DOCS)
2626
# Directories and Build Information
2727
BUILD_DIR := ./build
2828
SITE_DIR := ./site
29-
VERSION := 1.6.0
29+
VERSION := 1.6.1
3030
BUILD := $(shell date +%Y%m%d.%H%M%S)
3131

3232
# Pandoc configuration
@@ -57,7 +57,6 @@ PANDOC_EPUB_OPTIONS := --to epub3
5757
%.pdf : %.md
5858
@mkdir -p $(BUILD_DIR)/pdf
5959
$(PANDOC) $(PANDOC_OPTIONS) $(PANDOC_PDF_OPTIONS) -o $(BUILD_DIR)/pdf/$(notdir $@) $<
60-
6160
# Convert Markdown to DOCX
6261
%.docx : %.md
6362
@mkdir -p $(BUILD_DIR)/docx
@@ -67,14 +66,13 @@ PANDOC_EPUB_OPTIONS := --to epub3
6766
%.epub : %.md
6867
@mkdir -p $(BUILD_DIR)/epub
6968
$(PANDOC) $(PANDOC_OPTIONS) $(PANDOC_EPUB_OPTIONS) -o $(BUILD_DIR)/epub/$(notdir $@) $<
70-
7169
# Targets
7270
# -----------------------------------------------------------------------------
7371

7472
.PHONY: all mkdocs serve copy-pdfs zip-pdfs clean
7573

7674
# Default target: build all exported documents and the MkDocs site.
77-
all: $(EXPORTED_DOCS) zip-pdfs
75+
all: $(EXPORTED_DOCS) zip-pdfs mkdocs
7876

7977
# Build the MkDocs site
8078
mkdocs:

README.md

Lines changed: 73 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,15 @@
11
# The European Digital Identity Wallet
22

3-
43
![Digital Identity for all Europeans - A personal digital wallet for EU citizens and residents](./docs/media/top-banner-arf.png)
54

6-
7-
## The Digital Identity Regulation
8-
95
Under the [Electronic Identification, Authentication and Trust Services (eIDAS)
106
Regulation](https://digital-strategy.ec.europa.eu/en/policies/eidas-regulation),
117
EU Member States may, on a voluntary basis, notify and recognise, national
128
electronic identification schemes in their Member States. The recognition of
139
notified electronic identification became mandatory in 2018. Yet, there is no
1410
requirement for Member States to develop a national electronic identification
1511
and to make it interoperable with those in other Member States. This has led to
16-
discrepancies between countries. The new Regulation on digital identity
12+
discrepancies between countries. The new [European Digital Identity Regulation](https://eur-lex.europa.eu/eli/reg/2014/910/2024-10-18)
1713
addresses shortcomings in eIDAS by improving the effectiveness of the framework
1814
and extending its benefits to the private sector. Member States will offer
1915
citizens and businesses digital wallets that will be able to link various
@@ -39,26 +35,75 @@ control of the data they share.
3935

4036
## The Architecture and Reference Framework
4137

42-
On 3 June 2021, the European Commission adopted a Recommendation calling on
43-
Member States to work towards the development of a Toolbox including a
44-
technical Architecture and Reference Framework a set of common standards and
45-
technical specifications and a set of common guidelines and best practices.
38+
On 3 June 2021, the European Commission adopted a Recommendation ([COMMISSION
39+
RECOMMENDATION (EU) 2021/946 of 3 June 2021 on a
40+
[Common Union Toolbox](https://digital-strategy.ec.europa.eu/en/policies/eudi-wallet-toolbox)
41+
for a coordinated approach towards a [European Digital Identity Framework](https://eur-lex.europa.eu/eli/reco/2021/946),
42+
[OJ L 210/51, 14.6.2021](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ%3AL%3A2021%3A210%3AFULL))
43+
calling on Member States to work closely together with the Commission towards
44+
the development of a Toolbox including a technical Architecture and Reference
45+
Framework (hereinafter the ARF), a set of common standards and technical
46+
specifications and a set of common guidelines and best practices.
4647

4748
The Recommendation specifies that these outcomes will serve as a basis for the
48-
implementation of the European Digital Identity Framework, without the process
49-
of developing the Toolbox interfering with, or prejudging the legislative
50-
process.
51-
52-
The Recommendation foresees that the Toolbox is developed by Member States’
53-
experts in the eIDAS Expert Group in close coordination with the Commission
54-
and, where relevant for the functioning of the European Digital Identity (EUDI)
55-
Wallet infrastructure, other concerned public and private sector parties.
56-
57-
This repository contains the "[Architecture and Reference Framework](docs/architecture-and-reference-framework-main.md)"
58-
(hereinafter the [ARF](docs/architecture-and-reference-framework-main.md)).
59-
60-
The current **authoritative version** is tagged as [realease/tag in this
61-
repository](https://github.com/eu-digital-identity-wallet/architecture-and-reference-framework/releases).
49+
implementation of the [European Digital Identity Regulation](https://eur-lex.europa.eu/eli/reg/2014/910/2024-10-18),
50+
without the process of developing the Toolbox interfering with, or prejudging
51+
the legislative process.
52+
53+
The Recommendation establishes a structured framework for cooperation between
54+
Member States, the Commission, and, where relevant, private sector operators to
55+
develop the Toolbox. The European Digital Identity Cooperation Group (EDICG),
56+
formerly known as the eIDAS Expert Group, is responsible for:
57+
58+
* exchange best practices and cooperate with the Commission on emerging
59+
policy initiatives in the field of digital identity wallets, electronic
60+
identification means and trust services;
61+
* advising the Commission in the preparation of draft implementing and delegated
62+
acts;
63+
* supporting Supervisory Bodies in the implementation of the [European Digital
64+
Identity Regulation];
65+
* organising peer reviews of electronic identification schemes;
66+
* engaging with the Commission and other relevant stakeholders to develop a
67+
[Common Union Toolbox](https://digital-strategy.ec.europa.eu/en/policies/eudi-wallet-toolbox);
68+
69+
The European Digital Identity Cooperation Group's page can be found
70+
[at the official page](https://digital-strategy.ec.europa.eu/en/policies/european-digital-identity-cooperation-group).
71+
72+
The European Digital Identity Cooperation Group has since further developed the
73+
concepts and specifications for the European Digital Identity Framework. The
74+
current ARF version is based on the [legal text adopted](https://eur-lex.europa.eu/eli/reg/2014/910/2024-10-18)
75+
by the co-legislators, including the adopted Commission Implementing Regulations:
76+
77+
* [CIR 2024/2977](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2977)
78+
regarding PID and EAA,
79+
* [CIR 2024/2979](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202402979)
80+
regarding integrity and core functionalities,
81+
* [CIR 2024/2980](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202402980)
82+
regarding ecosystem notifications,
83+
* [CIR 2024/2981](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202402981)
84+
regarding certification of Wallet Solutions,
85+
* [CIR 2024/2982](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202402982)
86+
regarding protocols and interfaces.
87+
88+
## Contents of the repository
89+
90+
This repository contains:
91+
92+
* "[Architecture and Reference Framework](docs/architecture-and-reference-framework-main.md)"
93+
the main narrative text that describes the European Digital Identity Wallet and
94+
its ecosystem.
95+
* "[Annexes](docs/annexes/README.md)" the list of annexes that provide additional
96+
information to the main narrative text. In particular, the annexes provide normative
97+
high-level requirements.
98+
* "[Technical Specifications](docs/technical-specifications/README.md)" the list
99+
of specifications that will be developed to support the implementation of the
100+
European Digital Identity Wallet.
101+
* "[Discussion Topics](docs/discussion-topics/README.md)" the list of discussion
102+
topics that are open for public consultation. The topics are organized into
103+
three iterations, each focusing on a specific set of subjects to be included in
104+
a major document release.
105+
106+
The latest **authoritative version** is tagged as [release/tag in this repository](https://github.com/eu-digital-identity-wallet/architecture-and-reference-framework/releases).
62107

63108
## Contributing
64109

@@ -72,16 +117,16 @@ see the [tags on this repository](https://github.com/eu-digital-identity-wallet/
72117

73118
## Authors
74119

75-
See the list of [contributors](https://github.com/eu-digital-identity-wallet/architecture-and-reference-framework/graphs/contributors) who participated in this project.
120+
See the list of [contributors](https://github.com/eu-digital-identity-wallet/architecture-and-reference-framework/graphs/contributors)
121+
who participated in this project.
76122

77123
## License
78124

79-
This project is licensed under the [Attribution 4.0
80-
International](http://creativecommons.org/licenses/by/4.0/) - see the
81-
[LICENSE.txt](LICENSE) file for details.
125+
This project is licensed under the [Attribution 4.0 International](http://creativecommons.org/licenses/by/4.0/)
126+
see the [LICENSE.txt](LICENSE) file for details.
82127

83128
## [European Commission website](https://commission.europa.eu/index_en)
84129

85130
* [Contact the European Commission](https://commission.europa.eu/about-european-commission/contact_en)
86131
* [Follow the European Commission on social media](https://european-union.europa.eu/contact-eu/social-media-channels_en#/search?page=0&institutions=european_commission)
87-
* [Resources for partners](https://commission.europa.eu/resources-partners_en)
132+
* [Resources for partners](https://commission.europa.eu/resources-partners_en)

SECURITY.md

Lines changed: 45 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,15 @@
11
# EU Digital Identity Wallet Vulnerability Disclosure Policy (VDP)
22

3-
At the European Commission, we treat the security of our Communication and Information Systems as a top priority, in line with Commission Decision EC 2017/46. However, vulnerabilities can never be completely eliminated, despite all efforts. If exploited, such vulnerabilities can harm the confidentiality, integrity or availability of the Commission's systems and of the information processed therein. To identify and remediate vulnerabilities as soon as possible, we value the input of external entities acting in good faith, and we encourage responsible vulnerability research and disclosure. This document sets out our definition of good faith in the context of finding and reporting vulnerabilities, as well as what you can expect from us in return.
3+
At the European Commission, we treat the security of our Communication and
4+
Information Systems as a top priority, in line with Commission Decision EC
5+
2017/46. However, vulnerabilities can never be completely eliminated, despite
6+
all efforts. If exploited, such vulnerabilities can harm the confidentiality,
7+
integrity or availability of the Commission's systems and of the information
8+
processed therein. To identify and remediate vulnerabilities as soon as
9+
possible, we value the input of external entities acting in good faith, and we
10+
encourage responsible vulnerability research and disclosure. This document sets
11+
out our definition of good faith in the context of finding and reporting
12+
vulnerabilities, as well as what you can expect from us in return.
413

514
## Scope
615

@@ -9,34 +18,50 @@ At the European Commission, we treat the security of our Communication and Infor
918

1019
## If you have identified a vulnerability, please do the following
1120

12-
- E-mail your findings to <[email protected]>, specifying whether or not you agree to your name or pseudonym being made publicly available as the discoverer of the problem.
13-
- Encrypt your findings using our [PGP key](https://ec.europa.eu/assets/digit/pgpkey/ec-vulnerability-disclosure-pgp.txt) to prevent this critical information from falling into the wrong hands.
14-
- Provide us with sufficient information to reproduce the problem so that we can resolve it as quickly as possible. Usually, the IP address or the URL of the affected system and a description of the vulnerability will be sufficient, but complex vulnerabilities may require further explanation in terms of technical information or potential proof-of-concept code.
15-
- Provide your report in English, preferably, or in any other official language of the European Union.
16-
- Inform us if you agree to make your name/pseudonym publicly available as the discoverer of the vulnerability.
21+
- E-mail your findings to <[email protected]>, specifying
22+
whether or not you agree to your name or pseudonym being made publicly available
23+
as the discoverer of the problem.
24+
- Encrypt your findings using our [PGP key](https://ec.europa.eu/assets/digit/pgpkey/ec-vulnerability-disclosure-pgp.txt)
25+
to prevent this critical information from falling into the wrong hands.
26+
- Provide us with sufficient information to reproduce the problem so that we can
27+
resolve it as quickly as possible. Usually, the IP address or the URL of the
28+
affected system and a description of the vulnerability will be sufficient, but
29+
complex vulnerabilities may require further explanation in terms of technical
30+
information or potential proof-of-concept code.
31+
- Provide your report in English, preferably, or in any other official language
32+
of the European Union.
33+
- Inform us if you agree to make your name/pseudonym publicly available as the
34+
discoverer of the vulnerability.
1735

1836
## Please do not do the following
1937

20-
- Do not take advantage of the vulnerability or problem you have discovered, for example, by downloading more data than necessary to demonstrate the vulnerability, deleting, or modifying other people’s data.
38+
- Do not take advantage of the vulnerability or problem you have discovered, for
39+
example, by downloading more data than necessary to demonstrate the
40+
vulnerability, deleting, or modifying other people’s data.
2141
- Do not reveal any data downloaded during the discovery to any other parties.
2242
- Do not reveal the problem to others until it has been resolved.
2343
- Do not perform the following actions:
24-
- Placing malware (virus, worm, Trojan horse, etc.) within the system.
25-
- Reading, copying, modifying or deleting data from the system.
26-
- Making changes to the system.
27-
- Repeatedly accessing the system or sharing access with others.
28-
- Using any access obtained to attempt to access other systems.
29-
- Changing access rights for any other users.
30-
- Using automated scanning tools.
31-
- Using the so-called "brute force" of access to the system.
32-
- Using denial-of-service or social engineering (phishing, vishing, spam, etc.).
44+
- Placing malware (virus, worm, Trojan horse, etc.) within the system.
45+
- Reading, copying, modifying or deleting data from the system.
46+
- Making changes to the system.
47+
- Repeatedly accessing the system or sharing access with others.
48+
- Using any access obtained to attempt to access other systems.
49+
- Changing access rights for any other users.
50+
- Using automated scanning tools.
51+
- Using the so-called "brute force" of access to the system.
52+
- Using denial-of-service or social engineering (phishing, vishing, spam, etc.).
3353
- Do not use attacks on physical security.
3454

3555
## What we promise
3656

37-
- We will respond to your report within three business days with our evaluation of the report.
38-
57+
- We will respond to your report within three business days with our evaluation
58+
of the report.
3959
- We will handle your report with strict confidentiality.
4060
- Where possible, we will inform you when the vulnerability has been remedied.
41-
- We will process the personal data that you provide (such as your e-mail address and name) in accordance with the applicable data protection legislation and will not pass on your personal details to third parties without your permission.
42-
- In the public information concerning the problem reported, we will publish your name as the discoverer of the problem if you have agreed to this in your initial e-mail
61+
- We will process the personal data that you provide (such as your e-mail
62+
address and name) in accordance with the applicable data protection legislation
63+
and will not pass on your personal details to third parties without your
64+
permission.
65+
- In the public information concerning the problem reported, we will publish
66+
your name as the discoverer of the problem if you have agreed to this in your
67+
initial e-mail

0 commit comments

Comments
 (0)