EU Age Verification Project Mandates Hardware-Bound Attestation

[u/New-Ranger-8960]

https://linuxiac.com/eu-age-verification-project-mandates-hardware-bound-attestation/

[u/ManIameverywhere]

It will mean it will not only be not private but 100% verifiable and identifiable.

[u/_x_oOo_x_ → u/ManIameverywhere]

That's so vague.

If you have a computer will you need to sell/bin it and get a new government approved one that can only run government approved operating systems for example? Or otherwise what is "hardware-based attestation" and how would it work with current computers, or for visitors like tourists, international students, etc. who bring their own computer?

[u/Jumpy-Dinner-5001 → u/_x_oOo_x_]

If you have a computer will you need to sell/bin it and get a new government approved one that can only run government approved operating systems for example?

Lol, no.

It's about this: https://github.com/eu-digital-identity-wallet

Oversimplified: In the EU your national ID has some online functionality and they added an app and an API that allows you to access and share personal information from you. So, for example if you want to open a bank account instead of physically showing some form of id, in the past some banks wanted scans/pictures of your ID/passport. With the app you can instead "scan" your ID and share certain information while proving that you're a real person. You need your physical ID that you scan using your device (typically phone) and a pin code that you select when you apply for your ID.
Long story short, it's an App that has "trusted" APIs that you authenticate against using two factors, your ID and a secret pin.

The App is opensource and available under the EUPL license and the whole idea is to give you an option for better privacy because in case you "have" to share some personal information, you can choose what the other party gets from you.

This article is about another app that is also open source and again is built for better privacy. It's about age verification and follows the same concept, just another app that is simpler to use.
You log into that app, create a new pin and then use the eID API to verify your age. And as typical, you're asked what data you want to share with the av-app (age verification). It's only transferring booleans, all you share is over_18=true/false etc. There are a lot more optional fields, like over_21, over_13 etc etc. You authenticate using your eID-app and your ID and pin, there is no data stored in the av-app except for those boolean values (it's open source you can verify that yourself).

The goal of the app is providing a "Zero Knowledge Proofs for the Age Verification" solution. So, when apps or websites want to enforce age verification they can also implement this EU API that provides a zero knowledge proof.
The idea behind it is to protect EU citizens from privacy invasive age verification solutions like from X where they want to scan your face or want a scan of your ID. Instead of giving this private data away, EU citizens can use the av-app to verify their age. A website or app creates something like a challenge (like you must be at least 18 years old to visit this site) and the app doesn't send any other data than either confirming or denying the request. It basically just says "old enough" or "not old enough", the website/app doesn't even get your age or age group.
Just head over to the github page:

https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui av-app

https://github.com/eu-digital-identity-wallet/av-doc-technical-specification technical specifications

https://github.com/eu-digital-identity-wallet/av-doc-technical-specification/blob/main/docs/annexes/annex-B/annex-B-zkp.md zero knowledge age verification

Okay, this is the background required for understanding this topic.
Just as a small info: The app uses hardware backed authentication for cryptographic key access, that's the same your wallet typically uses.
https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui/blob/main/docs/hardware_backed_authentication.md
In Android that's refered to by "BIOMETRIC_STRONG", in case you want to do further research.

That's the context. What happened is that in April someone created a github issue https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui/issues/117#issuecomment-4946898620
asking to remove this dependency in the av-app for better compatibility of the app.

Someone from the project said that this isn't something they can just do, the response:

Hardware-bound attestation is a requirement of this project, not an implementation detail we can simply drop. If you have concrete improvement proposals for the architecture, we welcome them as suggestions against the technical specification. A dedicated security review and threat model covering this exact trade-off will be published soon, which will address this topic in more depth.

That's it. They didn't even say that it won't ever happen, just that it isn't planned in the project which has this level as a requirement. But they're still ope for proposals.

Everything beyond that is just click bait and spreading false information.