Why this topic

Trust online has become expensive

Cybercrime is evolving rapidly. Phishing, deepfakes, and identity fraud are causing ever-increasing economic damage and highlight the need for trustworthy digital identities.
75%

German companies affected

75% of German companies have already fallen victim to identity-based attacks. Artificial intelligence is accelerating phishing, deepfakes, and social engineering, significantly increasing the risk of digital identity theft.
Regarding the article
€500 million

SEPA fraud Germany ticket

Deutschlandtickets were issued before SEPA payments had been verified. This security loophole allowed fraudsters to issue and resell valid tickets on a massive scale, resulting in an estimated total loss of up to 500 million euros nationwide.
Regarding the article
€4.25 million

AI-powered identity attacks on average

Data breaches cost companies in Germany an average of 4.25 million euros. AI-powered deepfakes and identity theft are accelerating cyberattacks, making secure digital identities more important than ever.
Regarding the article
What the law requires

From eIDAS to mandatory: The timeline

What was decided in Brussels and when it will affect you.
2014

eIDAS is being adopted

An EU regulation creates the common legal basis for digital identities, electronic signatures, and trust services.

04/11/2024

eIDAS 2.0 enters into force

The revision introduces the EUDI Wallet — for citizens, public administration, and the private sector.

2026

Provision for citizens

Every member state must provide its citizens with the opportunity to use their sovereign digital identity.

01/02/2027

Examination becomes mandatory

According to Article 45e, evidence from an EUDI Wallet must be accepted and verified. This is the date when a future topic becomes a task.

Regarding the prescription

To whom it may concern

In paragraph 56, the regulation specifies the areas in which the wallet must be accepted – and thus almost every organization that identifies customers.

In detail, this affects organizations for which strong user authentication is required for online identification.

Traffic

Energy

Banking

Financial services

Social security

Bless you

Water Supply

Postal services

Digital infrastructure

Telecommunications

Education

[And what is a credential?]

A credential is a digital proof that is self-verifying

In the IDealWALLET|App, a credential looks like a small card: a subscription, ID, or authorization. Technically, these are signed data plus two keys - a public one that anyone can use to verify, and a private one that proves the credential belongs to you.

The difference compared to a PDF in your inbox: With a credential, you can determine in seconds who issued it, that no one has altered it, and that it belongs to the person standing in front of you. Without needing to check back with the issuer.

And you only show what is necessary.
This is called selective disclosure.

A daily life example:

Today
You show your ID. The other person sees your name, date of birth, address, and ID number—even if they only wanted to know if you are of legal age.
With the EUDI Wallet
You show "over 18". Not the date of birth, not the name. Verified and provable - but only this one piece of information.
The three roles

Three roles - and you have understood the most important points

The entire ecosystem consists of three participants. Anyone who knows these three understands every technical discussion.

A sentence that is often missing in this context:

An organization is usually all three at once: it issues credentials, holds credentials from others, and verifies credentials from others. That is precisely why it is worth understanding the topic thoroughly.

Issuer

Issues the proof and vouches for it with its signature. The registry office for the birth certificate, the transport company for the subscription, the bank for the account authorization.

Holder

Keep the proof safe and decide who you show it to. That is the person with the wallet — and the essential difference compared to today, where your data is held by others.

Verifier

Views the credential and checks two things: Does it come from the correct issuer, and does it belong to the person presenting it. The verifier, the agency, the online shop.

What really matters

[Safety]

Storage Types

What makes the difference: Where the key is stored

Every credential in a wallet is tied to a private key. Whoever possesses this key is that person to any system. The decisive question regarding a wallet is therefore not how good it looks, but where this key is stored.

In this regard, the security and the location of the storage must be examined closely:

In device storage
Quickly implemented and convenient: the key is stored as a file on your smartphone. However, every file can be copied—by malware, through backups, or when switching devices. With a copy, someone else could impersonate you without it being noticed.
In the device chip
The key is generated within the embedded security chip (eSE) and never leaves it. However, in the case of Apple, this chip is not certified – there are no guarantees. Furthermore, you are bound to the manufacturer and its jurisdiction, such as the US CLOUD Act.
In the external chip
The golden path: The private key is generated within the security chip of a smart card and never leaves it. Copying is impossible – this technology has been protecting bank cards for 25 years. Independent of the smartphone, even when switching devices. That is why we developed the DI Card.
More about the DI Card

There will be many wallets. That is exactly the point.

The most common misconception: That there will be a single app - provided by the government. In fact, multiple providers will build wallets - manufacturers, banks, government agencies, transport companies.
Each wallet will have individual advantages.
Each wallet has a different level of security.

For this to work, a credential must be verifiable everywhere, regardless of which wallet it comes from. That is the purpose of the standards and the reason why there is so much talk about interoperability in this field.

The benefits only become apparent then: 

  • The transport company's subscription card unlocks car sharing.
  • The registration confirmation as a digital credential from the citizens' office speeds up the application at the social welfare office.
  • The driver's license as a digital credential from the driver licensing authority is sufficient for the car rental provider.

Digital credentials that are valid across industry boundaries.

The glossary

The abbreviations, spelled out once

If you encounter an abbreviation in a presentation: here is what it means.


Group 1 - Law and Politics

eIDAS

"electronic IDentification, Authentication and trust Services." 2014 EU regulation that establishes uniform rules across Europe for digital identities, electronic signatures, and trust services.

eIDAS 2.0

The revision of April 11, 2024. It introduces the EUDI Wallet and makes its recognition mandatory in many sectors.

EU Digital Identity Wallet

"European Digital Identity Wallet." The EU's digital wallet — for citizens, public administration, and businesses. Every member state must offer one to its citizens.

eID

The electronic ID function of the identity card. It is the source from which official data enters a wallet.

PID

"Person Identification Data." A person's official core data: name, date of birth, nationality. The source proof in the wallet upon which others are built.

Sovereign and non-sovereign

Official credentials are issued by the state: identity card, driver's license, registration certificate. Non-official ones come from companies and associations: subscription card, employee ID, museum pass.

BMI & BMWK

Federal Ministry of the Interior and Federal Ministry for Economic Affairs and Climate Action, respectively. Both are advancing the German implementation of the EUDI Wallet through various projects.

Group 2 - Minutes

DID

“Decentralized Identifier.” An identifier that functions without a central registration authority and to which a key pair belongs.

DIDComm

A protocol for secure communication between two parties — even directly between two devices, with no server in between.

OPENID4VP

"OpenID for Verifiable Presentation." The standard used for presenting and verifying digital credentials. Built on the widely used OpenID protocol.

OPENID4VCI

"OpenID for Verifiable Credentials Issuance." The standard used to issue credentials. It also builds on the widely used OpenID protocol.

Group 3 - Verification Formats

mobile driver's license (ISO 18013-5)

A verification format based on international standards, originally developed for the digital driver's license. It is designed for on-site verification, for example via QR code or NFC from device to device.

SD-JWT VC

“Selective Disclosure JSON Web Token”. The format that allows you to show only individual details of a credential, such as “over 18” instead of your date of birth. It is one of the standard formats for the EUDI Wallet.

W3C VC / JSON-LD

The credential format of the W3C (World Wide Web Consortium, the body for web standards). JSON-LD (Linked Data) allows multiple credentials to be connected to one another. This creates chains of trust in which every link is verifiable.

Group 4 - Types of verification

Anmeldedaten

A digital credential. Represented as a card in the wallet, technically signed data with associated keys.

VC

„Verifiable Credential", verifiable proof. The standard term for a credential whose origin and integrity can be verified by anyone.

EAA

"Electronic Attestation of Attributes", electronic attestation of attributes. The term from the eIDAS regulation for proof of a person's characteristics, for example a driver's license, degree, or membership. It can be issued by any entity, not just the state.

QEAA

“Qualified Electronic Attestation of Attributes”, qualified electronic attestation of attributes. It is issued by a state-approved trust service provider and has the same legal effect in the EU as a paper attestation.

Group 5 - Connection

REST

“Representational State Transfer”. The most common type of interface for how software systems communicate with each other over the internet. Your specialized application sends a request and receives the validated data back, without needing to know anything about wallets itself.

OpenAPI

An open standard used to fully describe an interface: what requests exist and what data goes in and out. Your IT department can derive the connection directly from this, with no guesswork and no lengthy coordination.

XÖV

"XML in public administration". The family of data standards that German authorities use to exchange data with one another, for example XMeld for registration systems. This allows data from administrative procedures to be issued as proof.

JSON and XML

Two data formats in which systems exchange structured information. Verified evidence data arrives in your specialist system in one of these formats, ready for automatic further processing.

Group 6 - Technology

Applet

The small program that runs on a security chip. It manages the keys and executes the signature directly within the chip, so that the key never has to leave it.

eSIM, Secure Element

Security chips in which keys are securely generated and stored. The Secure Element can be permanently installed in the smartphone or externally, e.g., in the DI Card. The eSIM is the permanently installed successor to the SIM card.

HSM

“Hardware Security Module”. A security chip for organizations: it uses its keys to sign evidence. The keys cannot be exported and therefore cannot be stolen.

NFC

Near-field communication according to ISO 14443. The wireless technology that allows smartphones and smart cards to communicate with each other at a distance of a few centimeters.

WRPAC

"Wallet Relying Party Access Certificate", wallet access certificate. It identifies an organization to any EUDI wallet as a genuine, registered entity. Without this certificate, no wallet will respond to a request.

WRPRC

“Wallet Relying Party Registration Certificate”, registration certificate. It records which data an organization is permitted to request and for what purpose. The user sees this in their wallet before they share anything.

Selective Disclosure

"Selective disclosure." You only show the required information: "over 18" instead of the date of birth, "resident in Dresden" instead of the full address.

SSI

“Self-Sovereign Identity,” self-determined identity. The principle: Proofs are held by the individual, not in a central database.

Software cryptography

The keys are stored as a file in the device memory. Easy to implement — but copyable and therefore vulnerable.

Hardware cryptography

The keys are generated in a security chip and never leave it. The same technology that has been protecting bank cards for over 25 years.

Trust registry

A directory that keeps track of whom to trust when issuing credentials. Without it, a verifier cannot know whether an issuer is genuine.

Chain of trust

Evidence that builds on itself: The district court verifies the commercial register entry, which in turn verifies the authorization to sell, which then verifies the valid ticket. Each link is verifiable.

Group 7 - Projects and Programs

SPRIN-D

The competition held by the Federal Agency for Disruptive Innovation regarding EUDI Wallet prototypes. IDealWALLET was one of the selected prototypes.

More about Sprin-D

ID-Ideal

Development project for the management of secure digital identities. Within this, KAPRION worked on the urban mobility application scenario, among others, with field tests in Dresden and Leipzig.

More about the project

SaxTrust

Saxon research project with SQL Projekt AG and HTW Dresden. It is developing the interface used by organizations to manage certificates.

More about the project

Compass

The municipal data pass. In collaboration with the state capital Dresden, data from the population register is being issued as credentials.

More on the topic

Trustnet

We are a founding member of the Trustnet e.V. association.
The idea of an internet with verifiable identities and credentials — a trust layer over today's web.

Learn more

Trust over IP and DIF

Two international organizations that develop open standards for decentralized identities. KAPRION is active in both.

More about ToIP
The first step has been taken.

You have the basics. Where to now?

Get in touch with us, feel free to test various demo use cases, or order your own DI Card.

Ask us in person

For anything not covered here. We are also happy to explain things in a meeting at your location.

Contact

For Organizations

How to issue and verify certificates — and what that means for your specialized procedures.

To the business system

Deeper into security

Hardware cryptography, chains of trust, offline verification in detail.

Learn more

Order your own DI card

Don't have your own DI Card yet? Learn more about the DI Card, how to use it, and how you can order one.

Order DI card

Try it yourself

Download the app and receive a credential. Nothing explains it better than your first scan.

Test now