Research

Fooling Relying Parties of the EUDI Wallet Architecture: Credential Pooling Attacks and CRESTA, a Standard-Compliant Countermeasure

Researchers demonstrate that the EU Digital Identity Wallet's multi-credential disclosure flow is vulnerable to credential pooling — where colluding users swap attestations — and propose a standards-compliant binding mechanism (CRESTA) that enterprises building eIDAS 2.0 relying-party services should evaluate.

Summary written by editorial AI · Source link below

Filed by arXiv Crypto & Security2 November 20261 min readRead at source ↗

arXiv:2610.41655v1 Announce Type: new Abstract: The European Digital Identity (EUDI) Wallet will let millions of EU citizens prove who they are and what they are entitled to, disclosing only what is needed. Many services need several credentials at once, such as an identity card and a university degree, so combined presentations are essential. We present credential pooling attacks on relying parties of the EUDI Wallet reference architecture. Colluding users, each holding some credentials in t

Editorial Analysis

Why it matters

As EU member states roll out the EUDI Wallet under eIDAS 2.0, any architectural flaw in credential presentation directly affects the trust model enterprises will depend on for cross-border identity verification.

What to do

Include credential pooling scenarios in your threat model for EUDI Wallet relying-party integrations and track CRESTA adoption in the Architecture Reference Framework updates.

Board brief

A newly discovered attack on the EU Digital Identity Wallet's credential exchange could weaken the trust foundation of Europe's upcoming cross-border digital identity system.

Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.

Continue at the source

Read the full report at arXiv Crypto & Security

External link — opens at arXiv Crypto & Security in a new tab.

Continue with

Editorial Analysis

More from the Research Desk