Towards Flexible Embedded Disclosure Policies for EUDI Wallets

The upcoming EU Digital Identity (EUDI) Wallet aims to reshape identification and authentication across the EU. Users will receive attestations of identity data from issuers, store them in their wallet, and present them to relying parties. To prevent illegitimate access to sensitive attestation data, the EUDI framework introduces access control policies attached to attestations by their issuers; so-called embedded disclosure policies (EDPs). However, the current EDP framework is inflexible and restricted to simple whitelists and roots-of-trust logic.

We improve on the EUDI’s EDP concept, adopting ideas from the literature to build a more dynamic policy-based access control mechanism. We introduce a generic model for flexible, attribute-based access control. We then instantiate such a scheme using DCQL, a query language already established in the EUDI ecosystem. Finally, we also implement and integrate this approach into a real-world EUDI wallet, demonstrating its feasibility.