master thesis - zero trust architecture for legal entities

[synctext]

t.b.d.

• Real code
• Superapp
• government agency? (AFM,DNB,RvIG,Enisa,VWS, ?)
• idea: eidas-high certification of our Trustchain wallet, see commercial vendor details and another guide with info. With a friendly notary, live streaming, and hardware PUF; we should/could comply.

(starting today, but 10 ECTS left)

[Nieuwlaar]

Topic Funneling 1:

Ministerie van Volksgezondheid, Welzijn en Sport:
Project 1:
Improvement of MediTrail (https://repository.tudelft.nl/islandora/object/uuid%3A1774b1e9-3860-4a02-adaa-be9a92557169)

• Encryption of files (when MediTrail files leave the system, all data is unprotected)
• Integration Medic dossier on superapp
• Implement TrustChain transactions
• Connect MediTrail with 2024 EU passport

Project 2:
Improving communication of the health sector

• Integrate TrustChain in communication between hospitals
• Secure document sharing between hospitals

Autoriteit Financiële Markten:
Project 3:

• Integrate music ownership with passport linkage or other SSI

PaperDAO
Project 4

• Make a DAO like MusicDAO for academic research
• Integrate distributed crawling, ML, paper processing and filessharing

Rijksdienst voor Identiteitsgegevens:
Project 5:

• Implement a digital passport infrastructure / EBSI
• Create a personal data vault
• Integrate trusted data communication
  Came across, perhaps not an option (maybe talk with Johan/sjacobino on interesting directions): Digital Basic Identity - EU EBSI gateway and "regie op gegevens" #6023 (comment)

European Union Agency for Cybersecurity (ENISA):
Project 6:

• Tbd (waiting for mail)

De Nederlandsche Bank:
Project 7:

• Experiment with a EuroToken issued by DNB
• Issue an actual authority-backed digital Euro?

Projects still in the funnel of interest: 4, 5, 6, and 7.

[Nieuwlaar]

Status update:

• Applied for ENISA Traineeship

Read:

• General background information of eIDAS, ENISA, digital Euro and SSI.
• ENISA - Trust Services Security Incident 2020 - Annual Report
• ENISA Report - Digital Identity - Leveraging the SSI Concept to Build Trust
• ENISA Report - Remote Identity Proofing - Attacks & Countermeasures
• Industry-Grade Self-Sovereign Identity

[synctext]

• eIDAS high == golden standard.
• Proposal: we take exactly 1 month, until 11 April at 11:11am for a deep-dive into the viability of eIDAS high compliance
• thesis: New Innovations in eIDAS-compliant Trust Services: Blockchain
• Currently unknown regulation with unknown technical component, and unknown reliance on paper-document procedures written in lawyer-speak. Sincere opinion today: too risky to base a Delft master thesis on this, without a plan B.
• afraid of HSM, can a simple FIDO2 key be compliant?
• https://ec.europa.eu/futurium/en/system/files/ged/eidas_supported_ssi_may_2019_0.pdf
  • eIDAS Expert Group - TOWARDS A EUROPEAN DIGITAL IDENTITY FRAMEWORK
  • UZI-pas inside your smartphone with eIDAS-high
  • Driving license inside your smartphone with EU EBSI-compliant wallet at eIDAS high
  • encrypted key storage authentication on server inside Android using FIDO2/Webauthn (BouncyCastle based)

status copied. We now have the following inside the superapp:

• Self-Sovereign Identity
  • ✔️ Key management
  • ✔️ Identity wallet
  • ✔️ Verifiable claims in QR codes
  • ✔️ Zero-knowledge proofs and attestations
  • ✔️ Real-time and offline revocations
  • ✔️ Attribute sharing: name, address, location, and personal data vault entries
  • ✔️ No central point of failure, robust, disaster-proof (fully decentralised)
  • ✔️ European Commission EBSI v2 integration
  • ❌ Personal information is always encrypted and protected
• EuroToken
  • ✔️ Digital wallet
  • ✔️ Send money in real-time chats
  • ✔️ Offline transfers between wallets
  • ✔️ Gateway for Euro to EuroToken conversion
  • ✔️ Existing IBAN integration (TIKKIE)
  • ✔️ No central point of failure, robust, no fragile DiD "central resolver", disaster-proof (fully decentralised)
  • ✔️ Optional central transaction monitoring for compliance with money laundering legislation
  • ❌ Field trail with legal compliance (KYC,ALM)
• Social Networking
  • ✔️ Address book of friend and contacts
  • ✔️ Sharing of verified identities of friends
  • ✔️ Sharing of any data with friends (Unicode, emoji, pictures attestations,location, and Euros)
  • ✔️ Real-time messaging with contacts
  • ❌ Group messaging with multiple contacts
  • ❌ Compatibility with Facebook Instant Messaging
• Ecosystem
  • ✔️ Non-profit open ecosystem on Github
  • ✔️ Open Source without any exceptions
  • ✔️ Permissionless innovation
  • ✔️ Unbounded scalability (e.g. all citizens of European Union)
  • ✔️ Zero cloud infrastructure, GDPR compliant, fully decentralised

current sprint: literature survey.

[Nieuwlaar]

Draft literature survey on eIDAS compliance:
survey_eidas_high_compliance_1.pdf

[Nieuwlaar]

Status update:
Contacted Jean-Paul Bakkers from BZK, Geert-Jon Jepkes, IT architect eHerkenning and involved in DigiD eIDAS notification, and Bob Hulsebosch, process manager during DigiD hoog notification. From research and this contact, it can be concluded that creating a decentralized eIDAS high compliant standard and implementation is infeasible in a master thesis project, because of the following reasons:

• Most failed eIDAS level of assurance requests are kept secret (the applicant can choose to keep the eIDAS request secret).
• Self-assessment of TrustChain with respect to assurance levels indicates an overall level of assurance of ‘none’.
• The notification procedure requires a lot of communication and paperwork toward EC and Cooperation Network (peer review commission, consisting of around 15 to 25 members from all EU Member States).
• The notification procedure (pre-notification, peer review, notification, publication, and mandatory recognition) takes at least a year.
• Peer review process tends to take longer when innovative ideas are requested. Storing data in a SE or TEE on mobile phones is considered as innovative and requires a lot of proofing that the data is handled secure.
• No decentral eIDAS ‘high’ compliant service currently exists. Sovrin has a roadmap to comply to eIDAS ‘high’ which started from January 2019 and should have been finished before 2022, but as of today Sovrin is not eIDAS ‘high’. Furthermore, another decentral SSI from Catalan, Spain (IdentiCAT, with 550.000 euro budget) was expected in early 2020, but at the moment is nowhere to be found.
• eIDAS level of assurance requirements require central control (e.g., central revocation of keys)
• Many unforeseen problems are expected when creating a standard for decentral eIDAS ‘high’ services and applying for eIDAS ‘high’ without the supervision of someone (BZK, ENISA, DigiD, eHerkenning) who has eIDAS compliance experience.

[synctext]

Goal:

• get a government position (or EU level)
• get a minimal viable wallet operational from our Superapp efforts (strip&doc ?)
• Remove all decentralisation and replace with "offline disaster-mode", no-Internet-needed, always-works storyline, in-case-of-central-server failure, critical infrastructure reliability, backup mode.
• Explore adopting use-case stakeholders, digital drivers license, UZI pas, digital Euro, stable coin is now dollar dominated, Euro DAO, and a operational KYC with machine learning; innovation-on-top.
• prepare for a 3-year long project with mandatory EU-wide acceptance of TUDelft technology. Open source critical infrastructure with end-to-end verifiable security 🍷 🥇 🍻

[Nieuwlaar]

• Contacted potential use-case stakeholders, following have my CV, are interested, and know I need assistance in eIDAS compliance (I have sent them this issue as well); RDW, VWS, CIBG, BZK, ENISA, Logius, RvIG, ICTU, and more. No concrete collaboration has emerged from this for now.
• Created a new app called IDelft within the superapp
• Currently working on adding functionality from the valuetransfer app into IDelft, specifically the onboarding of IDs and passports (not functional yet)

[synctext]

• 100% certain we can get you into .GOV (afm,kvk,rvig, etc.)
• Prior work by Tim on access and legal entity matters: https://repository.tudelft.nl/islandora/object/uuid%3Aaab1f3ff-da54-47f7-8998-847cb78322c8
• after 9 weeks you are now getting the required knowledge on what is novel and whats done before.
• Only question is of direction and full re-usage of eIDAS expertise
• token route: FIDO Recognition for European Digital Identity Systems and eIDAS Grows
• biometrics route: https://hackernoon.com/6-best-open-source-projects-for-real-time-face-recognition-vr1w34x5
  • novelty: local-first biometrics, signed vector of hashed biometrics
• DAO route, KYC: https://www.eema.org/wp-content/uploads/2021/03/ANNUAL-CONFERENCE-2018-LONDONKEYNOTES2-BARTHA.pdf Europe: Mission: to explore how to facilitate the cross-border use of electronic identification (eID) and Know-Your-Customer (KYC) portability based on identification and authentication tools under the eIDAS Regulation to enable financial institutions to identify customers digitally. EBSI and DBI re-usage and production-ready.
• Notary signature (commercial)?
• open source FIDO2 NFC eIDAS high key storage https://github.com/solokeys/solo1

[Nieuwlaar]

Brief summary of the findings in these four directions:

• The token route is the previous idea of creating an eIDAS high compliant implementation (identity proofing at 'high' level of assurance), creating such a token is infeasible in a MSc thesis.
• Biometrics route: For eIDAS 'high', only facial/fingerprint recognition can be used for ID proofing (facial is preferred). Facial recognition requires a lot of proofing of security in eIDAS peer review. Seems like a very nice next step once there is a basis for eIDAS ID proofing.
• DAO route: Difficult to find bridging information on DAO and KYC. However, an interesting use case may be a decentralized cryptoexchange complying to Dutch law (Wet ter voorkoming van witwassen en financieren van terrorisme en Sanctiewet 1977) which implies ID proofing.
• Signature route: 3 different types of electronic signatures: Simple, advanced and qualified. Seems like a nice use case where each type can be implemented gradually. Goal TU Delft having a qualified signature creation device (QSCD)(required for generating a qualified signature). Even better: TU Delft being able to provide QSCDs by obtaining rights to issue QSCD certificates, in other words become a qualified trust service provider (QTSP, current Dutch QTSPs: https://esignature.ec.europa.eu/efda/tl-browser/#/screen/tl/NL) (unsure about feasibility, however, if TU Delft = QTSP, all TrustChain peers QSCDs?). Qualified signatures are legally equal to so called 'wet' signatures.

More information can be found in Section 4:
survey_eidas_high_compliance (1).pdf

[synctext]

• Doing SSI after DigiD is too ambitious
• Grand challenge for government will be digitisation, they dont have the people and are obsessively focused on legal matters.
• Blockchain and AI are going at "warp-speed", compared to government pace of innovation.
• Government is resilient to change (e.g. innovation)
• Investments in AI, machine learning and robotic process automation (RPA) technology are set to reach $232 billion by 2025, a new report from KPMG has shown. A skills shortage and lack of common infrastructure is dampening progress.
• Delft University has 50 master student / year as "production". We are highly ranked. Simply combining Top100 universities AI and blockchain output rough estimate (with guesstimating classes of 200 students max.): $232 billion / ((Top-)100 x 200 students ) = 11.6 million US$ per new top-educated senior engineer yearly. So there is a clear imbalance.
• Direction:
  • The DAO has a Sybil problem! Fake identity is essential to prevent a hostile take-over, governance issue. DAO has now nice outlook/fantasy/vision paper by Vitalik and others: decentralised society
  • Can your thesis be the grounding of this: Government policy, as communicated to parliament. Fundamentals for digitisation... e.g. EIDAS
  • qualified signature creation device (QSCD) combines with DAO?
    • Be like Let's Encrypt! Single-handily re-define an entire ecosystem.
    • eIDAS Conformity Certificate, https://www.aangetekendmailen.nl/wp-content/uploads/2021/07/QTSP-Aangetekend-B.V..pdf
    • we can certify open source providers, we provide a reference implementation + documents.
    • Peer-to-peer biometrics in a DAO for identity proofing? Like prior fingerprints without Android permissions portable biometric-based trust #2812 We can remotely read the machine readable zone and obtain a photo, this can be validated manually and assisted with biometric software. No government, no notary, and zero-banking institutions needed to prevent fake identities in systems. Stops all bots. Secured proof of humanity, see insecure version.
      • Superapp with ID-proofing ability within DAO, proof-of-principle level.
      • Identity document remote NFC reading {danger ⚠️ to privacy, random picked witness}
      • live streaming added to the operational remote chat app
      • Witness provides a trustchain-based "proof-of-identity-verification"? zero-knowledge proof?
      • analyse the legal standing of your proof-of-principle within eIDAS legal framework of EU. Document in IETF trustchain addition?
      • RDW embedding of master thesis in an ideal world: test app to scan existing RDW MRZ, make a photo suitable with rules for putting on your renewed driving license, compare the embedded photos with a selfie, request approval from RDW, pay the cost of a new driving license, and select the pickup location. EDIT: entry of signature to print on the plastic.
      • Tikkie experience from Superapp Euro i team.
• Sprint focus: (take DAO Sybils as tentative focus??????; "remote ID-proofing: an open source library - GDPR-compliant, EBSI-integration, and eIDAS checked") compile from source, understand id scan code, chat app by Bambacht, and binary transfer EVA protocol (Python+Kotlin code).
  • ensia requirements https://www.enisa.europa.eu/publications/remote-identity-proofing-attacks-countermeasures
  • etsi Technical Standard 119 461 V1.1.1

[Nieuwlaar]

• Applied for an internship at Logius in the eIDAS team (expected response: This week)
• Build a working app (based on valuetransfer) with ID boarding (not included in the video due to ID details):
  

[Nieuwlaar]

Update:

• Spoke with Ka-Kin Fung from the eIDAS team of Logius, he finished 7 peer reviews of eIDAS compliance. If TU Delft were to go for an official eIDAS 'high' peer review, interesting to learn from his and his team's findings (Some of these peer reviews he did with the aforementioned Geert-Jon Jepkes). They did the whole process for DigiD. Pilots are never peer reviewed. Decentralized eIDAS identification has never been peer reviewed before. All public peer reviews here.
• Identification is one of the pillars of trust in many use case, also at the KVK. Hence I think it would be nice to dedicate a chapter to identification with an outline of the current eIDAS situation, a look into the 'futuristic' eIDAS2 legislation and other upcoming laws, and a strong focus on the ultimate goal of a decentralized eIDAS 'high' compliant solution.
• Started at the KVK, enjoying it very much. Currently, having meetings with many people to get into the KVK ambiance.
• KVK has a very interesting SSI and Proof of Attorney (Machtiging) use case that can be developed. It concerns RDW's numberplate addition/suspension machtiging which is recorded in the KVK Handelsregister. KVK InnovationLab wants to build a SSI solution to learn from Proofs of Attorney in a SSI environment. So far the topic has been discussed within the team and RDW, and they decided they want Microsoft's SSI wallet to be used. I think this use case is more interesting than a Sligro one, this use case considers an actual legal binding machtiging! Would very much like to do this, wondering if that is ok?
• I wrote the introduction and draft problem description (Introduction is pretty ok, the problem description will be redone completely, I will repost once finished) Here is my work so far.
• Wondering what you think of below's schematic overview as "het rode draad" of my thesis?:
  

[synctext]

inspirational update, good efforts.

"Deploying pillars of trust: eIDAS2, Trustchain, IPv8, and EBSI"
That is worthy of a solid master thesis focus! Linking various sources-of-legal-truth, tamper-proof ledger storage, quantum-proof IPv8 communication, and root-of-trust from EBSI.
Uncompromising open source.