La Privacy e Cybersec per le aziende
Osservatorio a cura del dott. V. Spataro privacy, formulari, check up per WordPress

   eidas 2023-11-09 ·  NEW:   Appunta · Stampa · pdf

Patrick-Breyer: the european digital identity in the new Eidas undermines browsers and the web


La gestione dell'identità digitale, la carta d'identità europea, gestita dalla banca centrale europea, non piace ai pirati.

Il tema e' ancora ampiamente sottovalutato.

Fonte: Patrick-Breyer


L'analisi è riservata agli iscritti. Segui la newsletter dell'Osservatorio oppure il Podcast iscrizione gratuita 30 giorni




  • La carta d'identità europea, gest


EU Digital Identity Regulation (eIDAS): Pirates don’t support blank cheque for surveillance of citizens online!


The EU Parliament and EU Council yesterday struck a political deal on the reform of the EU Digital Identity Regulation (eIDAS 2). A new digital identity wallet app is to allow EU citizens to access public and private digital services such as Facebook or Google, and pay online. The deal was made even though more than 500 scientists and numerous NGOs in an open letter „strongly warn against the currently proposed trilogue agreement, as it fails to properly respect the right to privacy of citizens and secure online communications“ – criticism which the Pirate Party Members of the European Parliament underline.

“This regulation is a blank cheque for surveillance of citizens online, endangering our privacy and security online”, comments Pirate Party lawmaker Patrick Breyer. “Browser security is being undermined, and overidentification will gradually erode our right to use digital services anonymously. Mark Zuckerberg should have no right to see our ID! Entrusting our digital lives to the government instead of Facebook and Google is jumping out of the frying pan and into the fire. This deal sacrifices essential requirements the European Parliament had put forward to make the eID app privacy-friendly and secure. The EU misses the opportunity to establish a trustworthy framework for modernization and digitization. We will watch the implementation very closely.”

Pirates Mikulas Peksa and Patrick Breyer worked until the last minute to try and fix at least some of the numerous risks of the EU digital identity scheme. In a major victory, Member States will not be obliged to assign a single unique ID number to every citizen. Signing up for the eID app will be voluntary, and it will remain possible to access public and private services by other existing identification and authentication means. The app client will be open source.

Overall though the scheme remains a blank cheque for surveillance of citizens online: As hundreds of scientists publicly warn and contrary to what the EU claims, web browser manufacturers could be forced to expose our securely encrypted Internet use (including intimate and sensitive activities) to government surveillance. This is an unacceptable attack on secure encryption. The eID apps can also be used to monitor our digital lives because there is no requirement of unobservability. The content of our eID wallets (potentially bringing together personal banking data, medical prescriptions and criminal records) could be monitored via central databases because we have no right to store documents exclusively on our personal devices.

The lure of conveniently signing in to private digital services using a single official eID app is a trap. Overidentification will gradually erode our right to use digital services anonymously which currently keeps us safe from criminal activity, unauthorised disclosure, identity theft, stalking and other forms of abuse of personal data. The eID app will not allow for multiple, truly separate user profiles which vulnerable persons rely on.

The server-side code of the eID wallet will not have to be open source, meaning the public cannot know what the code actually does and if it is safe.

In view of all this, the new EU eID app will not be trustworthy and will fail to sufficiently encourage the development of digital and eGovernment services in Europe – much to the Pirates regret.

See also the assessment of the deal published by NGO

The text beginning on the next page is an open letter on the position of scientists and
NGOs on the EU’s proposed digital identity reform.
As of the 8th November 2023, the letter has been signed by 504 scientists and
researchers from 39 countries, as well as numerous NGOs.
For press inquiries please contact:
Juan Tapiador - (Spain)
Steven J. Murdoch - (UK)
Jaap-Henk Hoepman - (The Netherlands)
Anja Lehmann - (Germany)
Peter Schwabe - (Germany)
Cas Cremers - (Germany)
René Mayrhofer - (Austria)
Manuel Barbosa - (Portugal)
Raphael M. Reischuk - (Switzerland)
Gaëtan Leurent - (France)
Olivier Blazy - (France)
Stephen Farrell - (Ireland)
TJ McIntyre - (Ireland)
Ivan Visconti - (Italy)
Bart Preneel - (Belgium)
Vashek Matyas - (Czech Republic)
Diego Aranha - (Denmark)
Civil Society - NGOs
Thomas Lohninger - (Europe)
Alexis Hancock - (Worldwide)
For information on signing the letter, please see the end of this document.
Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform
2nd November 2023
Dear Members of the European Parliament,
Dear Member States of the Council of the European Union,
We the undersigned are cybersecurity experts, researchers, and civil society organisations from
across the globe.
We have read the near-final text of the eIDAS digital identity reform which has been agreed on a
technical level in the trilogue between representatives from the European Parliament, Council
and Commission. We appreciate your efforts to improve the digital security of European citizens;
it is of utmost importance that the digital interactions of citizens with government institutions and
industry can be secure while protecting citizens’ privacy. Indeed, having common technical
standards and enabling secure cross-border electronic identity solutions is a solid step in this
direction. However, we are extremely concerned that, as proposed in its current form, this
legislation will not result in adequate technological safeguards for citizens and businesses, as
intended. In fact, it will very likely result in less security for all.
Last year, many of us wrote to you to highlight some of the dangers in the European
Commission’s proposed eIDAS regulation. After reading the near-final text, we are deeply
concerned by the proposed text for Article 45. The current proposal radically expands the ability
of governments to surveil both their own citizens and residents across the EU by providing them
with the technical means to intercept encrypted web traffic, as well as undermining the existing
oversight mechanisms relied on by European citizens. Concretely, the regulation enables each
EU member state (and recognised third party countries) to designate cryptographic keys for
which trust is mandatory; this trust can only be withdrawn with the government’s permission
(Article 45a(4)). This means any EU member state or third party country, acting alone, is
capable of intercepting the web traffic of any EU citizen and there is no effective recourse. We
ask that you urgently reconsider this text and make clear that Article 45 will not interfere with
trust decisions around the cryptographic keys and certificates used to secure web traffic.
Article 45 also bans security checks on EU web certificates unless expressly permitted by
regulation when establishing encrypted web traffic connections (Article 45(2a)). Instead of
specifying a set of minimum security measures which must be enforced as a baseline, it
effectively specifies an upper bound on the security measures which cannot be improved upon
without the permission of ETSI. This runs counter to well established global norms where new
cybersecurity technologies are developed and deployed in response to fast moving
developments in technology. This effectively limits the security measures that can be taken to
protect the European web. We ask that you reverse this clause, not limiting but encouraging the
development of new security measures in response to fast-evolving threats.
The current text also mentions in multiple places the need for the European Digital Identity
Wallet to protect privacy, including data minimization, and prevention of profiling. Yet, the
legislation still allows relying parties like governments and service providers to unnecessarily
link together and gain full knowledge about the uses of credentials in the new European Digital
Identity System. Given the broad intended uses of this system, which span all areas of life from
health, finance, commerce, online activity up to public transport, we believe that failing to require
both unlinkability and unobservability will severely compromise the privacy of EU citizens. Article
6a(7)(a) should be aligned with the negotiation mandate from the European Parliament lead
Industry Committee and thereby prevent technologically that such information can be obtained
by governments and other parties without the explicit consent of users. Article 6a(7a)(b) should
“mandate” instead of “enable” that interactions cannot be linked by relying parties or other
actors, where identification of the user is not mandatory. Lastly, forum-shopping from ‘Big Tech’
and other bad actors can only be prevented by a harmonised implementation of the Regulation
that allows national eIDAS agencies to be overruled should they fail to act.
Finally, we would like to highlight our frustration that decisions crucial for the security and
privacy of citizens, businesses, and governments, are being taken behind closed doors in
trilogue negotiations without public consultation of experts about the potential consequences of
the proposed regulations. We urge the European Parliament, Commission, and Council to
reconsider their legislative processes and commit to greater transparency so that experts and
the public can effectively contribute to the development of new regulations.1
In summary, we strongly warn against the currently proposed trilogue agreement, as it
fails to properly respect the right to privacy of citizens and secure online
communications; without establishing proper safeguards as outlined above, it instead
substantially increases the potential for harm.
1 T-540/15 - De Capitani v Parliament
1. Undermining website authentication undermines communications security
The current text of Article 45 mandates that browsers must accept any root certificates provided
by any Member State (and any third party country approved by the EU) and will have severe
consequences for the privacy of European citizens, the security of European commerce, and
the Internet as a whole.
Root certificates, controlled by so-called certificate authorities, provide the authentication
mechanisms for websites by assuring the user that the cryptographic keys used to authenticate
the website content belong to that website. The owner of a root certificate can intercept users’
web traffic by replacing the website’s cryptographic keys with substitutes he controls. Such a
substitution can occur even if the website has chosen to use a different certificate authority with
a different root certificate. Any root certificate trusted by the browser can be used to
compromise any website. There are multiple documented cases of abuse, because the
security of some certificate authorities has been compromised. To avoid this, there exists
legislation that regulates certificate authorities, complemented by public processes and
continuous vigilance by the security community to reveal suspicious activities.
The proposed eIDAS revision gives Member States the possibility of inserting root certificates at
will, with the aim to improve the digital security of European citizens by giving them new ways to
obtain authentic information of who operates a website. In practice, this does exactly the
opposite. Consider the situation in which one of the Member States (or any of the third party
states recognized now or in the future) were to add a new authority to the EU Trusted List. The
certificate would have to be immediately added to all browsers and distributed to all of their
users across the EU as a trusted certificate. By using the substitution techniques explained
above, the government-controlled authority would then be able to intercept the web traffic of
not only their own citizens, but all EU citizens, including banking information, legally
privileged information, medical records and family photos. This would be true even when visiting
non-EU websites, as such an authority could issue certificates for any website that all browsers
would have to accept. Additionally, although much of eIDAS2.0 regulation carefully gives
citizens the capability to opt out from usage of new services and functionality, this is not the
case for Article 45. Every citizen would have to trust those certificates, and thus every
citizen would see their online safety threatened.
Even if this misbehaviour was discovered, under the current proposal it would not be possible to
remove this certificate without the ultimate approval of the country having introduced the
certificate authority. Neither eIDAS’s article 45 nor any provisions in adjacent EU legislation
such as the NIS2 Directive provide any independent checks and balances on these decisions.
Further, European citizens do not have an effective way to appeal these decisions. This
situation would be unacceptably damaging to online trust and safety in Europe and across the
world. We believe this legislative text must be urgently reworked to avoid these serious
consequences by clarifying that eIDAS does not impose obligations to trust cryptographic keys
used for encrypted web traffic.
The proposed legislation also prevents the introduction of security checks when verifying the
certificates used for encrypted web traffic in Art 45, (2a). As written, this language requires that
the EU’s website certificates not be subjected to any mandatory requirements beyond those
specified in ETSI standards. Mandatory requirements on certificates are essential when
browsers validate certificates presented for use in encrypted web connections. Preventing these
additional security checks has no useful purpose and only hampers the improvement of
cybersecurity for European citizens. The detailed rules on certificate validation and display are
constantly being adapted based on new research results and consensus in the security
community. Existing security mechanisms, well-studied and accepted by the security community
at large, such as TLS 1.3 and certificate transparency logs currently enable browsers to quickly
adapt to changing threats and improve global web security. It is essential that this regulation
establishes a mandatory minimum set of security standards, but does not impose a limited set of
requirements which would hamper the adoption of new security technology within the EU.
While Article 45 could be understood as reducing the power of the large companies behind the
major web browsers, from a technical perspective, this is not the case. There already exists a
large number of certificate authorities capable of issuing certificates trusted in every web
browser, many of which are European and also recognised under the EU’s existing eIDAS
legislation. Websites have a free choice about which certificate authority they use and all of the
approved certificate authorities are treated equally in the browser. Should issues arise, the EU is
already well-equipped to tackle them through the recently passed Digital Markets Act, which
specifically identifies popular browsers and cloud services and bans self-preferencing behaviour
by gatekeepers. Article 45 itself does nothing to assist this process or to enable European
scrutiny of trust decisions by ‘Big Tech’, instead it only enables the interception of EU citizens’
web traffic by European governments. It further prevents concerned users, who may have
serious and substantiated concerns about being subject to state surveillance, from choosing, or
even creating, a browser that has stricter security checks.
In summary, this regulation allows misbehaviour by any individual Member State (or approved
third party countries) to compromise the safety and security of other Member State’s citizens. If
it is implemented, it would result in citizens having to, without a choice, trust all certificate
authorities defined by Member States (and recognized third countries) in addition to the parties
they trust today. This regulation does not eliminate any existing risk. Instead, by undermining the
existing secure web authentication processes, introduces new risks with no gain by European
citizens, businesses, and institutions. Moreover, if this regulation becomes a reality, it is only to
be expected that other countries will put pressure on browsers to obtain similar privileges
as EU Member States — as some have unsuccessfully attempted in the past — globally
endangering web security.
In order to address these concerns and avoid the security issues introduced by the current
legislation proposal which could result in incalculable damage, we recommend:
● The text be clarified to ensure that this legislation will not interfere with trust decisions
around the cryptographic keys or certificates used to secure web traffic and the
consequent impact on privacy and security of European citizens.
● Additional checks independent from those envisioned in the legislation are not only
permitted but encouraged to enable browsers to rapidly incorporate advances made by
the security community to improve the security of communications.
In particular:
● The re-introduction of text to Article 45 (2) limiting its scope: “Such recognition, support
and interoperability means solely that web-browsers shall ensure that the identity data
attested in the certificate provided using any of the methods is displayed in a
user-friendly manner.”
● The deletion of Article 45 (2a) so that new security checks can be implemented
● In Recital 32: Adding clarification that the obligations of recognition, interoperability and
support in Article 45 do not extend to the use of encryption and authentication
technologies for securing web traffic.
We also explicitly note that established processes clearly allow new certificate authorities to be
added to browser root trust stores; nation states wishing to establish a new CA legitimate and
lawful purposes need to go through the same security certification procedures that existing
authorities do, without requiring new regulation. Fostering the development of an EU-native
browser, or strengthening the supervision of certificate authorities across the EU, would have a
much more positive impact on the overall security of European citizens than attempting to
change the status quo of web security from within the eIDAS regulation.
2. A complex system only provides the security and privacy guarantees of its weakest
The European Digital Identity Wallet (EDIW) is designed to identify and authenticate users with
a high level of assurance. The Wallet includes identity information from national IDs (age, sex,
etc), and can be extended with additional attributes. These attributes could include very
sensitive information such as medical certificates, or important information for the future of
European citizens such as their professional qualifications. The eIDAS regulation foresees the
creation of an ecosystem of public and private entities that will benefit from the Wallet to have
access to certified personal information about citizens.
We welcome the provisions crafted in the legislation, which advocate for strong protections to
preclude tracking and profiling, that enable the option of revealing attributes in a selective
manner or via zero-knowledge attestation, that attribute providers should not learn about with
whom users share their attributes, or that mention that the wallet should allow for unlinkability
when identification is not needed. These are essential to promote the use of technologies that
can provide these properties by design, and we commend the legislators for including them.
Yet, the legislation only enables the existence of privacy-preserving technologies, but does not
mandate them (Article 6a(7a)(b)). We are concerned that this legal ambiguity could lead to a
deterioration of privacy-safeguards that ultimately leaves too much room for technical
implementation on member state level. Importantly, operators of the EDIW can still obtain
knowledge about concrete user behaviour even when the user has not consented to this. With a
privacy-respecting architecture such information is not necessary for the provision of the EDIW.
With the current legal text the architecture of the whole system risks undermining trust from
citizens in the whole system (Article 6a(7)). A fully harmonised European system for the benefit
of the private sector also needs a fully harmonised level of safeguards European citizens can
rely upon. Moreover, relying parties (service providers with access to the wallet) can also
register in any of the Member States, thus the effective regulatory regime that bad actors and
‘Big Tech’ can exploit is the weakest of all Member States as we have seen with the GDPR and
DSA. This is particularly challenging because of the necessity of cross-border interoperability.
Hence, we recommend in Article 46e to empower the European Digital Identity Cooperation
Group to overrule the decisions of national eIDAS regulators in order to prevent the
circumvention of these important protections.
In order to address these concerns and avoid that the eIDAS regulation results in a new privacy
problem with no security gain in terms of authentication, we recommend:
● Make unlinkability a mandatory rather than optional requirement by Replacing “enable”
with “mandate” in Article 6a(7a)(b).
● Align the technical architecture with the strong protections established in the lead
Industry committee of the European Parliament in Article 6a(7).
● Provide a majority in the European Digital Identity Cooperation Group according to
Article 46e the power to overrule the decision of national eIDAS regulators in order to
ensure a harmonised enforcement of this regulation.
Without these necessary amendments the eIDAS regulation risks becoming a gift to Google and
other Big Tech actors. A European solution to the central question of handling sensitive identity
information needs to protect citizens against surveillance capitalism through strong technical
mechanisms and be resilient against attempts to exploit the regulatory system through
Associação de Empresas de Software Open Source Portuguesas (ESOP)
Associação Portuguesa para a Promoção da Segurança da Informação (AP2SI)
Asociatia pentru Tehnologie si Internet (ApTI)
Center for Democracy and Technology
Chaos Computer Club
Council of European Professional Informatics Societies
Defesa dos Direitos Digitais (D3)
Digital Courage
Digitale Gesellschaft
Electronic Frontier Finland (Effi)
Electronic Frontier Foundation (EFF)
Emerald Onion
Entropia e.V.
European Digital Rights (EDRi)
Foundation for Information Policy Research (FIPR)
Homo Digitalis
Innovationsverbund Öffentliche Gesundheit e.V.
Internet Governance Project
Internet Society
Internet Society Catalan Chapter
Internet Society Switzerland Chapter
Internet Society UK Chapter
La Quadrature du Net
Özgür Yazılım Derneği
Petites Singularités
Privacy & Access Council of Canada
Privacy First
SICEH Foundation
The Digital Freedom and Rights Association
The Document Foundation
The Foundation
The Syncthing Foundation
The Tor Project
Trust in Digital Life
Scientists and Researchers
The letter has been signed by 504 scientists and researchers from 39 countries.
Dr. Shaanan Cohney University of Melbourne
Prof. Elena Andreeva TU Wien
Dr. Gaëtan Cassiers Graz University of Technology
Prof. Maria Eichlseder Graz University of Technology
Prof. Daniel Gruss Graz University of Technology
Prof. Martina Lindorfer TU Wien
Univ.-Prof. Dr. Matteo Maffei TU Wien
Univ.-Prof. Dr. René Mayrhofer Johannes Kepler University Linz
Dr. Peter Meerwald-Stadler Universität Salzburg
Dr. Martin Riener TU Wien
Dr. Michael Roland Johannes Kepler University Linz
Dr. Marco Squarcina TU Wien
Univ.-Prof. Dr. Edgar Weippl Universität Wien
Dr. Aysajan Abidin KU Leuven
Prof. Olivier Bonaventure UCLouvain
Prof. Bart Coppens Ghent University
Dr. Lesly-Ann Daniel KU Leuven
Prof. Geert Deconinck KU Leuven
Prof. Claudia Diaz KU Leuven
Dr. Benedikt Gierlichs KU Leuven
Prof. Gregory Lewkowicz Université libre de Bruxelles
Prof. Jan Tobias Muehlberg Universite Libre de Bruxelles, Cybersecurity Research
Dr. Svetla Nikova KU Leuven
Prof. Olivier Pereira UCLouvain
Prof. Thomas Peters UCLouvain
Prof. Bart Preneel KU Leuven
Prof. Jean-Jacques Quisquater UCLouvain
Prof. Florentin Rochet UNamur
Prof. Nigel Smart KU Leuven
Prof. Sophie Stalla-Bourdillon VUB
Prof. François-Xavier Standaert Université catholique de Louvain
Prof. Mathy Vanhoef KU Leuven
Prof. Ingrid Verbauwhede KU Leuven
Dr. Karin Verelst Vrije Universiteit Brussel
Dr. Plixavra Vogiatzoglou KU Leuven Centre for IT & IP Law
Prof. Marcos A. Simplicio Jr. Universidade de São Paulo
Dr. Ian Brown Visiting Professor, Fundação Getulio Vargas
Prof. Emerson Ribeiro de Mello Federal Institute of Santa Catarina
Prof. Frederico Schardong Instituto Federal do Rio Grande do Sul
Dr. Vesselin Bontchev Bulgarian Academy of Sciences
Dr. Konstantin Delchev IMI-BAS
Prof. Diogo Barradas University of Waterloo
Prof. Claude Crépeau McGill University
Prof. Ian Goldberg University of Waterloo
Mr Mark Lizar CEO 0PN Transparency Lab
Prof. Simon Oya The University of British Columbia
Prof. Joel Reardon University of Calgary
Dr. Stacey Watson University of Waterloo
Paul Wouters The Libreswan Project
Prof. Alejandro Hevia Universidad de Chile
Prof. Dr.-Ing. Dirk Kutscher The Hong Kong University of Science and Technology
Czech Republic
Vlad Iliushin ELLIO Technology
Jan Jancar Masaryk University
Prof. Vashek Matyas Masaryk University
Prof. Petr Svenda Masaryk Uninversity
Dr. Martin Ukrop Masaryk University
Prof. Diego F. Aranha Aarhus University
Prof. Carsten Baum Technical University of Denmark
Prof. Ivan Damgård Aarhus University
Prof. Dr. Florian Echtler Aalborg University
Peter Kruse SIE Europe
Prof. Christian Majenz Technical University of Denmark
Prof. Claudio Orlandi Aarhus University
Prof. Peter Scholl Aarhus University
Dr. Shreyas Srinivasa Aalborg University
Prof. N. Asokan University of Waterloo and Aalto University
Prof. Christopher Brzuska Aalto University
Dr. Lars Eggert NetApp
Dr. Lachlan Gunn Aalto University
Prof. Kimmo Halunen University of Oulu
Prof. Antti Honkela University of Helsinki
Dr. Michael Klooß Aalto University
Prof. Russell W. F. Lai Aalto University
Dr. Valérie Berthé CNRS
Dr. Daniele Antonioli EURECOM
Prof. Simone Aonzo EURECOM
Florent Autréau Université Grenoble Alpes
Prof. Jean Claude Bajard Sorbonne Université
Prof. Davide Balzarotti EURECOM
Dr. Gustavo Banegas Independent Researcher
Dr. Sébastien Bardin Université Paris-Saclay, CEA
Dr. Sonia Belaïd CryptoExperts
Prof. Thierry Berger University of Limoges
Mr. Karthikeyan Bhargavan Cryspen
Dr. Bruno Blanchet Inria
Prof. Olivier Blazy Ecole Polytechnique
Dr. Xavier Bonnetain Inria
Dr. Isabelle Le Brun Université grenoble alpes
Dr. Olivier Buffet INRIA
Prof. Sébastien Canard Télécom Paris
Dr. Anne Canteaut Inria
Dr. Thibault Cholez Université de Lorraine
Dr. Véronique Cortier CNRS
Dr. Clément Dallard École Normale Supérieure de Lyon
Dr. Alexandre Debant Inria
CR. Thomas Debris-Alazard Inria
Dr. Daniel Demmler Zama
Dr. Jean-Christophe Deneuville ENAC, Université de Toulouse
Dr. Patrick Derbez Université de Rennes
Dr. Julien Deseigne Emlyon business school
Prof. Matthieu Dien Université de Caen
Dr. Jannik Dreier Université de Lorraine
Dr. Cyril Drocourt Université de Picardie Jules Verne
Dr. Sébastien Duval Université de Lorraine, Loria, CNRS, Inria
Dr. Christoph Egger Université Paris Cité, CNRS, IRIF
Dr. Antonio Faonio EURECOM
Prof. Jessica Feldman American University of Paris
Prof. Barbara Fila IRISA, INSA Rennes
Prof. Caroline Fontaine CNRS
Prof. Aurélien Francillon EURECOM
Dr. Aymeric Fromherz Inria
Prof. Joaquin Garcia-Alfaro Institut Mines-Telecom
Dr. Pierrick Gaudry CNRS
Dr. Louis Gesbert Inria
Dr. Lénaïck Gouriou ENS
Dr. Michaël Hauspie Université de Lille
Dr. Vincent Hugot INSA Centre Val de Loire
Dr. Charlie Jacomme Inria
Dr. Nesrine Kaaniche Telecom SudParis, Institut Polytechnique de Paris
Prof. Marc-Olivier Killijian UQAM/CNRS
Dr. Nadim Kobeissi Symbolic Software
Dr. Adrien Koutsos Inria Paris
Dr. Steve Kremer Inria
Prof. Pascal Lafourcade University Clermont Auvergne (LIMOS)
Dr. Joseph Lallemand CNRS
Philippe Langlois P1 Security
Dr. Vincent Laporte Inria Nancy
Prof. Maryline Laurent Télécom SudParis
Dr. Vincent Lefèvre Inria
MCF Joël Legrand CentraleSupélec
Dr. Gaëtan Leurent Inria
Dc Claire Levallois-Barth IMT Atlantique
Prof. Francoise Levy INRIA
Dr. Benoît Libert Zama
Prof. Nadia EL MRABET Mines Saint Etienne
Prof. (Honorary) Traian MUNTEAN Aix-Marseille Université
Dr. Damien Marion University of Rennes
Dr. Stephan Merz Inria Nancy
Dr. Brice Minaud Inria and ENS-PSL
Dr. Camille Monière Université Bretagne Sud
Dr. María Naya-Plasencia Inria
Prof. Benjamin Nguyen INSA Centre Val de Loire
Dr. Phong Nguyen Inria
Dr. Andrea Oliveri EURECOM
Dr. Charles Olivier-Anclin LIMOS
Dr. Cristina Onete Université de Limoges
Dr. Léo Perrin Inria
Dr. Tamara Rezk INRIA
Dr. Matthieu Rivain CryptoExperts
Dr. Léo Robert Université de Picardie Jules Verne
Dr. Thomas Roche NinjaLab
Prof. Christophe Rosenberger ENSICAEN
Dr. Yann Rotella Université Paris-Saclay
Dr. Merve Sahin
Hervé Schauer HS2
Dr. Jacques André Fines Schlumberger Université Panthéon Assas Paris 2
Dr. André Schrottenloher Inria
Dr. Benjamin Smith Inria and École polytechnique
Dr. Valentin Suder University of Rouen Normandy
Dr. Emmanuel Thomé Inria
Dr. Jean-Pierre Tillich Inria
Dr. Michael Toth
Prof. Yannick Toussaint LORIA
Dr. Alexandre Wallet Inria, Centre de l'Université de Rennes
Prof. Melek Önen EURECOM
Dr. Ali Abbasi CISPA Helmholtz Center for Information Security
Prof. Dr. Florian Adamsky Hof University od Applied Sciences
Prof. Dr. Dr. h.c. Michael Backes CISPA Helmholtz Center for Information Security
Prof. Gilles Barthe Max Planck Institute for Security and privacy (MPI-SP)
Dr.-Ing. Olaf Bergmann Universität Bremen, TZI
Privatdozent Dr. Roland Bless Karlsruhe Institute of Technology
Prof. Dr. Kevin Borgolte Ruhr University Bochum
Prof. Dr.-Ing. Carsten Bormann Universität Bremen, TZI
Dr. Jacqueline Brendel TU Darmstadt
Dr. Samira Briongos NEC Laboratories Europe
Prof. Dr. Stefan Brunthaler uCSRL - FI Code - Universität der Bundeswehr
Dr.-Ing. Jiska Classen Hasso Plattner Institute, University of Potsdam
Prof. Dr. Cas Cremers CISPA Helmholtz Center for Information Security
Dr. Aurore Fass CISPA Helmholtz Center for Information Security
Jens Finkhaeuser Interpeer gUG
Dr. Oliver Gasser Max Planck Institute for Informatics
Dr.-Ing. Stefane Gerdes Universität Bremen, TZI
Dr. Maximilian Golla CISPA Helmholtz Center for Information Security
Dr. Lorenzo Grassi Ruhr-University Bochum
Werner Haas Cyberus Technology GmbH
Prof. Dr. Andreas Heinemann Hochschule Darmstadt / ATHENE - National Research
Center for Applied Cybersecurity
Dr.-Ing. Dominik Helm Technische Universität Darmstadt
Prof. Dr. Dominik Herrmann Otto-Friedrich-Universität Bamberg
Prof. Dr. Peter Hertkorn Hochschule Reutlingen
Prof. Dr. Matthias Hollick TU Darmstadt
Prof. Thorsten Holz CISPA Helmholtz Center for Information Security
Prof. Ralph Holz University of Münster
Dr. Detlef Hühnlein ecsec GmbH
Prof. Dr. Luigi Lo Iacono H-BRS University of Applied Sciences
Dr. Fabian Ising Fraunhofer SIT, FH Münster
Prof. Tibor Jager University of Wuppertal
Dr. Heiko Jakubzik Ruprecht-Karls-Universität Heidelberg
Prof. Dr. Antoine Joux CISPA Helmholtz Center for Information Security
Prof. Dr. Stefan Katzenbeisser University of Passau
Dr. Franziskus Kiefer Cryspen
Jörg Knappen Saarland University
Dr. Konrad Kohbrok Phoenix R&D
Prof. Dr. Christoph Krauß Darmstadt University of Applied Sciences
Dr. Katharina Krombholz CISPA Helmholtz Center for Information Security
Roman Kuznetsov Systola GmbH
Dr. Robert Künnemann CISPA Helmholtz Center for Information Security
Prof. Gregor Leander Ruhr University Bochum
Prof. Anja Lehmann Hasso-Plattner-Institute, University of Potsdam
Dr. Christoph Lenzen CISPA Helmholtz Center for Information Security
Dr. Wouter Lueks CISPA Helmholtz Center for Information Security
Dr. Matthias Minihold Ruhr University Bochum
Prof. Esfandiar Mohammadi University of Lübeck
Dr. Veelasha Moonsamy Ruhr University Bochum
Prof. Dr.-Ing. Jörg Ott Technical University of Munich
Dr. Sebastian Pape Social Engineering Academy
Dr. Giancarlo Pellegrino CISPA Helmholtz Center for Information Security
Prof. Dr. Guenther Pernul University of Regensburg
Prof. Dr. Joachim Posegga University of Passau
Dr. Henrich C. Pöhls University of Passau
Prof. Dr. Kai Rannenberg Goethe University Frankfurt
Dr. Rainer Rehak Weizenbaum Institute for the Networked Society
Prof. Dr. Konrad Rieck Technische Universität Berlin
Prof. Dr. Stefanie Roos University of Kaiserslautern-Landau
Prof. Dr. Christian Rossow CISPA Helmholtz Center for Information Security
Dr.-Ing. Tim Ruffing Blockstream Research
Prof. Dr. Florian E. Sachs University of Cologne
Dr. Martin Schanzenbach Fraunhofer AISEC
Prof. Dr. Sebastian Schinzel Münster University of Applied Sciences and
Fraunhofer SIT and Athene
Prof. Thomas Schneider TU Darmstadt
Dr. Jonas Schneider-Bensch Cryspen
Prof. Dr.-Ing. Thomas Schreck Munich University of Applied Sciences
Prof. Dominique Schröder Friedrich-Alexander Universität Erlangen-Nürnberg
Prof. Dr. Peter Schwabe MPI-SP & Radboud University
Dr. Patrick Schweitzer FernUniversität Hagen
Prof. Dr. Jörg Schwenk Ruhr University Bochum
Prof. Dr. Marcus Schöller Reutlingen University
Dr. Lea Schönherr CISPA Helmholtz Center for Information Security
PD Dr. Karsten Sohr Center for Computing Technologies at the University of
Dr.-Ing. Ben Stock CISPA Helmholtz Center for Information Security
Prof. Dr. Thorsten Strufe KIT and CeTI TU-Dresden
Dr. Nils Ole Tippenhauer CISPA Helmholtz Center for Information Security
Dr. Oleksandr Tkachenko DFINITY
Prof. Dr. Peter Trapp Hochschule München
Dr.-Ing. Amos Treiber
Dr.-Ing. Tobias Urban Westphalian University of Applied Sciences & Institute
for Internet Security
Dr. Anjo Vahldiek-Oberwagner Intel Labs
Prof. Jilles Vreeken CISPA Helmholtz Center for Information Security
Dr. Christiane Weis NEC Laboratories Europe (views are my own)
Prof. Dr. Matthias Wählisch TU Dresden
Prof. Dr. Yuval Yarom Ruhr University Bochum
Prof. Stefanos Gritzalis University of Piraeus
Prof. Sotiris Ioannidis Technical University of Crete
Prof. Christos Kalloniatis University of the Aegean
Prof. Georgios Kambourakis University of the Aegean
Prof. Spyridon Kokolakis University of the Aegean
Prof. Costas Lambrinoudakis University of Piraeus
Hong Kong SAR, China
Dr. Xavier de Carné de Carnavalet The Hong Kong Polytechnic University
Dr. Balazs PEJO CrySyS Lab
Mr. Stefán Jökull Sigurðarson Have I Been Pwned Contributor, Microsoft MVP
Prof. Thomas Welsh University of iceland
Dr. Stephen Farrell Trinity College Dublin
Dr. Aikaterini Kanta University College Dublin
Prof. Douglas Leith Trinity College Dublin
Prof. David Malone Maynooth University
Dr. TJ McIntyre University College Dublin, Sutherland School of Law
Dr. Hazel Murray Munster Technological University
Dr. Kris Shrishak Irish Council for Civil Liberties
Prof. Orr Dunkelman Computer Science Dept. and the Center for Cyber,
Law and Policy at the University of Haifa
Dr. Eyal Ronen Tel Aviv University
Dr. Mahmood Sharif Tel Aviv University
Prof. Alessandro Barenghi Politecnico di Milano
Dr. Antonia Bezenchek INFORMAPRO, Rome
Prof. Carlo Blundo University of Salerno
Dr. Daniele Cono D'Elia Sapienza University of Rome
Dr. Matteo Dell'Amico University of Genoa
Dr. Salvatore Manfredi Fondazione Bruno Kessler
Dr. Emmanuela Orsini Bocconi University
Prof. Stefano Paraboschi University of Bergamo
Prof. Silvio Ranise Università di Trento and Fondazione Bruno Kessler,
Filippo Valsorda
Prof. Daniele Venturi Sapienza University of Rome
Prof. Ivan Visconti University of Salerno
Prof. Stefano Zanero Politecnico di Milano
Prof. Masayuki Hatta Surugadai University
Dr. Octavio Perez Kempner NTT Social Informatics Laboratories
Prof. Toshimaru Ogura JCA-NET
Prof. Kazue Sako Waseda University
Dr. Mehdi Tibouchi NTT Social Informatics Laboratories
Dr. Pēteris Paikens University of Latvia
Prof. Giovanni Apruzzese University of Liechtenstein
Dr. Afonso Arriaga University of Luxembourg
Prof. Gilbert Fridgen University of Luxembourg
Dr. Dmitry Khovratovich Ethereum Foundation
Dr. Baptiste Lambin University of Luxembourg
Dr. Johannes Müller University of Luxembourg
Dr. Claudia Negri-Ribalta President of OptIA and researcher at the University of
Dr. Peter Roenne University of Luxembourg
Prof. Peter Y A Ryan University of Luxembourg
Dr. Johannes Sedlmeir Interdisciplinary Centre for Security, Reliability and
Trust, University of Luxembourg
Loganaden Velvindron
New Zealand
Dr. Vladimir Mencl Research and Education Advanced Network New
Prof. Anamaria Costache NTNU
Prof. Kristian Gjøsteen NTNU
Prof. Nils Gruschka University of Oslo
Prof. Tjerand Silde Norwegian University of Science and Technology
Prof. Iain Sutherland Noroff University College
Prof. Mohsen Toorani University of South-Eastern Norway
Prof. Dr. Michael Welzl University of Oslo
Prof. Miroslaw Kutylowski NASK - National Research Institute
Prof. Manuel Barbosa Faculty of Science of the University of Porto
Sofia Celi Brave
Prof. Alex Davidson Universidade NOVA de Lisboa
Prof. Kevin Gallagher NOVA School of Science and Technology
Prof. Nuno Santos INESC-ID / Instituto Superior Técnico, University of
Prof. Thomas Peyrin Nanyang Technological University
Prof. Marko Hölbl University of Maribor, Faculty of Electrical Engineering
and Computer Science
Dr. Jorge Blasco Alis Universidad Politécnica de Madrid
Dr. Juan Caballero IMDEA Software Institute
Dr. Ignacio Cascudo IMDEA Software Institute
Prof. Jordi Domingo Universitat Politècnica de Catlaunya (UPC
Prof. Josep Domingo-Ferrer Universitat Rovira i Virgili
Prof. Luis Fernández-Sanz Universidad de Alcalá
Dr. Dario Fiore IMDEA Software Institute
Prof. José María de Fuentes Universidad Carlos III de Madrid
Dr. David Arroyo Guardeño Spanish National Research Council
Prof. Marco Guarnieri IMDEA Software Institute
Dr. Jordi Herrera-Joancomartí Universitat Autònoma de Barcelona
Prof. Lorena González Manzano Universidad Carlos III de Madrid
Dr. Pedro Moreno-Sanchez IMDEA Software Institute
Dr. Gorka Guardiola Múzquiz Universidad Rey Juan Carlos
Prof. Antonio Nappa UC3M Madrid
Prof. Jose A. Onieva University of Malaga
Dr. Sergio Pastrana University Carlos III de Madrid
Prof. Fernando Pérez-González University of Vigo
Prof. Ricardo J. Rodríguez Universidad de Zaragoza
Dr. Carla Ràfols Universitat Pompeu Fabra
Prof. Enrique Soriano-Salvador Universidad Rey Juan Carlos
Dr. Guillermo Suarez-Tangil IMDEA Networks Institute
Prof. Juan Tapiador Universidad Carlos III de Madrid
Dr. Ida Tucker Indra
Prof. Narseo Vallina-Rodriguez IMDEA Networks Institute
Prof. María Isabel González Vasco Universidad Carlos III de Madrid
Dr. Michele Cascella Lund University
Dr. Felix Engelmann Lund University
Prof. Dr.-Ing. Meiko Jensen Karlstad University
Dr. Leonardo Martucci Karlstad University
Dr. Tobias Pulls Karlstad University
Prof. David Basin ETH Zurich
Dr. ir. Bram Bonné Google
Prof. Christian Cachin University of Bern
Prof. Srdjan Capkun ETH Zurich
Antonios Chariton
Dr. Anastasija Collen University of Geneva
Dr. Aisling Connolly DFINITY
Dr. Olivier Crochat EPFL
Dr. Damien Desfontaines Tumult Labs (views my own)
Prof. Bryan Ford EPFL
Dr. Tommaso Gagliardoni Kudelski Security (views are my own)
Dr. Giacomo Giuliari ETH Zurich
Prof. Dr. Christian Grothoff Bern University of Applied Sciences
Prof. Andreas Habegger Bern University of Applied Sciences
Dr. Harry Halpin Nym Technologies
Prof. Jean-Pierre Hubaux EPFL
Prof. Lukas Ith Bern University of Applied Sciences
Prof. Ralf Jung ETH Zurich
Prof. Marc Langheinrich Università della Svizzera italiana (USI)
Prof. Dr. Annett Laube-Rosenpflanzer Bern University of Applied Science (BFH)
Dr. Markus Legner Mysten Labs
Prof. Rebekah Overdorf University of Lausanne
Prof. Kenneth Paterson ETH Zurich
Prof. Mathias Payer EPFL
Prof. Dr. Adrian Perrig ETH Zürich
Prof. Kaveh Razavi ETH Zurich
Dr. Raphael M. Reischuk National Test Institute for Cybersecurity; Zühlke
Engineering AG
Prof. Dr. Kenneth A. Ritley Bern University of Applied Sciences
Dr. Lutz Rosenpflanzer Berne University of Applied Sciences / BFH
Dr. Benjamin Rothenberger Zühlke
Dr. Alessandro Sorniotti IBM Research Europe (views are my own)
Prof. Carmela Troncoso EPFL
Dr. Piet De Vaere ETH Zürich
Dr. Rob van Weelderen CERN
Dr. Taras Zakharko University of Zurich
Dr. Matthias Kannwischer
The Netherlands
Dr. Gunes Acar Radboud University
Dr. Luca Allodi TU Eindhoven
Dr. Greg Alpár Open University of the Netherlands
Prof. Dr. H. Bos VUSec / Vrije Universiteit Amsterdam
Dr. Léo Colisson CWI
Dr. Andrea Continella University of Twente
Prof. Joan Daemen Radboud University
Prof. Sandro Etalle Eindhoven Technical University
Dr. Simona Etinski Centrum Wiskunde & Informatica
Dr. Seda Gurses TU Delft
Prof. Dr. Jaap-Henk Hoepman Radboud University / University of Groningen /
Karlstad University
Prof. Andreas Hülsing Eindhoven University of Technology
Dr. Ralph Koning University of Amsterdam
Dr. Matthijs Koot University of Amsterdam
Prof. Dr. Tanja Lange Eindhoven University of Technology
Drs. Jaap van der Straaten MBA Chief Executive Officer Civil Registration Centre for
Dr. Luca Mariot University of Twente
Prof. Giovane C. M. Moura TU Delft
Dr. Simona Samardjiska Radboud University
Prof. Christian Schaffner University of Amsterdam
Dr. Savio Sciancalepore TU Eindhoven
Prof. Georgios Smaragdakis Delft University of Technology (TU Delft)
Dr. Monika Trimoska Eindhoven University of Technology
Dr. Jeroen van der Ham-de Vos University of Twente
Dr. Yury Zhauniarovich TU Delft
Prof. Cihangir Tezcan Middle East Technical University
United Arab Emirates
Prof. Christina Pöpper New York University Abu Dhabi
United Kingdom
Prof. Martin Albrecht King's College London
Prof. Ross Anderson Universities of Edinburgh and Cambridge
Prof. David Aspinall University of Edinburgh
Prof. Ioana Boureanu Surrey Centre for Cyber Security, University of Surrey
Prof. Achim Brucker University of Exeter
Prof. Lorenzo Cavallaro University College London
Dr. Giovanni Cherubin Microsoft
Prof. Tom Chothia University of Birmingham
Dr. Michele Ciampi The University of Edinburgh
Dr. Richard Clayton University of Cambridge
Dr. Kovila Coopamootoo King's College London
Ray Corrigan The Open University
Dr. Elizabeth Crites University of Edinburgh
Prof. Jon Crowcroft University of Cambridge
Prof. Simon Dobson University of St Andrews
Dr. Benjamin Dowling The University of Sheffield
Dr. Tariq Elahi University of Edinburgh
Prof. Hamed Haddadi Imperial College London
Dr. Neil Hanley Queen's University Belfast
Mr Scott Helme Independent Security Researcher
Dr. Michio Honda School of Informatics, University of Edinburgh
Prof. Alice Hutchings University of Cambridge
Dr. Rikke Bjerg Jensen Royal Holloway, University of London
Dr. Philipp Jovanovic University College London
Dr. Marc Juarez University of Edinburgh
Prof. Vasilis Katos BU-CERT, Bournemouth University
Prof. Aggelos Kiayias University of Edinburgh
Prof. Markulf Kohlweiss University of Edinburgh
Prof. Douwe Korff Emeritus professor London Metropolitan University
Prof. Andrew Martin University of Oxford
Prof. Sarah Meiklejohn University College London
Prof. Andrew W Moore University of Cambridge
Alec Muffett Security Consultant
Prof. Steven J. Murdoch University College London
Dr. David Nadlinger University of Oxford
Prof. Bill Buchanan OBE Edinburgh Napier University
Dr. Oleksii Oleksenko Azure Research
Dr. Colin Perkins University of Glasgow
Dr. Fabio Pierazzi King's College London
Dr. Sasa Radomirovic University of Surrey
Prof. Kasper Rasmussen University of Oxford
Prof. Moritz Riede University of Oxford
Dr. Luc Rocher University of Oxford
Prof. Steve Schneider Surrey Centre for Cyber Security, University of Surrey
Dr. Andrei Serjantov
Dr. Siamak Shahandashti University of York
Prof. Peter Sommer Birmingham City University
Dr. Ian Stark The University of Edinburgh
Dr. Yiannis Tselekounis Royal Holloway, University of London
Prof. Dr. Luca Viganò King's College London
Dr. Mikhail Volkhov The University of Edinburgh
Dr. Christian Weinert Royal Holloway, University of London
Prof. Alan Woodward Surrey Centre for Cyber Security, University of Surrey
United States of America
Dr. Clément Aubert Augusta University
Prof. Lujo Bauer Carnegie Mellon University
Prof. Joseph Bonneau New York University
Prof. Mahdi Cheraghchi University of Michigan
Dr. Omar Haider Chowdhury Stony Brook University
Prof. Nicolas Christin Carnegie Mellon University
Prof. Lorrie Cranor CyLab Security and privacy Institute, Carnegie Mellon
Prof. Álvaro Cárdenas UCSC
Prof. Sanchari Das University of Denver
Prof. Zakir Durumeric Stanford University
Arthur Edelstein
Dr. Christina Garman Purdue University
Dr. Joseph Lorenzo Hall Internet Society
Prof. Umar Iqbal Washington University in St. Louis
Prof. Gabriel Kaptchuk Boston University
Mallory Knodel Internet Research Steering Group member
Prof. Susan Landau Tufts University
Dr. Per Larsen Immunant, Inc.
Prof. Milton L Mueller Georgia Institute of Technology
Prof. Adwait Nadkarni William & Mary
Prof. Nick Nikiforakis Stony Brook University
Prof. Riccardo Paccagnella Carnegie Mellon University
Christopher Patton
Prof. Michalis Polychronakis Stony Brook University
Dr. Niels Provos
Prof. Amir Rahmati Stony Brook University
Prof. Aanjhan Ranganathan Northeastern University
Prof. Ronald L. Rivest MIT
Prof. Mike Rosulek Oregon State University
Dr. Phillipp Schoppmann Google
Dr. Sergi Delgado Segura Chaincode Labs
Prof. Hovav Shacham The University of Texas at Austin
Prof. Micah Sherr Georgetown University
Dr. David Sidi The University of Arizona & Yale University
Prof. Michael A. Specter Georgia Tech
Prof. Deian Stefan University of California San Diego
Prof. Santiago Torres-Arias Purdue University
Prof. Blase Ur University of Chicago
Prof. Matthew Wright Rochester Institute of Technology
Dr. Pieter Wuille Chaincode Labs
Prof. Daniel Zappala Brigham Young University
Signing the letter
If you are a scientist or researcher and want to sign please fill out this form hosted by the Chaos
Computer Club of Vienna (PhD or demonstrated research track record required).
If you are a representative of an NGO, you can sign via adding your organisation to this
spreadsheet also hosted by the Chaos Computer Club of Vienna.


Testo del 2023-11-09 Fonte: Patrick-Breyer


i commenti sono anonimi e inviati via mail e cancellati dopo aver migliorato la voce alla quale si riferiscono: non sono archiviati; comunque non lasciare dati particolari. Si applica la privacy policy.

Ricevi gli aggiornamenti su Patrick-Breyer: the european digital identity in the new Eidas undermines browsers and the web e gli altri post del sito:

Email: (gratis Info privacy)

Nota: il dizionario è aggiornato frequentemente con correzioni e giurisprudenza