The recently completed DC4EU project investigated how the digital identity wallet and “verifiable credentials” (digitally verifiable certificates/documents) can work in practice across borders.
Europe is on the verge of a fundamental change in the way citizens identify themselves digitally and use official documents. With the revision of the eIDAS regulation, the European Union aims to evolve toward a uniform digital identity wallet for all citizens.
“By the end of 2026, all member states must make a digital identity wallet available to their citizens,” says Fabien Petitcolas, Information Security Specialist at Smals Research during a ResearchTalk. Belgium is among the frontrunners with MyGov.be, the national implementation of that European Digital Identity Wallet.
The European pilot project DC4EU tested the digital wallet and associated “verifiable credentials” on a large scale. Smals worked with 80 other European partners on this project. Petitcolas looks back on the lessons from that project and outlines how digital identities are taking shape in Europe.
eIDAS as a starting point
“In 2014, Europe introduced the eIDAS regulation, which formed the regulatory framework for online trust services and later also online identity,” Petitcolas notes. The initial eIDAS aimed to create common rules for electronic identification and signatures among all European member states. But due to rapid technological developments, the regulation had to evolve.
Digital identity wallet
“Ten years after the first eIDAS regulation, a revision was implemented in which Europe pushed for a Digital Identity Wallet,” says Petitcolas. This wallet includes the digital version of your identity card and driver’s license, as well as other documents such as deeds and certificates.
All European citizens will be able to have a digital version of their physical wallet.
Fabien Petitcolas, Information Security Specialist at Smals Research
The regulation states that all European member states must make a digital wallet available to their citizens by the end of 2026. Belgium has already done its homework. In May 2024, FPS BOSA, the federal public service for Policy and Support, announced a digital identity wallet: MyGov.be. This mobile application is free to download via Google Play or the Apple App Store. Smals, the ICT service provider for the Belgian government, worked behind the scenes on the application.
DC4EU project
“DC4EU (Digital Credentials for Europe) is one of the four pilot projects funded by the European Union under the eIDAS regulation,” Petitcolas begins. The DC4EU project has since been completed and aimed to test the digital wallet and “verifiable credentials” on a large scale in realistic scenarios.
Petitcolas: “The project focused primarily on two aspects: education and social security. More specifically, for the latter, the European Health Insurance Card and portable A1 documents for people working abroad were highlighted. With these documents, European citizens can access healthcare in other EU countries.”
The pilot project was supported by 80 partners across Europe, including Smals and the Belgian Crossroads Bank for Social Security. The National Social Security Office was also involved as an issuer of A1 certificates. “The project is a first step in the evolution of the use of these digital wallets,” says Petitcolas.
Chain of trust
Petitcolas emphasizes that the chain of trust plays a crucial role in the European system of digital identities. “Take the example of an A1 form for a Belgian person being checked in Germany by the local labor inspectorate. That document is issued by the NSSO in Belgium.” That institution is, in turn, recognized at the European level within a common trust infrastructure.
“When a check takes place in Germany, that country does not need to trust the Belgian institution directly,” he continues. “It relies on the European level, which confirms that the NSSO is authorized to issue this document.”
This creates a layered chain of trust from national issuance through European recognition to cross-border control, meaning countries do not have to make separate bilateral agreements. According to Fabien, this is no longer a technical stumbling block: the standards and infrastructure exist; the real challenge lies in organizing trust and aligning processes between member states.
Verifiable credentials
The digital identity wallet is based on the principle of verifiable credentials. These are digital and cryptographically secured versions of physical certificates that can prove something about a person, “while keeping the information released to a minimum,” Petitcolas explains. Examples include your identity, driver’s license, certificates, or, for instance, the A1 certificate.
Everything that exists on paper today can, in principle, exist as a verifiable credential.
Fabien Petitcolas, Information Security Specialist at Smals Research
These verifiable credentials were extensively tested in practice by Smals and other partners in the DC4EU project. According to Petitcolas, these digital certificates essentially do the same as their paper counterparts, but with additional advantages (and disadvantages).
Privacy guaranteed
According to Petitcolas, the digital wallet could be a step forward in terms of privacy. One of the potential privacy benefits is that users cannot be linked to their data. Petitcolas explains: “The idea would be that when you need to prove on a website that you are over 18, you can confirm that with your ‘verifiable credential’ identity card. If you visit that same website again later, you will have to prove it each time.” The website is therefore unable to determine if that person is the same one.
“Another aspect mentioned in the European regulations is ‘selective disclosure’,” Petitcolas continues. “An identity card contains information such as your name and ID number. Let’s take the age verification example again. You want to prove you are over 18, but without revealing data such as your name and date of birth. Selective disclosure allows you to prove only that you are over 18, without providing extra information.”
“Although the implementation is not yet here today, the ‘verifiable credentials’ standards do allow for these privacy benefits.”
Foundation laid
The DC4EU project has now been completed and represents a major milestone in the development of digital identity wallets. “The project has made progress and cleared up many issues,” says Petitcolas. According to him, these insights ensure that more and more institutions will consider offering verifiable credentials via the digital wallet. This raises a practical question: “Are they going to do this themselves, or are they going to engage another company/entity to do it for them?”
According to Petitcolas, there is a clear role for Smals there. Thanks to its knowledge of the technology and underlying standards, Smals could guide institutions through their applications and support them in issuing verifiable credentials in the BOSA wallet.
The DC4EU project has provided Smals not only with technical experience but also with a broader perspective on the functioning and impact of digital wallets. According to Petitcolas, this experience forms a solid basis for further shaping future applications and expansions of digital identity solutions.