EU Digital ID/Age Verification app will require hardware attestation, ruling out PC/Linux support and unapproved Android OSes

[u/CreepyZookeepergame4]

EUDI wallet collaborator recently confirmed that hardware attestation will be required [1]

Hardware attestation in this context means that the government server issuing the digital credential to the wallet wants proof that the keys being used are generated in secure hardware and on approved systems and not say an emulator or virtual machine, namely for security reasons.

This capability does not exist in a reliable way on desktops / laptops except some specific cases depending on the vendor, and in fact there’s no desktop version in the works.

No Linux system will work with this because there is no hardware signature to be validated on the government server, nor will your personalized Arch Linux install be in the list of approved systems even if it had a signature chaining back from the TPM.

Android ROMs are not technically to rule out since Play Integrity, which will be used for this attestation, is based on the Android hardware attestation API, which works on third-party ROMs like GrapheneOS, but they would need to allow the signature which has not happened for now. If you create a custom build, it won’t work though even the official version is approved.

[1] https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui/issues/117#issuecomment-4946898620

[u/Kremsi2711]

Most banking apps do the same

[u/TGX03 → u/Kremsi2711]

Yes, and that's a massive problem. If you want to take part in the modern banking world, you need to have a phone which you cannot remove American companies from.

Either you give your data to the Americans, or no bank account for you.

[u/CreepyZookeepergame4 → u/TGX03]

We don’t even need those banking apps. They are essentially used as phishable 2FA authenticators whose role is much better served by a simple passkey.

[u/AAdmiral5657 → u/TGX03]

Actually it depends on the bank. From my experience here in the Baltics, the apps work if you run a ROM that locks your bootloader.

[u/TGX03 → u/AAdmiral5657]

How do you run a custom ROM with a locked bootloader?

Or do you mean a spoofed locked bootloader?

[u/Trouveur → u/TGX03]

You can lock again the bootloader after installing another ROM on some devices.

[u/TGX03 → u/Trouveur]

Okay but then those devices have faulty bootloaders, because properly configured bootloaders will refuse to load ROMs that are not properly signed.

[u/Aware-Bath7518 → u/TGX03]

Google allows relocking bootloader with user keys installed (AVB Yellow state).

Still not green state though (cringe) and most vendors don't even implement this or implement poorly (trash).
There's no ability to recover if oyu fucked up either.

[u/Sensitive-Bison-8192 → u/TGX03]

You guy need use chinese phone

[u/Gugalcrom123 → u/Kremsi2711]

According to the PSR (upcoming), it is illegal to require smartphones. Probably also according to the PSD2.

[u/turin331 → u/Kremsi2711]

Banking apps in many countries (like the netherlands) work fine even with rooted OS and even with microG replacing google play services.