[論文レビュー] Self-Sovereign Identity and eIDAS 2.0: An Analysis of Control, Privacy, and Legal Implications

Nacereddine Sitouah, Marco Esposito+1 more|arXiv (Cornell University)|Jan 27, 2026

Privacy, Security, and Data Protection被引用数 1

ひとこと要約

この論文は、Self-Sovereign Identity (SSI) の原則がEUの eIDAS 2.0 Architecture Reference Framework (ARF) とどのように整合するかを分析し、適合性のギャップを特定し、欧州デジタルIDエコシステム内でSSIの適合性を高める実用的な調整を提案します。

ABSTRACT

European digital identity initiatives are grounded in regulatory frameworks designed to ensure interoperability and robust, harmonized security standards. The evolution of these frameworks culminates in eIDAS 2.0, whose origins trace back to the Electronic Signatures Directive 1999/93/EC, the first EU-wide legal foundation for the use of electronic signatures in cross-border electronic transactions. As technological capabilities advanced, the initial eIDAS 1.0 framework was increasingly criticized for its limitations and lack of comprehensiveness. Emerging decentralized approaches further exposed these shortcomings and introduced the possibility of integrating innovative identity paradigms, such as Self-Sovereign Identity (SSI) models. In this article, we analyse key provisions of the eIDAS 2.0 Regulation and its accompanying recitals, drawing on existing literature to identify legislative gaps and implementation challenges. Furthermore, we examine the European Digital Identity Architecture and Reference Framework (ARF), assessing its proposed guidelines and evaluating the extent to which its emerging implementations align with SSI principles.

研究の動機と目的

• Consolidate SSI properties into an evaluation framework aligned with eIDAS 2.0.
• Develop criteria for systematic SSI-compliance assessment against ARF and GDPR.
• Perform a property-by-property comparison of centralized vs. decentralized identity technologies under eIDAS 2.0.
• Apply the evaluation framework to eIDAS 2.0 and its ARF to identify tensions and gaps.
• Offer technical and regulatory recommendations to strengthen SSI-aligned implementations in the European Digital Identity ecosystem.

提案手法

• Synthesize SSI property frameworks from multiple sources into a unified evaluation criteria set.
• Conduct a normative and analytical comparative analysis of SSI properties versus eIDAS 2.0 ARF requirements.
• Use a structured, property-by-property compliance approach to assess alignment and gaps.
• Apply findings to a real-life SSI lifecycle scenario to illustrate control, privacy, and governance considerations.
• Propose targeted technical and regulatory adjustments to improve SSI compatibility with GDPR and ARF.

Figure 1: Identity, Security and Privacy trifecta for an IDMS.

実験結果

リサーチクエスチョン

• RQ1 RQ1: To what extent are SSI principles compatible with the eIDAS 2.0 Architecture Reference Framework?
• RQ2 RQ2: What technical or regulatory modifications could improve alignment with GDPR and ARF requirements while preserving SSI principles?
• RQ3 RQ3: Which challenges arise specifically from misalignments between distributed ledger technologies and existing regulations?

主な発見

• eIDAS 2.0 ARF and EUDIW provisions introduce centralized trust elements (e.g., trusted providers and PIDs) that can constrain true SSI sovereignty and user control.
• The legal requirement for unique government-issued PIDs and reliance on designated EUDIW endpoints challenge autonomous, decentralized identity representations.
• Gaps exist where SSI properties like existence, representation, and self-sovereign control are not fully supported by current ARF/Regulation, raising sovereignty and privacy concerns.
• Privacy-enhancing techniques (PETs) are discussed in literature but may not meet eIDAS 2.0 privacy requirements when implemented in practice, signaling a need for careful regulatory alignment.
• The study proposes concrete recommendations to allow anonymous/pseudonymous identifiers, enable autonomously generated DIDs in wallet hardware, and decouple PID validity from all wallet services to preserve digital representation and user control.
• The analysis highlights the risk of over-centralization in EUDIW governance and recommends design choices that maintain transparency, interoperability, and user empowerment.

Figure 2: eIDAS 2.0 Time Line Summary Until Adoption