The open letter from Mozilla (https://blog.mozilla.org/netpolicy/files/2023/11/eIDAS-Industry-Letter.pdf https://blog.mozilla.org/netpolicy/files/2023/11/eIDAS-

The open letter from Mozilla (https://blog.mozilla.org/netpolicy/files/2023/11/eIDAS-Industry-Letter.pdf https://blog.mozilla.org/netpolicy/files/2023/11/eIDAS-Indus...) has a very different tone: "Articles 45 and 45a of the proposed eIDAS provisions are likely to weaken the security of the Internet as a whole. These articles mandate that all Web browsers recognize a new form of certificate for the purposes of authenticating websites. *The current language is imprecise, and this risks being interpreted as requiring that browsers recognize the certificate authorities that each EU member state appoints for the purposes of authenticating the domain name of websites.*" If I look at the public draft from 2021 (available on the EC website, or the annotated version from an awesome Dutch man: https://timspeelman.nl/eidas/#A45(2) https://timspeelman.nl/eidas/#A45(2)) I see the problem: " 2.Qualified certificates for website authentication referred to in paragraph 1 shall be recognised by web-browsers. For those purposes web-browsers shall ensure that the identity data provided using any of the methods is displayed in a user friendly manner. Web-browsers shall ensure support and interoperability with qualified certificates for website authentication referred to in paragraph 1, with the exception of enterprises, considered to be microenterprises and small enterprises in accordance with Commission Recommendation 2003/361/EC in the first 5 years of operating as providers of web-browsing services. " For those unfamiliar with the concepts behind eIDAS 2.0: the system consists of: * A wallet which is owned by a person and contains their potentially sensitive personal information in the form of signed attributes. * Relying Parties; these are organizations which are allowed to request attributes from a user's wallet and who are able to verify the attributes. Often known as "verifiers". * Attribute Providers; these are organizations which provide the signed attributes. Think the driving license authority. One important aspect is that Relying Parties are regulated; they have to have permission to be able to request certain attributes from a user's wallets. In order for this to technically work, this means that they must be able to authenticate themselves to the user's wallet. Now, the user's wallet can be browser based. In which case the website needs to authenticate itself to the browser (the wallet!!) to prove that it is allowed request the attributes. So here we are: the text of the regulation exists because an "EU Wallet Trust Store" is required in all internet browsers, otherwise the system won't work. The problem being that the actual text does not make this explicit - it is open for an interpretation whereby the TLS layer also falls under the regulation. It sounds to me like a huge stretch, however there are enough instances where a law is poorly interpreted to make this something which should be avoided. Now for the bear in the woods: Mozilla claim in other places that THE TEXT HAS CHANGED. This is both a massive and very worrying claim. It's also extremely strange that Mozilla do not mention this in their letter? So what's up. Mozilla need to leak the current draft text ASAP so that we can see what the exact problem is and so that we can help legislators fix the issue.