Carlo Mazzocca

In a world where digitalization is reshaping every aspect of society, digital identity has become more crucial than ever to establish trust and accountability across all entities, whether human, organizational, or machine-based. Numerous initiatives are emerging worldwide, such as the United States mobile driver’s license (mDLs) and Singapore’s National Digital Identity (NDI). In May 2024, the European Union introduced Regulation 2024/1183, establishing the European Digital Identity Framework. By 2026, this framework will provide all European citizens with a European Digital Identity Wallet (EUDIW), allowing them to access both online and offline public and private services while maintaining full control over their data. Individuals can selectively disclose only the required information to access services. However, the current EUDIW design relies on Selective Disclosure for JSON Web Token (SD-JWT), which does not fully meet the privacy requirements outlined in the regulation. This paper presents a comprehensive comparison of the main selective disclosure mechanisms. Specifically, we identify relevant threat models, formalize associated security and privacy properties, and assess the extent to which existing mechanisms satisfy these properties in mitigating the identified threats. Furthermore, we introduce an open-source benchmark that evaluates multiple selective disclosure across key performance indicators, including computational latency, bandwidth consumption, and storage requirements.

Digital identity has always been one of the keystones for implementing secure and trustworthy communications among parties. The ever-evolving digital landscape has undergone numerous technological transformations that have profoundly reshaped digital identity management, leading to a major shift from centralized to decentralized identity models. The latest stage of this evolution is represented by the emerging paradigm of Self-Sovereign Identity (SSI), which gives identity owners full control over their data. SSI leverages Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs), which have been recently standardized by theWorldWideWeb Consortium (W3C). These technologies have the potential to build more secure and decentralized digital identity systems, significantly strengthening communication security in scenarios involving many distributed participants. It is worth noting that use of DIDs and VCs is not limited to individuals but extends to a wide range of entities including cloud, edge, and Internet of Things (IoT) resources. However, due to their novelty, existing literature lacks a comprehensive survey on DIDs and VCs beyond the scope of SSI. This paper fills this gap by providing a comprehensive overview of DIDs and VCs from multiple perspectives. It identifies key security threats and mitigation strategies, analyzes available implementations to guide practitioners in making informed decisions, and reviews the adoption of these technologies across various application domains. Moreover, it also examines related regulations, projects, and consortiums emerging worldwide. Finally, it discusses the primary challenges hindering their real-world adoption and outlines future research directions.

Federated learning (FL) enables collaborative training of a machine learning (ML) model across multiple parties, facilitating the preservation of users’ and institutions’ privacy by maintaining data stored locally. Instead of centralizing raw data, FL exchanges locally refined model parameters to build a global model incrementally. While FL is more compliant with emerging regulations such as the European General Data Protection Regulation (GDPR), ensuring the right to be forgotten in this context—allowing FL participants to remove their data contributions from the learned model—remains unclear. In addition, it is recognized that malicious clients may inject backdoors into the global model through updates, e.g., to generate mispredictions on specially crafted data examples. Consequently, there is the need for mechanisms that can guarantee individuals the possibility to remove their data and erase malicious contributions even after aggregation, without compromising the already acquired “good” knowledge. This highlights the necessity for novel federated unlearning (FU) algorithms, which can efficiently remove specific clients’ contributions without full model retraining. This article provides background concepts, empirical evidence, and practical guidelines to design/implement efficient FU schemes. This study includes a detailed analysis of the metrics for evaluating unlearning in FL and presents an in-depth literature review categorizing state-of-the-art FU contributions under a novel taxonomy. Finally, we outline the most relevant and still open technical challenges, by identifying the most promising research directions in the field.