hlr-10-issuing-a-pid-or-attestation-to-a-wallet-part-2

To issue PIDs and attestations to an EUDI Wallet securely, you must implement privacy risk mitigations, establish reuse policies, and enforce attestation-signing certificate profiles compliant with ARF Annex 2 and ETSI standards.

When issuing attestations to a wallet, you can apply once-only, limited-time, rotating-batch, or per-relying party reuse policies to control presentation and prevent unauthorized data correlation across sessions.

Batch issuance prevents linkability in EUDI Wallets by generating rotating-batch attestations, mitigating privacy risks and ensuring that multiple presentations cannot be easily correlated by relying parties.

Yes, you need specific attestation-signing certificate profiles compliant with ETSI standards and ARF Annex 2 to ensure the cryptographic validity and trust of issued PIDs and attestations.

The best way to manage PID re-issuance without compromising privacy is to utilize rotating-batch and per-relying party methods, which actively mitigate linkability and prevent unauthorized data correlation during re-issuance.

You should use per-relying party attestations instead of once-only attestations when you need to prevent cross-service linkability, ensuring that a relying party receives a unique attestation to strictly mitigate data correlation risks.