Secure Issuance of the Swiss E-ID: Advancing Security and Rollout Together

The postponement of the Swiss E-ID shows how quickly the threat landscape is evolving as a result of deepfakes and AI-enabled attacks. DIDAS therefore proposes strengthening identity verification within the existing swiyu trust infrastructure and developing it into an evolvable Secure Issuance Architecture.

The delay in the introduction of the Swiss E-ID due to new security requirements does not, from the perspective of DIDAS, call the fundamental trust architecture into question. Rather, it demonstrates that the security mechanisms used during issuance must be able to evolve continuously as threats change.

The new DIDAS Community Position Paper therefore proposes further developing the existing architecture into an end-to-end Secure Issuance Architecture with hardened identity verification.

At the core of the approach are three complementary identity verification paths:

• a fully automated remote path based on biometric identity documents and NFC,
• a hybrid remote verification process combining automated controls with additional expert review,
• and in-person identity verification at a passport office or another designated authority or location.

All three paths should lead into the same issuance process and be governed by the same fundamental trust and security principles.

DIDAS explicitly does not recommend introducing an E-ID with a reduced level of security. This should be clearly distinguished from credentials with a reduced set of attributes, such as an age credential, proof of personhood, or proof of nationality. The underlying identity verification can remain at the same level, while the later use of such credentials does not require unnecessary identifying attributes to be disclosed.

A central principle of the paper is the separation between a stable trust architecture and evolvable security mechanisms.

AI-enabled attacks and future technological developments should be addressed by continuously adapting the relevant security components, without repeatedly redesigning the fundamental principles of the Swiss E-ID and the swiyu trust infrastructure.

This modular approach allows security mechanisms to evolve faster than laws and core protocols, while preserving stable principles such as privacy by design, data minimisation, user control, open standards and decentralised trust architecture.

At the same time, secure issuance cannot be considered in isolation.

The verifier side of the ecosystem must develop in parallel. The E-ID only creates meaningful value when there are enough real-world applications, electronic credentials and organisations able to verify and use them.

For this reason, the paper explicitly links secure issuance with the broader challenge of ecosystem activation. DIDAS addresses this in its accompanying position paper “Activate the Ecosystem Now”, covering verifier adoption, organisational identities, sector-specific standards, use cases and the funding required to build the ecosystem.

The response to a changing threat landscape should therefore be neither reduced security nor prolonged standstill.

It should be an architecture that allows security and rollout to advance together.

DIDAS Community Paper – Sichere Ausstellung der E-ID September 2026