Article URL: https://linuxiac.com/eu-age-verification-project-mandates-hardware-bound-attestation/ Comments URL: https://news.ycombinator.com/item?id=49148128 Points: 100 # Comment…

The EU’s age verification project confirms hardware-bound attestation is mandatory, raising concerns over Linux, custom ROMs, and open-source access. The European Union’s open-source age-verification project has drawn criticism after a maintainer confirmed that hardware-bound attestation is a mandatory architectural requirement, raising concerns about Linux, custom Android ROMs, and independently compiled applications. The debate began in the GitHub repository for the project’s Android app, where a user argued that tying credentials to specific hardware environments would make it more difficult to support open systems. “Hardware-bound attestation is a requirement of this project, not an implementation detail we can simply drop,” a maintainer responded. The project invited alternative architectural proposals and said a dedicated security review and threat model would be published soon. The solution lets users prove they are over a certain age without revealing their name, exact birth date, or full identity document. To prevent credentials from being copied, cloned, or reused by modified clients, the project relies on keys stored in protected hardware like Android TEE, StrongBox, or Apple’s Secure Enclave. However, critics claim that this approach endangers the system by making it dependent on a small number of approved devices, operating systems, and attestation providers. The project’s technical specification requires age verification apps to use native cryptographic hardware when available. However, stricter checks like root detection, Google Play Integrity, and Apple App Attest are not universally mandated by the reference implementation and may be left to individual deployers. This distinction matters because hardware-backed key storage does not require a server to approve the entire device, operating system, or application build. The maintainer’s wording leaves some uncertainty over how restrictive production deployments will be.