EU Age Verification Project Mandates Hardware-Bound Attestation
Skip to content
No results
Search
Menu
EU Age Verification Project Mandates Hardware-Bound Attestation<br>The EU’s age verification project confirms hardware-bound attestation is mandatory, raising concerns over Linux, custom ROMs, and open-source access.
ByBobby Borisov<br>OnAugust 2, 2026<br>2 Comments
The European Union’s open-source age-verification project has drawn criticism after a maintainer confirmed that hardware-bound attestation is a mandatory architectural requirement, raising concerns about Linux, custom Android ROMs, and independently compiled applications.
The debate began in the GitHub repository for the project’s Android app, where a user argued that tying credentials to specific hardware environments would make it more difficult to support open systems.
“Hardware-bound attestation is a requirement of this project, not an implementation detail we can simply drop,” a maintainer responded. The project invited alternative architectural proposals and said a dedicated security review and threat model would be published soon.
The solution lets users prove they are over a certain age without revealing their name, exact birth date, or full identity document. To prevent credentials from being copied, cloned, or reused by modified clients, the project relies on keys stored in protected hardware like Android TEE, StrongBox, or Apple’s Secure Enclave.
However, critics claim that this approach endangers the system by making it dependent on a small number of approved devices, operating systems, and attestation providers.
The project’s technical specification requires age verification apps to use native cryptographic hardware when available. However, stricter checks like root detection, Google Play Integrity, and Apple App Attest are not universally mandated by the reference implementation and may be left to individual deployers.
This distinction matters because hardware-backed key storage does not require a server to approve the entire device, operating system, or application build. The maintainer’s wording leaves some uncertainty over how restrictive production deployments will be.
There is also a separate governance limitation. Proof of Age providers are expected to issue credentials only to applications included in a list of compliant apps maintained by the European Commission. This means that publishing the source code does not automatically guarantee that a community-built version can use the real service.
Importantly, Linux is not explicitly banned. Desktop Linux users could access a website and scan a QR code using a supported mobile wallet. However, the current architecture does not provide a native Linux wallet, and alternative mobile operating systems could struggle to meet the required trust conditions.
So, as you can understand, the controversy goes far beyond a single Android implementation. For now, however, the project’s position is that hardware binding remains required. The expected security review and threat model may provide a more detailed explanation of why that trade-off was selected and whether alternative roots of trust or less restrictive implementations can still comply.
Until then, the central question remains unresolved: whether an EU-funded, open-source identity system can meaningfully remain open when real-world access depends not only on available source code, but also on approved applications, supported security hardware, trusted operating environments, and the policies of credential providers.
Tell others:
Share on X (Twitter)
Share on Reddit
Share on Facebook
Share on Threads
Share on Bluesky
Share on Telegram
Share on LinkedIn
Share on Hacker News
Bobby Borisov
Bobby, an editor-in-chief at Linuxiac, is a Linux professional with over 20 years of experience. With a strong focus on Linux and open-source software, he has worked as a Senior Linux System Administrator, Software Developer, and DevOps Engineer for small and large multinational companies.
2 Comments
jadiri
August 2, 2026 at 3:49 pm
it bad enough that any age verification is invasion of privacy and illegal with out a dont in any democratic nation as is the rest of the mindless poorly thought out plan Freedom is for everyone regardless of age, race creed color and yes Age a new born if it were possible should be able to use the internet with out being doxed by it own Government period or the country is not Free and either are its people .
Reply
flx1s+ Linux phone
August 2, 2026 at 2:49 pm
how is EU even considering age verification, let alone US based system attestation. Bonkers!
Reply
Leave a ReplyCancel Reply<br>Your email address will not be published. Required fields are marked *
Name
Add Comment *
Save my name and email in this browser for the next time I comment.<br>Post Comment
Trending
Linux Desktop Market Share Surpasses 10% in North America
AerynOS Gets Linux Kernel 7.1.5, COSMIC 1.5, and Mesa...