The European Union’s open-source age-verification project has drawn criticism after a maintainer confirmed that hardware-bound attestation is a mandatory architectural requirement. The confirmation sparked debate in the project’s GitHub repository, where concerns emerged about compatibility with Linux, custom Android ROMs, and independently compiled applications.
According to the project’s technical specification, age verification apps must use native cryptographic hardware when available. The solution allows users to prove they are over a certain age without revealing their name, exact birth date, or full identity document. To prevent credentials from being copied, cloned, or reused by modified clients, the project relies on keys stored in protected hardware like Android TEE, StrongBox, or Apple’s Secure Enclave.
When a user questioned whether hardware binding was necessary, a maintainer responded: “Hardware-bound attestation is a requirement of this project, not an implementation detail we can simply drop.” The project invited alternative architectural proposals and said a dedicated security review and threat model would be published soon.
Critics argue that this approach creates vulnerability by making the system dependent on a small number of approved devices, operating systems, and attestation providers. Hardware-backed key storage does not require a server to approve the entire device, operating system, or application build, though the maintainer’s wording leaves some uncertainty about how restrictive production deployments will be.
A separate governance limitation also applies: Proof of Age providers are expected to issue credentials only to applications included in a list of compliant apps maintained by the European Commission. This means publishing source code does not automatically guarantee that a community-built version can use the real service.
Linux is not explicitly banned. Desktop Linux users could access a website and scan a QR code using a supported mobile wallet. However, the current architecture does not provide a native Linux wallet, and alternative mobile operating systems could struggle to meet the required trust conditions.
The central question remains unresolved: whether an EU-funded, open-source identity system can remain meaningfully open when real-world access depends on available source code, approved applications, supported security hardware, trusted operating environments, and the policies of credential providers.
Key facts
- The EU project mandates hardware-bound attestation as a core requirement, not an optional detail
- Credentials are tied to protected hardware like Android TEE, StrongBox, or Apple’s Secure Enclave to prevent cloning and reuse
- Proof of Age providers must only issue credentials to apps on the European Commission’s compliant apps list
- Linux is not explicitly banned, but there is no native Linux wallet in the current architecture
- The project plans to publish a security review and threat model to explain the architectural trade-offs