When the internet goes down: can digital identity still work?

The internet can fail. Mobile networks can disappear. A central service can become temporarily unavailable. But a person does not stop being who they are. Should their digital identity stop working as well? QEI explores a different approach: the internet as infrastructure for issuance and synchronisation, but not necessarily as a requirement for every individual proof.

How do we use digital identity today?

In many current electronic services, identity verification is connected to online and central infrastructure. Slovenia’s electronic identity card, for example, contains electronic identification means on a secure chip. For high-assurance authentication, the associated private key is protected by a PIN and cannot be exported from the chip.

The chip therefore performs important cryptographic operations locally. But when the card is used to sign in to an online service through SI-PASS, the user flow is connected to a remote service and network infrastructure.

This creates an important distinction: local operation of a security element does not mean that the entire service works without the internet.

What happens when connectivity is unavailable?

If a service is designed to communicate with a central system during every verification, an internet outage can interrupt the process. That can matter in the field, in areas with weak coverage, during overloaded mobile networks, natural disasters or temporary outages of central infrastructure.

The question is therefore not whether we need the internet. We clearly do for a large part of modern digital infrastructure. The more important question is:

Does the internet also have to be available at every single moment when identity is proved?

European digital identity is already opening the door to offline verification

The European Digital Identity framework also provides for the European Digital Identity Wallet to be used in offline mode where appropriate. Regulation (EU) 2024/1183 explicitly provides for online and, where appropriate, offline authentication together with selective disclosure of data.

The European technical architecture for proximity verification also supports direct device-to-device communication, including NFC and Bluetooth Low Energy. In such scenarios, certain credentials or proofs can be verified locally without direct access to a remote system at the moment of interaction.

This matters because offline digital identity is not science fiction. It is already part of the direction of European digital identity development.

How could this work in QEI?

QEI – Quantized Encrypted Identity is a research and development concept of Institute 1 April. One possible architectural direction is that a user would not necessarily need to contact a central database or server for every individual proof.

Instead, the user could hold a cryptographically verifiable credential or token on a secure device. When something needs to be proved, the verifier device could validate the proof locally and receive only the answer required for that specific transaction.

For example:

AGE 18+: YES

instead of receiving the person’s name, exact date of birth, address and other personal information.

A simplified flow could be:

USER → LOCAL CRYPTOGRAPHIC PROOF → VERIFIER → RESULT

rather than the mandatory:

USER → INTERNET → CENTRAL SYSTEM → DATABASE → RESPONSE → VERIFIER

How could QEI be different?

The purpose of QEI would not be to claim that the internet is unnecessary. Nor is offline verification something unknown to other systems. The potentially important difference would be the combination of several principles within the architecture itself:

LOCAL VERIFICATION
In suitable scenarios, a basic proof could be checked directly between devices.

MINIMAL DATA DISCLOSURE
The verifier would receive only the attribute or proof actually required.

LESS DEPENDENCE ON A SINGLE POINT
Every individual proof would not necessarily require a connection to a central server.

SYNCHRONISATION AFTER RECONNECTION
When connectivity returns, keys, status information, revocations and other security data could be refreshed.

MULTI-LAYER TRUST
A proof would not rely simply on what a device displays, but on cryptographic verification of its origin and validity.

Offline does not mean infrastructure-free

There is an important limitation. A system capable of offline verification still needs infrastructure.

Connectivity remains necessary for issuing and renewing credentials, updating trusted keys, security upgrades, synchronisation and checking revoked or compromised credentials.

Revocation is a particularly important challenge. If a device stays offline for a long period, the system needs rules for how long locally stored status can be trusted. Possible approaches include short-lived proofs, time limits on offline use, locally cached status information and periodic synchronisation.

It is therefore more accurate to speak of a digital identity capable of secure offline operation, rather than a system that never needs the internet.

Today’s online-dependent flow and a possible QEI approach

TODAY’S ONLINE FLOW:
user → internet → remote service → verification → result.

POSSIBLE QEI OFFLINE FLOW:
user → direct NFC/Bluetooth connection → locally verifiable proof → result.

When connectivity returns, the system synchronises and refreshes its security information.

“If the internet goes down, a person does not lose their identity. Why should a digital system lose it?”
— Institute 1 April

The internet should be infrastructure, not an identity switch

The future of digital identity is not only about moving an identity document onto a phone. It is also about building a system that remains usable when part of the infrastructure is unavailable.

QEI aims to explore a model in which central infrastructure remains important for issuance, trust management, revocation and synchronisation, while the moment of proving something could, where appropriate, be a local cryptographic event between two devices.

Such an approach could increase system resilience while also reducing the amount of personal data that needs to be disclosed during individual checks.

“Digital identity should not disappear with the signal.”
— Institute 1 April

Note: QEI – Quantized Encrypted Identity is a research and development concept of Institute 1 April. This article describes possible architectural directions and does not claim that QEI is already an implemented production system. Offline verification is also part of the development of the European EUDI Wallet framework; QEI’s proposed distinction lies in combining local verification, cryptographically verifiable tokens and minimal disclosure of data.

Sources:
SI-TRUST – Electronic identity card
EUR-Lex – Regulation (EU) 2024/1183
European Commission – EUDI Wallet: Identification in proximity scenarios