|
1 | 1 | # Topic P - Secure Cryptographic Interface between the Wallet Instance and WSCA |
2 | 2 |
|
3 | | -Version 0.4, updated 23 Sep. 2025 |
| 3 | +Version 1.0, updated 14 Oct. 2025 |
4 | 4 |
|
5 | 5 | [Link to GitHub discussion](https://github.com/eu-digital-identity-wallet/eudi-doc-architecture-and-reference-framework/discussions/578) |
6 | 6 |
|
@@ -131,7 +131,24 @@ generated cryptographic keys and sensitive data [WIAM_13, WIAM_21, PAD_04, PAD_0 |
131 | 131 | private key [WIAM_19]. |
132 | 132 |
|
133 | 133 |
|
| 134 | + |
134 | 135 | ## 3. Existing technologies |
| 136 | +This section presents a number of technologies that potentially can be used to |
| 137 | +implement a WSCA. It is important to clarify that the ARF does not endorse any |
| 138 | +specific technology. The Wallet Provider must ensure that its implementation of |
| 139 | +the WSCA and WSCD in combination can be certified for security. Moreover, it is |
| 140 | +possible that the Wallet Provider may need to develop some bespoke components to |
| 141 | +be able to fulfill all requirements for a WSCA in the ARF and the CIRs. For |
| 142 | +example, if the WSCD is a smart card, the Wallet Provider may develop a |
| 143 | +dedicated JavaCard applet that runs on the WSCD and augments the native OS of |
| 144 | +the smart card with additional functionalities. If so, the security of this |
| 145 | +JavaCard applet needs to be considered during certification of the Wallet |
| 146 | +Solution, whereas the OS of the WSCD itself (which is not provided by the Wallet |
| 147 | +Provider) may be covered under an assumption regarding its resistance against |
| 148 | +attackers with high attack potential, in accordance with CIR 2024/2981, Annex |
| 149 | +IV, paragraph 3(3). Furthermore, in accordance with CIR 2024/2981 "every |
| 150 | +architecture and implementation of wallets" shall properly address the security |
| 151 | +and privacy risks set in Annex I of CIR 2024/2981. |
135 | 152 |
|
136 | 153 | In mobile devices, the Wallet Secure Cryptographic Device (WSCD) is often embedded within |
137 | 154 | the device hardware. The WSCA, in this case is platform-dependent and acts as the interface |
|
0 commit comments