How Wallet Providing Works
What are wallet attestations?
The attestations issued by a Wallet Provider do not contain user credentials. Instead, they contain claims about the wallet itself. This is what allows credential issuers and verifiers to trust that the wallet is a legitimate, secure place to store and present sensitive identity information.
In the EUDI ecosystem, Wallet Unit Attestation (WUA) is an umbrella term covering all of the attestations a wallet unit holds. There are two types of attestation under it, both defined in OpenID4VCI:
Wallet Instance Attestation (WIA) authenticates the wallet application itself, proving it's legitimate, unmodified, and from a trusted provider. These short-lived attestations are used during authorization flows. (OpenID4VCI Appendix E: "Wallet Attestation")
Key Attestation (KA) attests to the security properties of cryptographic keys, proving they are stored securely and meet specific requirements. These longer-lived attestations are used when binding credentials to keys. (OpenID4VCI Appendix D: "Key Attestation")
Together, these attestations enable issuers to confidently distribute credentials, verifiers to trust presentations, and users to benefit from enhanced privacy and security across the ecosystem.
Two naming changes from the EU Architecture Reference Framework (ARF) are reflected here:
- "Wallet Instance Attestation" (WIA) was previously called "Wallet App Attestation" (WAA). Our code interfaces have been updated to reflect this change.
- "Wallet Unit Attestation" (WUA) previously referred to what's now called Key Attestation (KA); WUA is now the umbrella term above. Our code interfaces have not yet been updated to reflect this change — see Wallet Provisioning Flows for the flows in the API.
Wallet Providing implementation
For details of the Procivis One Wallet Provider implementation, see Providing Wallets.