EU Digital Identity Wallet, eIDAS 2.0, key stores, relying parties
Attested wallets and digital identity
A wallet is certified once. Phones change every day.
Every EU member state has to offer a digital identity wallet by 24 December 2026, and banks, telecoms and other regulated services have to accept it soon after. The whole scheme rests on one claim: this wallet app is genuine and its keys sit in certified hardware. Phones are updated, rooted, lost and replaced every day, so that claim has to be proved again, for millions of units.
Who this is for
- Wallet providers, national and private, preparing for certification
- Issuers and trust service providers, deciding which wallets to issue to
- Banks, telecoms and other relying parties, that have to accept wallets
- HSM and secure element makers, whose key attestation carries the scheme
When trust has to be proved again
The phone's operating system or the wallet app is updatedThe wallet provider must decide whether the unit still qualifies, then issue a new Wallet Unit Attestation or refuse. A device is rooted, cloned or reported lostThe attestation has to be revoked fast, and every credential that depended on it has to follow.
Keys live in a remote HSM instead of the phoneThe provider has to prove to issuers and certifiers that the key is inside the HSM and that only the right user can use it.
A flaw is found in a phone model or secure elementA whole class of units loses its assurance level at once. The provider needs a plan that is faster than a recall.
What we deliver
- A lifecycle design for Wallet Unit Attestations: issuance, validity period, renewal and revocation, and the events that trigger each.
- Remote attestation for cloud HSMs and server-side key stores, so a key attestation is backed by hardware evidence.
- A verification policy for issuers and relying parties: which wallet evidence to require, how fresh, and what to do when it is missing.
- Evidence prepared for wallet certification, mapped to the Architecture and Reference Framework.
Questions worth answering
- How long is your Wallet Unit Attestation valid, and why that long?
- What happens to issued credentials when a wallet unit is revoked?
- Can you prove that a key never left the HSM?
- As a bank: what do you check before you trust what a wallet presents?
Across the life cycle
DesignBuildMake or deployOperateUpdateRetire
The stage that decides here: retire. Phones are lost and replaced every day. Revocation is where a wallet scheme is tested. See attestation in the product life cycle.
Rules and standards your buyers cite
eIDAS 2.0 and the EU Digital Identity WalletCyber Resilience Act
Industries that use this
Legal services and digital trust
Use case
An identity wallet with keys in a cloud HSM
Go deeper
- How the platforms attest: Android, Apple devices, Arm TrustZone and PSA
- Terms explained: Attestation freshness, Wallet Unit Attestation (WUA), Two meanings of attestation in eIDAS 2.0, Local attestation, Self-sovereign identity (SSI), Non-repudiation, Anonymous attestation: DAA, EPID and group signatures
- Read next: HSM makers and key attestation, Anonymous attestation
Who builds in this area
From our public landscape: EU Digital Identity Wallet reference implementation, German EUDI Wallet blueprint, Swiss e-ID, OpenWallet Foundation, Android Key Attestation, Apple App Attest, Thales, Ubiqu, iGrant.io, Procivis, Scytáles, IDEMIA, walt.id, Lissi, Sphereon, Signicat, Cryptomathic, Namirial, Tinexta InfoCert, Intesi Group, Promon, Gataca, Yivi, Swisscom Trust Services, Utimaco, Securosys, Google Cloud HSM, Azure Key Vault Managed HSM, YubiHSM 2, AWS CloudHSM, Nitrokey NetHSM, Crypto4A, Futurex, I4P, Eviden Trustway Proteccio.
Not quite your case? Signing and trust services? Legal and digital trust. Keys in the cloud? Attested cloud workloads.
Working on Attested wallets and digital identity? A first call takes 30 minutes and commits you to nothing. Bring your product and the one question that worries you.
Next fixed date: EU Digital Identity Wallets are due in every member state on 24 December 2026, 42 days from now.
Concepts: Re-attestation · Continuous attestation · Remote attestation · IETF RATS architecture