WUA explained: how a wallet proves itself to an issuer
Before an organisation puts a credential into someone’s EUDI Wallet, it wants to know the wallet is the real thing and that what it stores cannot be copied out. A Wallet Unit Attestation is how the wallet proves that. It is not one document but two, both signed by the wallet’s provider: one about the app, one about the secure storage on the device.
The problem a WUA solves
An organisation about to issue an identity or a company registration credential has no way of its own to tell a certified wallet from a modified app, or from a script pretending to be one. It also cannot see whether the credential it is about to hand over will be locked to that device, or will sit somewhere it can simply be copied from.
The WUA closes both gaps by making someone else answer for it. The wallet’s provider vouches for the app and for the secure storage, and is supervised and listed at European level for doing so. The issuer checks both statements before issuing, and keeps checking afterwards, so it can withdraw what it issued if the wallet later turns out to be compromised.
A WUA is only ever used while collecting a credential. A wallet is not allowed to show one to a business accepting a credential, which keeps details about the holder’s phone and wallet out of everyday transactions.
The actors and who trusts whom
Five parties are involved, and only four of them ever handle a WUA. The secure storage on the device guards the secret, the Wallet Provider vouches for the app and that storage, and the issuer relies on that rather than assessing every wallet itself.
Wallet Provider
Vouches for the app and for the secure storage behind it, and keeps both statements up to date
Wallet Unit
Shows both statements to the issuer when it collects a credential, and uses a fresh pair every time
Secure storage on the device
Holds the secret that ties a credential to this one wallet, and never lets it out
PID Provider or Attestation Provider
Checks both statements before issuing, and keeps checking afterwards so it can withdraw what it issued
Relying Party
Never receives a WUA. It checks the credential itself, and whether it is still valid
Issuers can trust a WUA because the Wallet Provider that signed it appears on the official EU Trusted List for Wallet Providers, and because the wallet product itself has been certified by an independent assessment body.
Two statements under one name
The European specification splits the attestation in two because the app and the secure storage are different things. They are checked by different parties, and they are withdrawn for different reasons: one when a phone is lost, the other when a whole class of device turns out to be weak.
Wallet Instance Attestation (WIA)
- Vouches for
- The wallet app itself: a genuine, unmodified copy of a certified product
- Lifetime
- Less than 24 hours
- Can be withdrawn when
- This installation is reported lost, stolen or tampered with
- Needed for
- Every credential the wallet collects
Key Attestation (KA)
- Vouches for
- The secure storage on the device, and how well it resists attack
- Lifetime
- Set by the Wallet Provider, and may be longer than a WIA
- Can be withdrawn when
- A weakness is found in that kind of secure storage
- Needed for
- Credentials tied to the device, which includes every PID
Both are signed by the Wallet Provider, and both are used once and then discarded. That is deliberate: it means two issuers cannot compare notes and work out that they are dealing with the same wallet.
How a wallet gets these statements
This happens inside one wallet product, so each provider does it its own way. What the rules require is fixed: the provider must satisfy itself that the app has not been tampered with, and that the secret really sits in the secure storage it names. Most providers use the integrity checks Google and Apple already offer for this.
1. Wallet Unit
Asks the secure storage on the device for a new secret
2. Secure storage on the device
Creates it and returns proof from the device that it was created there
3. Wallet Provider
Checks that the app is genuine and that the proof is sound, then signs both statements
4. Wallet Unit
Keeps a small supply of fresh statements and uses a new one for each credential it collects
The WUA lifecycle
These statements are short-lived and used once, on purpose. The ability to withdraw them, though, outlives them by a long way. The first three stages below are routine; the fourth only happens when something goes wrong.
1. Checked
The Wallet Provider signs the two statements only after it has checked the app and the secure storage
2. Used once
Each statement serves a single credential collection, so the wallet keeps fetching fresh ones
3. Rechecked
A PID Provider rechecks at least once a day and withdraws the PID if either statement has been withdrawn
4. Withdrawn
Only when something goes wrong: a lost or stolen phone, or a weakness found in a type of secure storage
Outside the EUDI Wallet ecosystem, some wallet providers issue similar statements that simply expire and can never be withdrawn. The European rules do not allow that. Even though the statement about the app lives less than a day, both statements must remain withdrawable for at least 31 more days, because that is what lets an issuer pull a credential back long after it was issued.
WUA, WIA and KA: which term means what
The terminology changed while the specifications matured, so older articles use these three abbreviations differently from the way they are used today. This is the current meaning.
WUA
The umbrella term for the other two, shown to issuers only
WIA
The statement about the wallet app itself
KA
The statement about the secure storage on the device
What this means for you
Issuer
You can issue to wallets you have never assessed, because a supervised provider answers for each one and you can withdraw what you issued if that changes.
Verifier
Nothing extra to do. The work happens before the credential ever reaches you, and a compromised wallet loses its credentials rather than being flagged at your counter.
Wallet holder
Losing your phone does not hand over your credentials, and nothing about your wallet is disclosed to the businesses you show credentials to.
Technical deep dive
This page explains what the technology does and who it affects. Our developer documentation covers the implementation itself: the messages, the fields and the worked examples an integration team needs.
Read the technical documentationRelated terms
Frequently asked questions
Is a WUA the same thing as a Wallet Instance Attestation?
No. Since version 1.5 of TS3, WUA is the umbrella term for two statements: the Wallet Instance Attestation (WIA), about the app, and the Key Attestation (KA), about the secure storage on the device. Older articles use WUA for what is now called the Key Attestation, which is why the terms are often confused.
Does a verifier ever see the WUA?
No, and it is not allowed to ask for one. A wallet may show these statements to an issuer while collecting a credential, never to a business accepting one. A verifier checks the credential instead: who signed it, whether it belongs to this wallet, and whether it is still valid. If a wallet is compromised, the issuer withdraws the credentials it issued to it, and the verifier sees that through the credential itself.
How long is a WUA valid?
The statement about the app lives less than 24 hours; the one about the secure storage can live longer. Separately from that, the Wallet Provider promises to keep reporting whether each has been withdrawn for at least 31 more days, because issuers rely on that long after the statement itself has expired.
What happens if a wallet is lost or compromised?
The Wallet Provider marks that installation as withdrawn, or, when a whole type of secure storage turns out to be weak, marks that instead. Issuers recheck at least once a day and withdraw the credentials they issued to it. What protects the holder is that withdrawal, not the expiry of the statement.
Does this let the Wallet Provider see what I do with my wallet?
No. The statements say what kind of wallet this is, not who owns it, and a fresh one is used for each credential collected, so an issuer cannot recognise a returning wallet from them. The Wallet Provider signs them in advance and is not involved in the exchange between the wallet and the issuer.
Sources
This page is informational and does not constitute legal advice. For authoritative guidance consult the European Commission and the OpenID Foundation directly.