Wallet Unit

A Wallet Unit is the unique configuration a Wallet Provider gives to one Wallet User: the Wallet Instance (the app), together with the Wallet Secure Cryptographic Application and Wallet Secure Cryptographic Device that generate and protect its keys.

The ARF distinguishes a Wallet Solution, the software and service a Wallet Provider builds and offers generally, from a Wallet Unit, the specific instance of that solution issued to one user and bound to that user's own secure hardware. In everyday use, Wallet Instance is the app installed on a device, and Wallet Unit is that installed app together with the cryptographic material behind it: the pairing is what lets a Wallet Unit Attestation later prove a request came from a genuine, unmodified copy rather than a spoofed client. This distinction matters most when something goes wrong: a Wallet Provider can revoke a single Wallet Unit, for example because its device was reported lost or its Wallet Secure Cryptographic Device is suspected compromised, without affecting any other user running the same Wallet Solution. Revoking the Wallet Solution itself is the far more disruptive step of withdrawing the whole product from the market. A Wallet Unit Attestation is issued per Wallet Unit rather than per Wallet Solution, since it has to speak to the specific hardware behind one user's keys, and a relying party checking that attestation is really asking whether this particular Wallet Unit, not the software brand behind it, is genuine and has not been tampered with. The ARF also allows one Wallet User to hold several Wallet Units, for instance on a phone and a separate hardware device, each provisioned from the same Wallet Solution but cryptographically independent of the others.

Back to the glossary