Wallet Unit
A Wallet Unit is the unique configuration of a Wallet Solution that a Wallet Provider provides to one Wallet User: the Wallet Instance (the app), the Wallet Secure Cryptographic Application and Wallet Secure Cryptographic Device that manage its critical keys, and optionally one or more keystores.
The ARF distinguishes a Wallet Solution, the combination of software, hardware, services and configurations a Wallet Provider offers, from a Wallet Unit, the configuration of that solution provided to one Wallet User. The Wallet Instance is the app or web application the user interacts with, and it talks directly to the WSCA, which manages keys by using the WSCD. The WSCD is not always dedicated to one user: a remote HSM, for example, can be part of many Wallet Units.
The Wallet Provider issues a Wallet Instance Attestation and one or more Key Attestations to each Wallet Unit, and the Wallet Unit presents them only to PID Providers and Attestation Providers during issuance, never to Relying Parties.
A Wallet Provider revokes a Wallet Unit by revoking its Wallet Instance, for example at the User's request or when the device or its WSCA/WSCD is compromised. Such a compromise can reach beyond one user: if a type of WSCA/WSCD is compromised, every Wallet Unit using that type is revoked. A Wallet Solution is not revoked but suspended or withdrawn by the issuing member state, and withdrawal revokes all of its Wallet Units.
One user device can host several Wallet Instances, from the same or different Wallet Providers, and each forms a separate Wallet Unit that must meet the ARF requirements on its own.
- ARF 3.0.0, Annex 1
- ARF 3.0.0, 4.3.2, 4.6.3
- ARF 3.0.0, 6.5.3.4, 6.5.3.5
- ARF 3.0.0, Annex 2, WURevocation_09, WURevocation_09a
Read the full explanation
This page gives the short definition. Our explainer shows what it means in practice: who is involved, how it works and what changes for your organisation.
Wallet Unit Attestation explainedRelated terms
What is the difference between a Wallet Unit and a Wallet Solution?
A Wallet Solution is the product a Wallet Provider offers: a combination of software, hardware, services and configurations. A Wallet Unit is the configuration of that solution provided to one Wallet User. A single Wallet Unit can be revoked, for example at the User's request. A Wallet Solution can only be suspended or withdrawn by the issuing member state, and withdrawing it revokes all of its Wallet Units.