WSCD
(Wallet Secure Cryptographic Device)
A Wallet Secure Cryptographic Device (WSCD) is the tamper-resistant device that protects a Wallet Unit's cryptographic keys and executes its critical cryptographic operations. The Wallet Secure Cryptographic Application (WSCA) manages those keys through it, and the ARF does not allow private keys to be exported.
The ARF describes the WSCD and the WSCA as a pair. The WSCD is the tamper-resistant hardware together with its firmware, such as its operating system and cryptographic libraries. The WSCA is the application that manages keys and other critical assets by using the functions the WSCD provides.
The ARF distinguishes four WSCD architectures. A remote WSCD is typically a Hardware Security Module on a secure server run by the Wallet Provider, which suits user devices without sufficiently secure hardware. A local external WSCD is a smart card or secure token connected over NFC or another short-range link, usually with a Java Card applet as its WSCA. A local internal WSCD is built into the user's device, such as a UICC, an eSIM or an embedded Secure Element. A local native WSCD is secure hardware the device's operating system exposes through its own API, in which case no separate WSCA is needed.
Whatever the architecture, the Wallet Provider manages the keys on the WSCD for the lifetime of the Wallet Unit and attests the properties of the WSCD, including its certifications, in a Key Attestation. A PID Provider or Attestation Provider relies on that attestation to know that the keys it binds a credential to were generated by and are stored in that WSCD.
The certification rules themselves come from Implementing Regulation (EU) 2024/2981, which expects a WSCD to meet high standards such as EUCC at EAL4 with vulnerability analysis comparable to AVA_VAN.5.
Related terms
Is a WSCD the same thing as a WSCA?
No. The WSCD is the tamper-resistant device that protects the keys and executes cryptographic functions, for example an HSM, a smart card, an eSIM or an embedded Secure Element. The WSCA is the application that manages those keys by using the WSCD. With a local native WSCD the operating system's API takes the WSCA's place, so no separate WSCA is needed.
Which WSCD architectures does the ARF allow?
Four. A remote WSCD is a Hardware Security Module on a secure server run by the Wallet Provider. A local external WSCD is a smart card or token connected over NFC. A local internal WSCD is built into the device, such as a UICC or an eSIM. A local native WSCD is secure hardware the operating system exposes through its own API.
Can the private keys be copied out of a WSCD?
No. The ARF does not allow private keys to be exported from the WSCD. The Wallet Provider manages those keys for the lifetime of the Wallet Unit and attests the properties of the device, including its certifications, in a Key Attestation that issuers rely on before binding a credential to the keys.
Which certification does a WSCD need?
The rules come from Implementing Regulation (EU) 2024/2981, which expects a WSCD to meet high standards such as EUCC at assurance level EAL4 with a vulnerability analysis comparable to AVA_VAN.5. The Wallet Provider records which certifications a device holds in the Key Attestation it issues.