Ecosystem Architecture¶
Person Identification Data (PID)¶
Runtime Views¶
Basic Idea¶
In this flow, long-lived, digitally signed PID credentials in ISO mdoc and IETF SD-JWT VC formats are issued to the Wallet Instance utilizing the OpenID4VCI protocol. During the issuance, the user is authenticated using the eID card, so when these PID credentials are presented to the Relying Parties over OpenID4VP protocol, there is no need for the user to use physical eID card. This flow trusts using Wallet Backend to manage keys on behalf of the Wallet Instance, under the assumption that keys managed on the mobile device cannot be secured in a way that is appropriate for Level of Assurance High (unlike Option C).
To improve user experience and prevent the users from tapping an eID card every time a batch of Credentials needs to be refreshed and tapping an eID card as many times as there are Credentials in a batch, a concept of Seed Credential is introduced. A Seed Credential is used to acquire a set of single-use Batch Credentials from the Provider. The Wallet can then present these Batch Credentials to the Relying Parties. The user only needs to present the physical ID card once - to acquire the Seed Credential - instead of every presentation.
Such Seed Credential is issued by a PID Provider to the Wallet as a signed DPoP-bound refresh token and can be stored for a longer period. The key from the wallet backend, that the refresh token is bound to, is stored and managed by an HSM in the wallet backend (WSCD) instead of the wallet device itself.
Issuance of a Refresh Token used as a Seed Credential¶
[Sequence Diagram] Issuance of a Refresh Token used as a Seed Credential¶
User Journey: PID Issuance - Issuer Signed - Cloud
[Step-by-Step Description] Issuance of a Refresh Token used as a Seed Credential¶
- The user opens and unlocks the Wallet
- The user browses through the pre-configured credential catalog and chooses to request a PID
- The Wallet requests a fresh pid_issuer_session_id from the PID Provider
- The PID Provider generates a fresh pid_issuer_session_id linked to the issuance session
- The PID Provider returns the pid_issuer_session_id to the Wallet
- The Wallet obtains fresh wallet_backend_session_id from the Wallet Backend's session endpoint.
- part of an above module
- part of an above module
- The User enters the Wallet PIN
- The Wallet proves possession of the Wallet PIN
- See "Wallet proving possession of the PIN" module for a detailed description of the steps
- part of an above module
- part of an above module
- The Wallet prepares a Wallet Attestation PoP; containing
- audience
- expiration time
- pid_issuer_session_id
- The Wallet hashes the prepared Wallet Attestation PoP
- The Wallet sends a request to the Wallet Backend; containing
- UUID & Issuer_ID
- PoP for pin_derived_eph_priv
- PoP for device_priv
- Hash of the Wallet Attestation PoP
- The Wallet Backend checks Wallet Instance.
- See Wallet Backend checks the Wallet Instance module for a detailed description of the steps.
- part of an above module
- part of an above module
- The Wallet Backend validates the PoP for pin_derived_eph_pub and device_pub
- The Wallet Backend signs the hash of Wallet Attestation PoP with wb_device_priv
- The Wallet Backend returns the request to the Wallet; containing:
- signed hash of Wallet Attestation PoP
- The Wallet assembles the Wallet Attestation PoP using the signature received in a previous step
- The Wallet sends the Pushed Authorization Request to the PID Provider;
containing
- the Wallet Provider's client_id
- authorization_details for PID
- a PKCE code_challenge
- a wallet attestation and proof of possession
- The PID Provider verifies the wallet attestation and its proof of possession and validates the certification status of the Wallet Solution on a trust list
- The PID Provider returns a
request_uri
that is bound to the Pushed Authorization Request - The Wallet sends the Authorization Request; containing the PAR
request_uri
- The PID Provider responds with the first step to start the eID process with the Wallet, e.g. the tcToken, to authenticate the user.
- Further communication is exchanged to perform the eID process
- The user provides the eID PIN to the Wallet.
- Further communication is exchanged to perform the eID process
- The eID process is finished and as a final step the Wallet sends a request to the PID Provider calling the refreshURL. From now on Wallet and PID Provider are using the TLS-PSK channel generated by the eID flow.
- The PID Provider responds to the Wallet with an Authorization Response; containing the authorization code.
- The Wallet generates (and stores) a placeholder DPoP proof with a generic
(not HSM-bound) keypair to trigger an error response from the Token endpoint
necessary to retrieve the
dpop_nonce
. - The Wallet sends a Token Request to the PID Provider; containing the placeholder DPoP proof.
- The PID Provider generates and stores a
dpop_nonce
. - The PID Provider responds with the expected error "use_dpop_nonce";
containing the
dpop_nonce
to be used from now in the DPoP nonce header. - The Wallet extracts and stores the
dpop_nonce
. - The Wallet now prepares the actual DPoP-proof JWT for the HSM-bound
wb_dpop_pub
including thedpop_nonce
andiat
. - The Wallet hashes the DPoP proof.
- The Wallet sends a request to the Wallet Backend to sign the hash of the
DPoP-proof for the HSM bound key; containing
- hash of the PoP for the HSM bound key
wallet_backend_session_id
- The Wallet Backend validates the
wallet_backend_session_id
and loads session context - The Wallet Backend signs the hash of the PoP for the HSM bound key with wb_dpop_priv (associated with UUID & Issuer_ID) from the HSM
- The Wallet Backend returns the signed hash of the PoP for the HSM bound key to the Wallet.
- The Wallet assembles the DPoP-proof for the HSM bound key using the signature received in a previous step
- The Wallet sends a Token Request to the PID Provider; containing:
- a DPoP Header with the DPoP-proof JWT incl.
wb_dpop_pub
- the authorization code from Authorization Response
- the PKCE code_verifier matching the code_challenge from Authorization Request
- key attestation for
wb_dpop_pub
- a DPoP Header with the DPoP-proof JWT incl.
- The PID Provider matches the code, verifies the PKCE
code_verifier
to the previously receivedcode_challenge
and verifies the DPoP proof. - The PID Provider then generates an access token and a refresh token bound to
the DPoP key wb_dpop_priv in JWT format, signed with pp_priv;
containing:
- the eID data encrypted with pp_data
- the expiration date of the refresh token
- The PID Provider generates and stores a fresh
dpop_nonce
. - The PID Provider generates a Token Response; containing
- DPoP-bound access token (bound to wb_dpop_priv)
- DPoP-bound refresh token (bound to wb_dpop_priv)
- a c_nonce
- a fresh
dpop_nonce
in the DPoP nonce header
- The PID Provider sends the Token Response to the Wallet
- The Wallet stores the access and the refresh token.
- The wallet stores the
dpop_nonce
.
Issuance of a Batch of PIDs¶
[Sequence Diagram] Issuance of a Batch of PIDs¶
[Step-by-Step Description] Issuance of a Batch of PIDs¶
- The user opens and unlocks the Wallet.
- The Wallet requests issuance of PID Batch Credentials.
- The Wallet requests fresh wallet_backend_session_id
- The Wallet Backend generates and links it to the session
- The Wallet Backend returns the wallet_backend_session_id to the Wallet
- The Wallet requests a fresh pid_issuer_session_id from the Wallet Backend
- The Wallet Backend generates a fresh wallet_backend_session_id linked to the session
- The Wallet Backend returns the pid_issuer_session_id to the Wallet
- The user enters the Wallet PIN.
- The Wallet proves possession of the Wallet PIN
- See "Wallet proving possession of the PIN" module for a detailed description of the steps
- part of an above module
- part of an above module
- The Wallet sends a Credential Request to the Wallet Backend; containing
- the UUID & the Issuer_ID,
- the PoP for
pin_derived_eph_priv
and - the PoP for
device_priv
- The Wallet Backend checks Wallet Instance.
- See Wallet Backend checks the Wallet Instance module for a detailed description of the steps.
- part of an above module
- part of an above module
- The Wallet Backend validates the PoP for pin_derived_eph_pub and device_pub.
- The Wallet Backend generates a cryptographic seed (c_seed) for the batch
credential keys and associates it with Issuer_ID
- Each batch of credentials uses it's own c_seed, previous c_seeds are discarded when a new batch of credentials for a specific Issuer are requested
- The Wallet Backend deterministically derives the required number of key
pairs incl. key IDs from c_seed
- A mechanism for key derivation will be defined later
- The Wallet Backend assembles a claim called CloudWalletBatchKey containing the public part of the just generated key pairs and the respective key IDs and signs the claim with wb_attestation_priv.
- The Wallet Backend returns the request to the Wallet; containing
- the signed CloudWalletBatchKey
- The Wallet prepares a Wallet Attestation PoP containing
- the audience,
- the signed CloudWalletBatchKey claim and
- the pid_issuer_session_id.
- The Wallet hashes the Wallet Attestation PoP.
- The Wallet sends a signing request to the Wallet Backend containing
- hash of the Wallet Attestation PoP
- wallet_backend_session_id
- The Wallet Backend validates the wallet_backend_session_id and loads the session context.
- The Wallet Backend signs the hash of the Wallet Attestation PoP with the respective wb_device_priv.
- The Wallet Backend returns the request to the Wallet incl. the signed hash of the Wallet Attestation PoP.
- The Wallet assembles the Wallet Attestation PoP using the signature received in a previous step.
- The Wallet generates (and stores) a placeholder DPoP proof with a generic
(not HSM-bound) keypair to trigger an error response from the Token endpoint
necessary to retrieve the
dpop_nonce
. - The Wallet sends a Token Request to the PID Provider; containing the placeholder DPoP proof.
- The PID Provider generates and stores a
dpop_nonce
. - The PID Provider responds with the expected error "use_dpop_nonce";
containing the
dpop_nonce
to be used from now in the DPoP nonce header. - The Wallet extracts and stores the
dpop_nonce
. - The Wallet prepares the DPoP-proof JWT for the HSM-bound
wb_attestation_pub
including thedpop_nonce
andiat
. - The Wallet hashes the DPoP proof.
- The Wallet sends a request to the Wallet Backend to sign the hash of the
DPoP-proof for the HSM bound key containing
- a hash of the PoP for the HSM bound key
- The Wallet Backend validates the wallet_backend_session_id and loads the session context.
- The Wallet Backend signs the hash of the PoP for the HSM bound key with wb_device_priv (associated with UUID & Issuer_ID) from the HSM.
- The Wallet Backend returns the signed hash of the PoP for the HSM bound key to the Wallet.
- The Wallet assembles the DPoP-proof for the HSM bound key using the signature received in a previous step.
- The Wallet sends a Token Request to the PID Provider containing
- the Wallet Attestation + PoP in the wallet attestation Header,
- the DPoP-proof JWT over
wb_attestation_pub
, - the grant_type "refresh_token",
- the DPoP-bound refresh token
- The PID Provider verifies the wallet attestation and its proof of possession and validates the certification status of the Wallet Solution on a trust list
- The PID Provider verifies the validity of the refresh token (incl. DPoP-binding).
- The PID Provider decrypts the refresh token contents with //pp_data// and stores the users identity attributes in the session.
- The PID Provider generates and stores a
dpop_nonce
. - The PID Provider generates a Token Response with a DPop bound access token.
- The PID Provider returns a Token Response to the Wallet containing
- the DPoP bound access_token and
- the c_nonce
- a fresh
dpop_nonce
in the DPoP nonce header.
- The Wallet prepares the required number of PoP (incl. audience and respective public key) for the batch credential keys and hashes them.
- The Wallet sends a BatchSigningRequest to the Wallet Backend containing
- the required number of hashed batch credential key PoPs and
- the wallet_backend_session_id.
- The Wallet Backend validates the wallet_backend_session_id and loads the session context.
- The Wallet Backend signs the hashed batch credential key PoPs with the respective batch_kb_X_priv.
- The Wallet Backend returns the request to the Wallet incl. the signed hashes of the batch credential key PoPs.
- The Wallet assembles the required amount of CredentialRequests containing the signed batch credential key PoPs.
- The Wallet prepares the DPoP-proof JWT for the HSM-bound //dev// key
including the
dpop_nonce
andiat
. - The Wallet hashes the DPoP proof.
- The Wallet sends a request to the Wallet Backend to sign the hash of the
DPoP-proof for the HSM bound key containing
- a hash of the PoP for the HSM bound key and
- the wallet_backend_session_id.
- The Wallet Backend validates the wallet_backend_session_id and loads the session context.
- The Wallet Backend signs the hash of the PoP for the HSM bound key with wb_dpop_priv (associated with UUID & Issuer_ID) from the HSM.
- The Wallet Backend returns the signed hash of the PoP for the HSM bound key to the Wallet.
- The Wallet assembles the DPoP-proof for the HSM bound key using the signature received in a previous step.
- The Wallet generates a new ephemeral keypair (cre_eph_pub, cre_eph_priv).
- The Wallet creates the
credential_response_encryption
JSON object containing the following information:- a jwk containing the cre_eph_pub
- the JWE alg parameter
- the JWE enc parameter
- The Wallet sends a BatchCredentialRequest to the PID Provider containing
- DPoP proof JWT
- required amount of CredentialRequests
credential_response_encryption
object- DPoP bound access_token
- The PID Provider validates the DPoP bound access_token and checks the
signatures of the CredentialRequests.
- The PID Provider has to ensure that the batch_kb_X_pub from the CredentialRequests match to the public keys in the CloudWalletBatchKey claim from the Wallet Attestation PoP.
- (mdoc) The PID Provider creates the mdoc containing
- the issuerAuth with the batch_kb_X_pub as deviceKey and hashes of the eID data,
- the eID data as NameSpaceBytes and
- the status management information
- (mdoc) The PID Provider creates an encrypted JWT (JWE) using the values
received in the
credential_response_encryption
object and adds (among others) the PID credential to the payload. - The PID Provider generates and stores a fresh
dpop_nonce
. - (mdoc) The PID Provider sends the Credential Response JWT containing
- the required amount of PID credentials as mdoc.
- (SD-JWT) The PID Provider creates SD-JWT VC containing
- the SD-JWT with the batch_kb_X_pub as confirmation claim and hashes of the eID data,
- the eID data as Disclosures and
- the status management information
- (SD-JWT) The PID Provider creates an encrypted JWT (JWE) using the
values received in the
credential_response_encryption
object and adds (among others) the PID credential to the payload. - The PID Provider generates and stores a fresh
dpop_nonce
. - (SD-JWT) The PID Provider sends the Credential Response JWT containing
- the required amount of PID credentials as SD-JWT VC.
- The Wallet decrypts the Credential Response JWT using the cre_eph_priv.
- The Wallet matches the key IDs (from the CloudWalletBatchKey claim) to the public keys in the Credential Response by their respective public keys and stores them as tuple in a BatchCredentialStore with the issuer_ID.
- The Wallet extracts and stores the
dpop_nonce
.
Credential Presentation¶
[Sequence Diagram] Credential Presentation¶
User Journey: PID Presentation - Issuer Signed - Cloud
[Step-by-Step Description] Credential Presentation¶
Note: While certain assumptions about session management of the Relaying Party are made here, the concrete implementation is considered out of scope for this document. The usual security considerations for web session management apply.
- The user browses to Relying Party (RP) website
- Browser app on the user's device opens the RP website
- RP generates an ephemeral key pair (e.g.,
rp_eph_pub
,rp_eph_priv
) - RP generates an OpenID4VP Authorization Request and stores it under a
request_uri
(e.g.,https://rp.example.com/oidc/request/1234
); - The request is bound to the user's browser session
- It is signed using a key bound to the RP's metadata that can be retrieved using the RP's client_id
- It contains the ephemeral key for response encryption
- It contains RP's nonce and state
- It contains the RP's response_uri endpoint for sending the Authorization Response over POST
- RP generates a new browser session and binds the generated Authorization Request to it
- RP returns a HTML page to the browser containing a link to the Wallet (e.g.,
openid4vp://authorize?client_id=..&request_uri=https://rp.example.com/oidc/request/1234
); a cookie with the browser sessionId is set - The user clicks on the link
- The RP website navigates to the custom scheme link to launch the Wallet
- The user unlocks the Wallet (see notes below)
- The Wallet sends a GET request to the RP's Authorization Request endpoint
(e.g.,
https://rp.example.com/oidc/request/1234
) - The Wallet retrieves the Authorization Request from the RP website
- The Wallet validates the Authorization Request using the RP's public key
- Was the signature valid and the key bound to the RP's metadata?
- Security: This ensures that the Authorization Request was not tampered with; it does not ensure that the party that sent the Authorization Request is the RP.
- The Wallet displays information about the identity of the Relying Party and the purpose, the user gives consent to present the PID.
- The Wallet picks a batch credential tuple (Credential incl. possible disclosures, keyID) from the batch credential store
- (mdoc) The Wallet prepares an mdoc presentation according to the presentation_definition by removing NameSpaceBytes of not disclosed attributes.
- (mdoc) The Wallet calculates the SessionTranscript according to ISO 18013-7 Annex B.4.4 from mDocGeneratedNonce, client_id, responseUri, nonce and generates the deviceAuthentication structure from SessionTranscript and NameSpaceBytes for signing and hashes the deviceAuthentication structure.
- (SD-JWT) The Wallet generates an SD-JWT VC presentation according to the presentation_definition by removing Disclosures of not disclosed attributes.
- (SD-JWT) The Wallet creates the header and payload for the KB-JWT from audience, nonce, hash of issuer-signed JWT and Disclosures for signing and hashes the payload.
- The Wallet requests a fresh wallet_backend_session_id from the Wallet Backend
- The Wallet Backend generates a fresh wallet_backend_session_id linked to the session
- The Wallet Backend returns the wallet_backend_session_id to the Wallet
- The User enters the Wallet PIN
- The Wallet proves possession of the Wallet PIN
- See "Wallet proving possession of the PIN" module for a detailed description of the steps
- The Wallet signs over the wallet_backend_session_id and the device-bound public key device_pub using the key pin_derived_eph_priv
- The Wallet signs over the wallet_backend_session_id and the Wallet PIN derived public key pin_derived_eph_pub using the key device_priv
- The Wallet sends a signing request to the Wallet Backend; containing
- UUID & issuer_ID
- PoP for pin_derived_eph_priv
- PoP for device_priv
- hash of KB-JWT/deviceAuth
- keyID (of the respective key that should be used to sign)
- The Wallet Backend checks Wallet Instance.
- See Wallet Backend checks the Wallet Instance module for a detailed description of the steps.
- part of an above module
- part of an above module
- The Wallet Backend validates the PoP for pin_derived_eph_pub and device_pub
- The Wallet Backend loads the c_seed associated with the issuer_ID
- The Wallet Backend deterministically regenerates (batch_kb_X_pub,
batch_kb_X_priv) from c_seed and keyIDx
- A mechanism for key derivation will be defined later
- The Wallet Backend signs the hash of KB-JWT/deviceAuth with the respective batch_kb_X_priv
- The Wallet Backend returns the signed hashes of KB-JWT/deviceAuth to the Wallet
- (mdoc) The Wallet assembles the deviceAuth from header, payload and signature and builds the presentation from deviceAuth and issuerSigned
- (SD-JWT) The Wallet assembles the KB-JWT from header, payload and signature and builds the SD-JWT VC presentation from issuer-signed JWT, Disclosures and KB-JWT
- The Wallet creates a VP token and a presentation submission from the received credential.
- Optional: The Wallet can add further presentations
- The Wallet deletes the used batch credential tuple (credential, keyID)
- The Wallet sends the VP token and presentation submission to the RP (encrypted to the RP's public key rp_eph_pub).
- The RP finds a session with the state and generates a response_code for this session
- The RP returns the redirect_uri with the response_code to the Wallet
- The Wallet launches the browser with the redirect_uri and response_code.
- The browser sends the redirect_uri and response code to the RP, attaching the browser sessionId as a cookie.
- The RP looks up whether there exists a session with the sessionId from the cookie and a matching response_code
- (mdoc) The RP verifies the PID in the VP token and verifies the SessionTranscript calculated from nonce, mDocGeneratedNonce, client_id, response_uri.
- (SD-JWT) The RP verifies the SD-JWT PID in the VP token, verifies the KB-JWT using the batch_kb_X_pub in the SD-JWT, and verifies the nonce and audience in the KB-JWT
- The RP considers the user to be identified in the session context and continues the UX flow.