Skip to content

2.4 Communication Channels

This chapter comprises a register of all communication channels between the components listed in the decomposition.

In the following table all communication channels are listed with the following information:

  • ID: Identifier of the communication channel
  • Components: Which role or component participates in the communication channel
  • Protocol: What APIs or protocols are used to transfer data over the communication channel
  • Transport Security: How is the confidentiality and integrity of the communication channel protected
  • Authentication: How is the authenticity of the components ensured
  • Purpose: Short description of the purpose of the communication channel
ID Components Protocol Transport Security Authentication Purpose
CON_WI_PP WI/USER, PP OpenID4VCI TLS 1.2/1.3, OpenID4VCI Credential Request/Response encryption
  • WI/USER: WIA (wb_wia), eID-card/pp_refresh_token
  • PP: pp_access_cert, pp_registration_cert, CA-pinned TLS for hardcoded endpoint
 PID issuance
CON_WI_RP WI/USER, RP OpenID4VP TLS 1.2/1.3, OpenID4VP Authorization Response encryption
  • WI/USER: PID/EAA presentation
  • RP: rp_access_cert, rp_registration_cert
 PID presentation
CON_WI_MDVM WI, MDVM MDVM API TLS 1.2/1.3
  • WI enrollment: API keys, Android key attestation/iOS App Attest
  • WI renewal: API keys, Android key attestation/iOS App Attest, possession factor (wi_mdvm_auth_prvk)
  • MDVM: CA-pinned TLS for hardcoded endpoint
 MDVM operations
CON_WI_WB WI/USER, WB WB API TLS 1.2/1.3
  • WI/USER: API keys, possession factor (wi_mdvm_auth_prvk), mobile security assessment (mdvm_token)
  • WB: CA-pinned TLS for hardcoded endpoint
 WB operations
CON_WI_RWSCA WI/USER, RWSCA RWSCA API TLS 1.2/1.3
  • WI/USER: API keys, possession factor (wi_mdvm_auth_prvk), mobile security assessment (mdvm_token), knowledge factor (user_rwsca_pin/rwsca_pin_session_token)
  • RWSCA: CA-pinned TLS for hardcoded endpoint
 Remote WSCA operations
CON_WI_PNS WI, PNS PNS API TLS 1.2/1.3
  • WI: possession factor (wi_mdvm_auth_prvk), mobile security assessment (mdvm_token)
  • PNS: CA-pinned TLS for hardcoded endpoint
 PNS operations
CON_USER_WB USER, WB HTTPS TLS 1.2/1.3
  • User: none (publicly accessible)
  • WB: TLS certificate
 User-initiated wallet revocation via the revocation website
CON_PP_WB PP, WB OAuth Token Status List TLS 1.2/1.3
  • PP: none (publicly accessible)
  • WB: TLS for endpoint from signed WIA/WTE
 Retrieval of signed Status List Tokens for WIA and WTE by the PP
CON_RP_PP RP, PP OAuth Token Status List TLS 1.2/1.3
  • RP: none (publicly accessible)
  • PP: TLS for endpoint from signed PID
 Retrieval of signed Status List Tokens for the PID by the RP
CON_MQ WB, MDVM, RWSCA, PNS, MQ Message queue TLS 1.2/1.3
  • WB, MDVM, RWSCA, PNS: mTLS (?)
 inter-backend communication (tbd)
CON_HSM WB/MDVM/RWSCA, RWSCD/HSM PKCS#11 vendor-specific mTLS Protocol
  • WB/MDVM/RWSCA: client certificate, PKCS#11 C_Login to the HSM partition
  • RWSCD/HSM: server certificate
 Communication between backend services and HSM/RWSCD.
CON_DB WB/MDVM/RWSCA/PNS, DB Database protocol TLS 1.2/1.3
  • WB/MDVM/RWSCA/PNS: password (scram-sha-256)
  • DB: TLS for hardcoded endpoint
Storage/Access of Wallet Instance accounts in the account databases.

2.4.1 TLS Cipher Suites

The TLS configuration of all communication channels MUST comply with the following technical guidelines:

Note that both Android and iOS do not support TLS cipher suites with brainpool curves.