Skip to content

2.4 Communication Channels

This chapter comprises a register of all communication channels between the components listed in the decomposition.

In the following table all communication channels are listed with the following information:

  • ID: Identifier of the communication channel
  • Components: Which role or component participates in the communication channel
  • Protocol: What APIs or protocols are used to transfer data over the communication channel
  • Transport Security: How is the confidentiality and integrity of the communication channel protected
  • Authentication: How is the authenticity of the components ensured
  • Purpose: Short description of the purpose of the communication channel
ID Components Protocol Transport Security Authentication Purpose
CON_WI_PP WI/USER, PP OpenID4VCI TLS 1.2/1.3, OpenID4VCI Credential Request/Response encryption
  • WI/USER: WIA (wb_wia), eID-card/pp_refresh_token
  • PP: pp_access_cert, pp_registration_cert, CA-pinned TLS for hardcoded endpoint
 PID issuance
CON_WI_RP WI/USER, RP OpenID4VP TLS 1.2/1.3, OpenID4VP Authorization Response encryption
  • WI/USER: PID/EAA presentation
  • RP: rp_access_cert, rp_registration_cert
 PID presentation
CON_WI_MDVM WI, MDVM MDVM API TLS 1.2/1.3
  • WI enrollment: API keys, Android key attestation/iOS App Attest
  • WI renewal: API keys, Android key attestation/iOS App Attest, possession factor (wi_mdvm_auth_prvk)
  • MDVM: CA-pinned TLS for hardcoded endpoint
 MDVM operations
CON_WI_WB WI/USER, WB WB API TLS 1.2/1.3
  • WI/USER: API keys, possession factor (wi_mdvm_auth_prvk), mobile security assessment (mdvm_token)
  • WB: CA-pinned TLS for hardcoded endpoint
 WB operations
CON_WI_RWSCA WI/USER, RWSCA RWSCA API TLS 1.2/1.3
  • WI/USER: API keys, possession factor (wi_mdvm_auth_prvk), mobile security assessment (mdvm_token), knowledge factor (user_rwsca_pin/rwsca_pin_session_token)
  • RWSCA: CA-pinned TLS for hardcoded endpoint
 Remote WSCA operations
CON_WI_PNS WI, PNS PNS API TLS 1.2/1.3
  • WI: possession factor (wi_mdvm_auth_prvk), mobile security assessment (mdvm_token)
  • PNS: CA-pinned TLS for hardcoded endpoint
 PNS operations
CON_USER_WB USER, WB HTTPS TLS 1.2/1.3
  • User: none (publicly accessible)
  • WB: TLS certificate
 User-initiated wallet revocation via the revocation website
CON_PP_WB PP, WB OAuth Token Status List TLS 1.2/1.3
  • PP: none (publicly accessible)
  • WB: TLS for endpoint from signed WIA
 Retrieval of signed Status List Tokens for WIA by the PP
CON_RP_PP RP, PP OAuth Token Status List TLS 1.2/1.3
  • RP: none (publicly accessible)
  • PP: TLS for endpoint from signed PID
 Retrieval of signed Status List Tokens for the PID by the RP
CON_MQ WB, MDVM, RWSCA, PNS, MQ Message queue TLS 1.2/1.3
  • WB, MDVM, RWSCA, PNS: mTLS (?)
 inter-backend communication (tbd)
CON_HSM WB/MDVM/RWSCA, RWSCD/HSM PKCS#11 vendor-specific mTLS Protocol
  • WB/MDVM/RWSCA: client certificate, PKCS#11 C_Login to the HSM partition
  • RWSCD/HSM: server certificate
 Communication between backend services and HSM/RWSCD.
CON_DB WB/MDVM/RWSCA/PNS, DB Database protocol TLS 1.2/1.3
  • WB/MDVM/RWSCA/PNS: password (scram-sha-256)
  • DB: TLS for hardcoded endpoint
Storage/Access of Wallet Instance accounts in the account databases.

2.4.1 TLS Cipher Suites

The TLS configuration of all communication channels comply with the following technical guidelines:

  • BSI TR-03116-4
  • BSI TR-02102-2
  • as a deviation, the cipher TLS_CHACHA20_POLY1305_SHA256 is also allowed

Note that both Android and iOS do not support TLS cipher suites with brainpool curves.

2.4.2 CT Log Monitoring

While the Wallet Instance pins the CA for its hardcoded endpoints, the Wallet Provider monitors Certificate Transparency logs for its own domains to detect impersonation attempts. This covers the endpoints of WB, MDVM, RWSCA and PNS as well as the publicly reachable revocation website (CON_USER_WB).

Certificates that were not requested by the Wallet Provider are reported to the issuing CA for revocation and trigger the incident response process.