Wallet unit integrity
1. Wallet units shall not perform any functionality listed in Article 5a(4) of Regulation (EU) No 910/2014, except wallet user authentication to access the wallet unit, until the wallet unit has successfully authenticated the wallet user.
2. Wallet providers shall, for each wallet unit, sign or seal, at least one wallet unit attestation compliant with the requirements laid down in Article 6. The certificate used to sign or seal the wallet unit attestation shall be issued under a certificate listed in the trusted list referred to in Implementing Regulation (EU) 2024/2980.
Wallet instances
1. Wallet instances shall use at least one wallet secure cryptographic device to manage critical assets.
2. Wallet providers shall ensure integrity, authenticity and confidentiality of the communication between wallet instances and wallet secure cryptographic applications.
3. Where critical assets relate to performing electronic identification at assurance level high, the wallet cryptographic operations or other operations processing critical assets shall be performed in accordance with the requirements for the characteristics and design of electronic identification means at assurance level high, as set out in Commission Implementing Regulation (EU) 2015/1502 ( 11 ) .
Wallet secure cryptographic applications
1. Wallet providers shall ensure that wallet secure cryptographic applications:
(a)
perform wallet cryptographic operations involving critical assets other than those needed for the wallet unit to authenticate the wallet user only in cases where those applications have successfully authenticated wallet users;
(b)
where they authenticate wallet users in the context of performing electronic identification at assurance level high; perform authentication of wallet users, in accordance with, the requirements for the characteristics and design of electronic identification means at assurance level high, as set out in Implementing Regulation (EU) 2015/1502;
(c)
are able to securely generate new cryptographic keys;
(d)
are able to perform secure erasure of critical assets;
(e)
are able to generate a proof of possession of private keys;
(f)
protect the private keys generated by those wallet secure cryptographic applications during the existence of the keys;
(g)
comply with the requirements for the characteristics and design of electronic identification means at assurance level high, as set out in Implementing Regulation (EU) 2015/1502;
(h)
are the only components able to execute wallet cryptographic operations and any other operation with critical assets in the context of performing electronic identification at assurance level high.
2. Where wallet providers decide to provide a wallet secure cryptographic application to an embedded secure element these wallet providers shall base their technical solution on the technical specifications listed in Annex I or on other equivalent technical specifications.
Wallet unit authenticity and validity
1. Wallet providers shall ensure that each wallet unit contains wallet unit attestations.
2. Wallet providers shall ensure that the wallet unit attestations referred to in paragraph 1 contain public keys and that the corresponding private keys are protected by a wallet secure cryptographic device.
3. Wallet providers shall:
(a)
inform wallet users of their rights and obligations in relation to their wallet unit;
(b)
provide mechanisms, independent of wallet units, for the secure identification and authentication of wallet users;
(c)
ensure wallet users have the right to request revocation of their wallet unit attestations, using the authentication mechanisms referred to in point (b).
Revocation of wallet unit attestations
1. Wallet providers shall be the only entities capable of revoking wallet unit attestations for wallet units that they have provided.
2. Wallet providers shall establish a publicly available policy specifying the conditions and the timeframe for the revocation of wallet unit attestations.
3. Where wallet providers have revoked wallet unit attestations, they shall inform affected wallet users within 24 hours of the revocation of their wallet units, including the reason for the revocation and the consequences for the wallet user. This information shall be provided in a manner that is concise, easily accessible and using clear and plain language.
4. Where wallet providers have revoked wallet unit attestations, they shall make publicly available the validity status of the wallet unit attestation in a privacy preserving manner and describe the location of that information in the wallet unit attestation.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
