Wallet unit

The configuration a wallet provider gives one user: wallet instance plus secure application and device. Certification and revocation apply here.

The unit of a wallet that actually belongs to somebody. The reference framework defines it as a unique configuration of a wallet solution that includes the wallet instances, the wallet secure cryptographic applications and the wallet secure cryptographic devices that a wallet provider provides to an individual wallet user.

The distinction matters because three words get used interchangeably in conversation and mean different things in the specifications. A wallet solution is the product a provider builds. A wallet instance is the app installed on this user's device. A wallet unit is the whole working configuration for that one user - the instance plus the secure application and device that hold the keys. Certification, revocation and attestation all apply at the level of the unit, not the app icon.

That is also why a relying party can ask a wallet to prove something about itself. A wallet unit attestation is a data object describing the components of the unit, so a verifier can establish that it is talking to a genuine, certified, non-revoked wallet before it accepts an attestation of attributes from it. Combined with cryptographic binding, that is what stops a copied credential from being presented from a hostile app.