Wallet secure cryptographic application (WSCA)

WSCA is the software component in the EUDI Wallet that manages cryptographic keys, working with the WSCD device to bind and present attestations.

WSCA (Wallet Secure Cryptographic Application) is the software component, defined in the EUDI Wallet's Architecture and Reference Framework, that manages and protects the cryptographic keys and operations of a Wallet Unit: generating key pairs, performing the cryptographic binding of attestations to the wallet, and producing the signatures used to present attributes to a relying party. Together with the Wallet Instance - the application the user interacts with - the WSCA and the WSCD make up what the ARF calls the Wallet Unit. The WSCA is linked to a WSCD (wallet secure cryptographic device) and uses the cryptographic functions that device provides - the certified, tamper-resistant environment in which the private keys live, a role comparable to how a QSCD protects signature creation data for qualified signatures. The two are not necessarily one thing: the reference framework states that WSCA and WSCD do not have to be coupled, and where the WSCD is a remote HSM the WSCA may, but need not, be a dedicated firmware module. Before the WSCA/WSCD combination performs a cryptographic operation, the wallet holder must authenticate, for example with a PIN or biometric check - the mechanism that enforces sole control over the keys. The WSCD and WSCA combination must be certified - under the wallet certification scheme set out in Implementing Regulation (EU) 2024/2981, which can draw on standards such as Common Criteria - to support the high level of assurance the EUDI Wallet requires.

A WSCD can be local (a secure element or embedded chip on the user's device, or a separate local device such as a smart card or secure token), or remote (an HSM-backed service operated by a wallet provider). Which configuration is used affects the assurance level the wallet instance can claim and how sole control over the keys is enforced.