Wallet secure cryptographic device (WSCD)
WSCD (Wallet Secure Cryptographic Device): secure hardware or service in the EUDI Wallet storing keys, can be QSCD-certified for qualified signatures.
WSCD (Wallet Secure Cryptographic Device) is the secure cryptographic component defined in the EUDI Wallet's Architecture and Reference Framework that generates and stores the private keys of a wallet instance and performs the cryptographic operations - signing, key agreement - needed for wallet use. Together with the wallet instance, the WSCA and the WSCD form what the ARF calls a wallet unit. The WSCA is the secure application that is linked to the WSCD and exposes its functions to the wallet instance; the two do not have to be coupled, so the WSCA does not necessarily run inside the device. Using a key normally requires the wallet holder to authenticate first, for example with a PIN or a biometric check.
The WSCD also holds the device-bound keys behind the wallet unit attestation - since ARF 1.5 the name for what earlier versions called wallet trust evidence, made up of a wallet instance attestation and a key attestation. Note who may see it: the ARF requires a wallet unit to present those attestations only to a PID provider or attestation provider during issuance, and not to a relying party. A verifier's assurance that a presentation comes from a genuine wallet therefore rests on the cryptographic binding of the attestation it receives, not on being handed the wallet's own attestation. The ARF allows several deployment models: a secure element built into the user's smartphone, an external device such as a smart card, or a remote service backed by an HSM and operated by a wallet provider or qualified trust service provider (QTSP). Certifying a WSCD's security normally happens as part of certifying the whole wallet solution under Implementing Regulation (EU) 2024/2981, though a component such as a Common Criteria-certified secure element can have its own certificate reused as evidence in that solution-level assessment. A WSCD underpins the wallet's assurance level High.
Where a WSCD meets the eIDAS Annex II requirements it is certified as a QSCD, giving the wallet holder a device capable of creating qualified electronic signatures or seals directly from the wallet. eIDAS 2.0 requires wallet providers to offer this qualified signature creation free of charge to natural persons for non-professional purposes, which is one reason QSCD-grade WSCDs matter. Which model a wallet uses affects usability, cost and where liability for key protection sits.