Digital wallets

A digital wallet is an app that keeps your credentials on your phone and lets you present them. But it is not just a folder of files; it also carries the keys and rules needed to use those credentials safely.

What does a wallet hold?

• Credentials: an identity credential, a diploma, a ticket, a student certificate. For most credentials several single-use copies are kept; each presentation uses a different copy.
• Device keysA key made on the phone that binds credentials to the wallet and signs at presentation time. The goal is to keep it in the phone's secure hardware.: the keys binding the credentials to this phone. They are made on the phone and never leave it.
• Wallet attestationA statement signed by the wallet provider that this app is a genuine, compliant wallet.: the wallet provider's signed statement that this app is a genuine wallet following the rules. Issuers check it before issuing.
• Transaction log: a record of which credential you showed to whom. It stays on your phone; you can export it encrypted if you wish.

Where does security come from?

The credentials themselves are not secret; what is valuable is the keys that let you present them. So the keys live in the phone's secure hardware, the app opens with a lock (PIN or biometrics), and every presentation asks for your consent. The wallet never sends a credential anywhere without your approval.

What if the phone is lost?

Whoever finds the phone cannot use your credentials: they are bound to that phone's keys and the app is locked. You can switch off the wallet on the lost phone remotely. On a new phone you verify your identity again and collect your credentials from the institutions again. Your pseudonyms on websites are derived from your identity, so they come back unchanged; you do not lose your accounts.