User authentication by the WSCD

[vilmosa]

“the WSCD authenticates the User prior to or during requesting User approval”

• It is the WSCA and not the WSCD which can authenticate the user.
• In case biometric authentication is foreseen to be used, then in-phone secure elements (eSE, SIM, eSIM) cannot support this requirement, because authentication is performed by the handset itself and only the result is forwarded to the WSCD.

[sander]

• It is the WSCA and not the WSCD which can authenticate the user.

High level requirements RBA_10 and WTE_02 in v1.4.0 seem to agree:

A Wallet Instance SHALL ensure that the WSCA has authenticated the User, before allowing the User to give or refuse approval for releasing any attributes.

A WSCA SHALL authenticate the User before performing any cryptographic operation involving a private or secret key of a Wallet Instance (i.e., a WTE key) or of an attestation in a Wallet Instance.

---

• In case biometric authentication is foreseen to be used, then in-phone secure elements (eSE, SIM, eSIM) cannot support this requirement, because authentication is performed by the handset itself and only the result is forwarded to the WSCD.

Did handset biometric authentication ever make it through eIDAS peer reviews for LoA High?

[digeorgi]

Thank you for your review comment. This is indeed misleading and will be updated to provide clarity in the next ARF version.