11.1.1. Credential Issuance High-Level Flows

11.1.1.1. High-Level PID flow

This flow applies after the condition in PID issuance before EUDIW notification. Until then, the High-Level IT-Wallet ID flow applies.

The Fig. 11.1 shows a general architecture and highlights the main operations involved in the issuance of a PID.

The figure illustrates the general architecture and high level flow for PID issuance.

Fig. 11.1 PID Issuance - General architecture and high level flow.

The high-level flow begins with the User who wants to obtain a PID and starts his/her Wallet Instance (Step 0). Below the description of the steps represented in the previous picture:

  1. PID Provider Discovery and Trust: the Wallet Unit discovers the trusted PID Provider using the Digital Credential Catalogue. Issuance of a PID uses the EUDIW Trust Framework, as specified in Selection at Issuance. The Wallet Unit obtains metadata that discloses the formats of the PID, the algorithms supported and other interoperability parameters (WP_045–046).

  2. PID Request: the Wallet Unit requests the PID using the Authorization Code Grant supported by the PID Provider (WP_051).

  3. Wallet Provider Discovery and Trust: the PID Provider checks the authenticity and validity of the Wallet Instance. The PID Provider establishes the trust to the Wallet Provider and obtains Wallet metadata with the parameters required for interoperability needs, according to the Trust Model.

  4. User Authentication: the PID Provider authenticates the User according to User Authentication Method Selection.

  5. Fetch of PID data from National Public Registry: the PID Provider obtains the required PID data from National Public Registry (ANPR) which acts as Authentic Source.

  6. PID Issuance: the PID Provider releases a PID bound to the key material held by the requesting Wallet Instance.

11.1.1.2. High-Level IT-Wallet ID flow

The Fig. 11.2 shows a general architecture and highlights the main operations involved in the issuance of an IT-Wallet ID.

The figure illustrates the general architecture and high level flow for IT-Wallet ID issuance.

Fig. 11.2 IT-Wallet ID Issuance - General architecture and high level flow.

The high-level flow begins with the User who wants to obtain a IT-Wallet ID and starts his/her Wallet Instance (Step 0). Below the description of the steps represented in the previous picture:

  1. IT-Wallet ID Provider Discovery and Trust: the Wallet Unit discovers the trusted IT-Wallet ID EAA Provider using the Digital Credential Catalogue. Issuance of the IT-Wallet ID uses the National Trust Framework, as specified in Selection at Issuance. The metadata discloses the formats of the IT-Wallet ID, the algorithms supported, and other interoperability parameters (WP_045-046).

  2. IT-Wallet ID Request: the Wallet Unit requests the IT-Wallet ID using the Authorization Code Grant(WP_051).

  3. Wallet Provider Discovery and Trust: the IT-Wallet ID EAA Provider checks the authenticity and validity of the Wallet Instance. The IT-Wallet ID EAA Provider establishes the trust to the Wallet Provider and obtains Wallet metadata with the parameters required for interoperability needs, according to the Trust Model.

  4. User Authentication: the IT-Wallet ID EAA Provider authenticates the User according to User Authentication Method Selection. For the L2+ protocol flow, see eID Substantial Authentication with MRTD Verification for IT-Wallet ID Issuance.

  5. Fetch of IT-Wallet ID data from National Public Registry: the IT-Wallet ID EAA Provider obtains the required IT-Wallet ID data from National Public Registry (ANPR) which acts as Authentic Source.

  6. IT-Wallet ID Issuance: the IT-Wallet ID EAA Provider releases a IT-Wallet ID bound to the key material held by the requesting Wallet Instance.

11.1.1.3. High-Level EAA flow

The Fig. 11.3 shows a general architecture and highlights the main operations involved in the issuance of a EAA. The assumptions are listed below.

  • The User has a valid PID stored in the Wallet Instance, or a valid IT-Wallet ID when requested according to User Authentication Method Selection.

  • The (Q)EAA requires a high security implementation profile.

The figure illustrates the general architecture and high level flow for EAA issuance.

Fig. 11.3 EAA Issuance - General architecture and high level flow.

Similarly to the PID and IT-Wallet ID high-level flow, the above diagram depicts a National EAA high-level flow starting from the User who wants to obtain an EAA (step 0). Below the description of the most relevant operations involved in the EAA issuance:

  1. EAA Provider Discovery and Trust: the Wallet Unit obtains the list of trusted EAA Providers using the Digital Credential Catalogue and selects the Trust Framework as specified in Selection at Issuance. It then inspects the metadata for the Digital Credentials offered by each Provider (WP_045–046).

  2. EAA Request: the Wallet Unit requests an EAA using the Authorization Code Grant or the Pre-Authorized Code Grant, as specified in Digital Credential Issuance (WP_051).

  3. Wallet Provider Discovery and Trust: the EAA Provider verifies the authenticity and validity of the Wallet Instance. During this step the EAA Provider establishes trust with the Wallet Provider and retrieves Wallet metadata containing the necessary parameters for interoperability, as defined by the Trust Model.

  4. User Authentication: the EAA Provider, acting as a Relying Party Instance, authenticates the User according to User Authentication Method Selection.

  5. Obtaining Attributes: the EAA Provider fetches User attributes from the relevant Authentic Source.

  6. EAA Issuance: the EAA Provider releases a EAA bound to the key material held by the requesting Wallet Instance.