11.1. Digital Credential Issuance

This section describes the PID and (Q)EAAs issuance flow with a high level of security. The high-level flows are specified in Credential Issuance High-Level Flows.

Issuance uses [OpenID4VCI], profiled by [OPENID4VC-HAIP], as required by [CIR2024/2982], and is controlled by [ETSI TS 119 472-3]. Support for the Authorization Code Grant is specified in Low-Level Issuance Flow. Where [ETSI TS 119 472-3] requests it, the Wallet Unit supports the Pre-Authorized Code Grant.

The applicable Trust Framework is selected as specified in Selection at Issuance.

The scheme for Credential Offers in the EUDI Wallet flow is specified in Credential Offer Flow. PID issuance before EUDIW notification is specified in PID issuance before EUDIW notification.

Credential Issuance Table of Contents

• 11.1.1. Credential Issuance High-Level Flows
  • 11.1.1.1. High-Level PID flow
  • 11.1.1.2. High-Level IT-Wallet ID flow
  • 11.1.1.3. High-Level EAA flow
• 11.1.2. Credential Issuance Low-Level Flows
  • 11.1.2.1. Low-Level Issuance Flow
  • 11.1.2.2. Refresh Token Flow
    • 11.1.2.2.1. Security Considerations
  • 11.1.2.3. Re-Issuance Flow
    • 11.1.2.3.1. Re-Issuance Flow: Security Considerations
  • 11.1.2.4. Credential Offer Flow
    • 11.1.2.4.1. Non-normative Examples
• 11.1.3. eID Substantial Authentication with MRTD Verification for IT-Wallet ID Issuance
  • 11.1.3.1. Design Principles
  • 11.1.3.2. System Architecture
  • 11.1.3.3. High-Level Flow
  • 11.1.3.4. Session Management
  • 11.1.3.5. Low-Level Flow
    • 11.1.3.5.1. Phase 1: OAuth Authorization Request
    • 11.1.3.5.2. Phase 2: Primary Authentication
    • 11.1.3.5.3. Phase 3: MRTD PoP Validation Flow
    • 11.1.3.5.4. Phase 4: OAuth Authorization Response
  • 11.1.3.6. Error Management
    • 11.1.3.6.1. MRTD PoP Response Errors
    • 11.1.3.6.2. MRTD PoP Validation Response Errors
    • 11.1.3.6.3. HTTP Status Code Mapping
  • 11.1.3.7. Security Considerations
    • 11.1.3.7.1. Secure Session Management
    • 11.1.3.7.2. Cryptographic Challenge Generation
    • 11.1.3.7.3. Nonce Lifecycle Management
    • 11.1.3.7.4. EAA Provider Metadata
    • 11.1.3.7.5. Security Controls
  • 11.1.3.8. Implementation Considerations