IT-Wallet Technical Documentation

These Technical Specifications define the technical architecture, the implementation framework and the design requirements to be adopted by IT-Wallet Solutions. These Technical Specifications complement the Guidelines provided for in Article 64-quater of Legislative Decree No. 82 of 7 March 2005 (CAD) and, once formally adopted, form part of the regulatory framework for the IT-Wallet System. These Technical Specifications are drafted through an open and collaborative process. This version of these Technical Specifications enables the notification of the IT-Wallet System to the European Commission. The notification is in conformity with the eIDAS Regulation ([EIDAS], as amended by [EU_2024_1183]) and its implementing regulations.

In Italy, Decree-Law No. 19 of 2 March 2024, converted, with amendments, by Law No. 56 of 29 April 2024, introduced Article 64-quater of Legislative Decree No. 82 of 7 March 2005, establishing the Italian Digital Wallet System - IT-Wallet System. The IT-Wallet System allows natural or legal persons to access public and private services through the secure presentation of Digital Credential, attesting to entitlements, delegations, characteristics, licenses or qualifications. Article 64-quater also provides for the adoption of one or more implementing decrees (decreti attuativi) to define the rules governing the operation of the IT-Wallet System. The decrees include the roles of the entities involved, technical and security requirements, and principles of economic sustainability.

Table of Contents

• 1. Introduction
  • 1.1. Scope
  • 1.2. Normative Language and Conventions
  • 1.3. How to Read the Specification
    • 1.3.1. Specification Structure Overview
    • 1.3.2. Reading Paths by Role
• 2. Brand Identity
  • 2.1. Naming
  • 2.2. Visual Identity
    • 2.2.1. Logo
    • 2.2.2. Trust Mark
• 3. Architecture Overview
• 4. User Experience Design
  • 4.1. Design Principles
  • 4.2. Functionalities Overview
  • 4.3. Activation of the Wallet Instance
    • 4.3.1. Focus on Person Identification Attestations
  • 4.4. Issuance of Electronic Attestations of Attributes
    • 4.4.1. Issuance from the Wallet Instance Catalog
    • 4.4.2. Issuance from a Touchpoint of the Authentic Source
    • 4.4.3. Focus on Electronic Attestations of Attributes
  • 4.5. Presentation of Electronic Attestations
    • 4.5.1. Proximity Presentation
    • 4.5.2. Remote Presentation
  • 4.6. Management of Electronic Attestations
    • 4.6.1. Status of Electronic Attestations
    • 4.6.2. Transaction Logging
    • 4.6.3. Backup and Restore of Electronic Attestation of Attributes
  • 4.7. Deactivation of the Wallet Instance
  • 4.8. Error Management
    • 4.8.1. Activation of the Wallet Instance Errors
    • 4.8.2. Issuance of Electronic Attestations of Attributes Errors
    • 4.8.3. Presentation of Electronic Attestations Errors
    • 4.8.4. Management of Electronic Attestations Errors
    • 4.8.5. Deactivation of the Wallet Instance Errors
  • 4.9. User Assistance
  • 4.10. User Feedback
    • 4.10.1. Transactional Feedback Collection
    • 4.10.2. Relational Feedback Collection
• 5. Infrastructure of Trust
  • 5.1. Overview
  • 5.2. PKI Architecture
    • 5.2.1. Certification Hierarchies
    • 5.2.2. Design Principles
  • 5.3. X.509 Certificate Profile
  • 5.4. Common Trust Artifacts
    • 5.4.1. Entity Sign/Seal Certificate Profile
    • 5.4.2. Trust Anchor Certificate Profile
  • 5.5. EUDIW Trust Artifacts
    • 5.5.1. Register of WRPs
    • 5.5.2. Wallet-Relying Party Access Certificate (WRPAC) Profile
    • 5.5.3. Registrar Sign/Seal Certificate Profile
    • 5.5.4. Wallet-Relying Party Registration Certificate (WRPRC) Profile
    • 5.5.5. Trusted List, Lists of Trusted Lists, and Lists of Trusted Entities
    • 5.5.6. Embedded Disclosure Policy (EDP)
  • 5.6. National Trust Artifacts
    • 5.6.1. Federation API Endpoints
    • 5.6.2. Entity Statements
    • 5.6.3. Entity Statement Examples
    • 5.6.4. Trust Marks
  • 5.7. Trust Management and Lifecycle
    • 5.7.1. Trust Artifacts Lifecycle State Machine
    • 5.7.2. Federation Entity Key Rotation
    • 5.7.3. Revocation Mechanisms
• 6. Trust Evaluation Process
  • 6.1. Trust Framework Selection
    • 6.1.1. Selection at Issuance
    • 6.1.2. Selection at Presentation
    • 6.1.3. Failure Handling
  • 6.2. Trust Evaluation in the EUDIW Trust Framework
    • 6.2.1. EUDIW Trust Evaluation Processes by Context
    • 6.2.2. EUDIW Trust Anchor Validation
    • 6.2.3. X509 Certificate Chain Validation Algorithm
    • 6.2.4. EUDIW Attestation Signature Validation
    • 6.2.5. EUDIW Authentication
    • 6.2.6. EUDIW Authorization
    • 6.2.7. EUDIW Metadata Retrieval and Validation
  • 6.3. Trust Evaluation in the National Trust Framework
    • 6.3.1. Trust Evaluation Processes by Context
    • 6.3.2. Federation Trust Anchor Distribution and Validation
    • 6.3.3. Trust Chain Validation
    • 6.3.4. Signing Trust Anchor Distribution and Validation
    • 6.3.5. Wallet Trust Anchor Distribution and Validation
    • 6.3.6. Authentication Trust Anchor Distribution
    • 6.3.7. Authentication
    • 6.3.8. Authorization
    • 6.3.9. Metadata Retrieval and Validation
  • 6.4. Authorization Decision and Override Rules
    • 6.4.1. Override Principles
• 7. Registry Infrastructure
  • 7.1. Registries and Catalogues of the Ecosystem
  • 7.2. Registry Discovery Endpoint
    • 7.2.1. Registry Discovery Endpoint Parameters
    • 7.2.2. Content Negotiation and Signed Representation
  • 7.3. Taxonomy
    • 7.3.1. Taxonomy Objectives
    • 7.3.2. Taxonomy Usage
    • 7.3.3. Digital Credentials Hierarchy
    • 7.3.4. Taxonomy Structure
  • 7.4. Claims Registry
    • 7.4.1. Claims Registry Usage
    • 7.4.2. Claims Registry Structure
  • 7.5. Authentic Source Registry
    • 7.5.1. Authentic Source Registry Usage
    • 7.5.2. Authentic Source Registry Structure
  • 7.6. Schema Registry
    • 7.6.1. Schema Registry Objectives
    • 7.6.2. Schema Registry Usage
    • 7.6.3. Catalogue of Attestations
  • 7.7. Digital Credentials Catalog
    • 7.7.1. Digital Credentials Catalog Usage
    • 7.7.2. Digital Credentials Catalog Retrieval
    • 7.7.3. Digital Credentials Catalog Structure
    • 7.7.4. Decentralization of Display and Claim Information
  • 7.8. Registry Integration and Cross-References
  • 7.9. Registry Infrastructure Usage Journeys
    • 7.9.1. Catalog Browsing
    • 7.9.2. Credential Issuance
    • 7.9.3. Credential Presentation and Verification
    • 7.9.4. Cross-border Attribute Verification by a QTSP
• 8. Onboarding System and Lifecycle Management
  • 8.1. Overview
    • 8.1.1. System Actors and Roles
    • 8.1.2. System Components and Services
  • 8.2. Registration Model
    • 8.2.1. Registration Data Model
    • 8.2.2. Mapping to the Registry Data Models
    • 8.2.3. Eligibility and Compliance Preconditions
    • 8.2.4. Trust Artifacts Registration Outcomes
    • 8.2.5. Registration Profiles
  • 8.3. Onboarding Processes
    • 8.3.1. Process Dependency Map
    • 8.3.2. Entity Onboarding
    • 8.3.3. Certificate and Trust Artifact Issuance
    • 8.3.4. Attestation Onboarding
  • 8.4. Notification and Publication
    • 8.4.1. Notification and Publication: Input
    • 8.4.2. Notification and Publication: Outcome
    • 8.4.3. Notification and Publication: Process
  • 8.5. Lifecycle Management
    • 8.5.1. Entity Lifecycle State Machine
    • 8.5.2. Registration Events and Their Governance
    • 8.5.3. Entity Updates and Their Effects on Trust Artifacts
    • 8.5.4. Credential Type Lifecycle
    • 8.5.5. Claims and Schemas Lifecycle
    • 8.5.6. Authentic Source Lifecycle and PDND Alignment
    • 8.5.7. Events, Registries and Trust Artifacts
• 9. Entities
  • 9.1. Wallet Solution
    • 9.1.1. Wallet Solution Requirements
    • 9.1.2. Wallet Solution Components
    • 9.1.3. Wallet Solution Interaction Patterns
    • 9.1.4. Wallet Instance
    • 9.1.5. Backup and Restore
    • 9.1.6. Wallet Provider Entity Configuration
    • 9.1.7. Wallet Solution Metadata
  • 9.2. Credential Issuer Solution
    • 9.2.1. Credential Issuer Requirements
    • 9.2.2. Component Details
    • 9.2.3. Interaction Patterns
    • 9.2.4. Credential Issuer Entity Configuration
    • 9.2.5. Credential Issuer Metadata
  • 9.3. Relying Party Solution
    • 9.3.1. Relying Party Instance
    • 9.3.2. Mobile Relying Party Instance
    • 9.3.3. Web Relying Party Instance
    • 9.3.4. Relying Party Entity Configuration
    • 9.3.5. Relying Party Metadata
  • 9.4. Authentic Sources
• 10. Digital Credential Management
  • 10.1. Digital Credential Data Model
    • 10.1.1. Format-Agnostic Credential Metadata Attributes
    • 10.1.2. SD-JWT-VC Credential Format
    • 10.1.3. mdoc-CBOR Credential Format
    • 10.1.4. Cross-Format Credential Parameters Mapping
  • 10.2. PID Data Model
    • 10.2.1. PID issuance before EUDIW notification
    • 10.2.2. PID attributes
    • 10.2.3. PID Data Model in SD-JWT VC Format
    • 10.2.4. PID Data Model in mdoc-CBOR Format
  • 10.3. IT-Wallet ID Data Model
    • 10.3.1. IT-Wallet ID Data Model in SD-JWT VC Format
  • 10.4. QEAA and PuB-EAA Data Model
    • 10.4.1. Scope
    • 10.4.2. Category
    • 10.4.3. Issuer Identification
    • 10.4.4. Attestation Identity
    • 10.4.5. Subject
    • 10.4.6. Technical and Administrative Validity
    • 10.4.7. Status and Short-Lived Attestations
    • 10.4.8. Components Not Used
    • 10.4.9. SD-JWT VC Profile
    • 10.4.10. mdoc-CBOR Profile
    • 10.4.11. Verification
    • 10.4.12. Non-normative Examples
  • 10.5. Digital Credential Lifecycle
    • 10.5.1. Credential Transitions
    • 10.5.2. Digital Credential Lifecycle in a Batch
    • 10.5.3. Credential Lifecycle Management
    • 10.5.4. Validity Verification Mechanisms
• 11. Digital Credential Flows
  • 11.1. Digital Credential Issuance
    • 11.1.1. Credential Issuance High-Level Flows
    • 11.1.2. Credential Issuance Low-Level Flows
    • 11.1.3. eID Substantial Authentication with MRTD Verification for IT-Wallet ID Issuance
  • 11.2. Digital Credential Presentation
    • 11.2.1. Remote Flow
    • 11.2.2. Proximity Flow
    • 11.2.3. Identity Matching and Identity Reconciliation
  • 11.3. Wallet Metadata Retrieval Flow
• 12. Endpoints
  • 12.1. Wallet Provider Endpoints
    • 12.1.1. Federation Endpoint
    • 12.1.2. Wallet Solution Nonce Endpoint
    • 12.1.3. Wallet Instance Management Endpoint
    • 12.1.4. Wallet Instance Attestation Issuance Endpoint
    • 12.1.5. Key Attestation Issuance Endpoint
    • 12.1.6. Token Status List (Wallet Unit Attestation Profile)
    • 12.1.7. e-Service PDND Wallet Provider Catalog
  • 12.2. Credential Issuer Endpoints
    • 12.2.1. Metadata Endpoints
    • 12.2.2. Credential Issuance Endpoints
    • 12.2.3. e-Service PDND Credential Issuer Catalog
  • 12.3. Relying Party Endpoints
    • 12.3.1. Relying Party Remote Flow Endpoints
    • 12.3.2. Relying Party Provider Backend Endpoints
  • 12.4. Authentic Source Endpoints
    • 12.4.1. e-Service PDND Authentic Source Catalog
  • 12.5. PDND Signal Hub Endpoints
    • 12.5.1. Prerequisites
    • 12.5.2. Signal Hub e-Services
    • 12.5.3. Signals Processing
• 13. Cryptographic Algorithms
• 14. Security and Privacy Considerations
  • 14.1. Security Requirements
    • 14.1.1. SR-CF-10 and SR-E-10
    • 14.1.2. SR-CF-20
    • 14.1.3. SR-CF-21
    • 14.1.4. SR-E-20
    • 14.1.5. SR-E-30
    • 14.1.6. SR-E-40
    • 14.1.7. SR-I-10
    • 14.1.8. SR-I-20
    • 14.1.9. SR-I-30
    • 14.1.10. SR-I-40
    • 14.1.11. SR-I-50
    • 14.1.12. SR-P-20
    • 14.1.13. SR-P-30
    • 14.1.14. SR-P-40
    • 14.1.15. SR-P-41
    • 14.1.16. SR-P-50
    • 14.1.17. SR-V-10
    • 14.1.18. SR-V-20
    • 14.1.19. SR-W-20
    • 14.1.20. SR-W-30
  • 14.2. Privacy Requirements
    • 14.2.1. PR-CF-30
    • 14.2.2. PR-CF-40
    • 14.2.3. PR-E-60
    • 14.2.4. PR-E-70
    • 14.2.5. PR-W-40
    • 14.2.6. PR-W-60
    • 14.2.7. PR-W-70
  • 14.3. Security and Privacy Requirements
    • 14.3.1. SPR-E-50
    • 14.3.2. SPR-P-10
    • 14.3.3. SPR-P-60
    • 14.3.4. SPR-P-70
    • 14.3.5. SPR-P-80
    • 14.3.6. SPR-W-50
• 15. General Log Retention Policies
  • 15.1. ISO/IEC 27001 Logging General Requirements
    • 15.1.1. Wallet Provider Log Retention Policy
    • 15.1.2. Credential Issuer Log Retention Policy
    • 15.1.3. Authentic Source Log Retention Policy
    • 15.1.4. Relying Party Log Retention Policy
    • 15.1.5. Wallet Instances Logging Features
• 16. Defined Terms and References
  • 16.1. Defined Terms and Acronyms
    • 16.1.1. Acronyms
  • 16.2. Normative References
    • 16.2.1. Official Resources
  • 16.3. Technical References
    • 16.3.1. Wallet Architecture and Reference Frameworks
    • 16.3.2. EUDI Wallet Standards and Technical Specifications
    • 16.3.3. Infrastructure of Trust
    • 16.3.4. Digital Credential Data Format
    • 16.3.5. Digital Credential Issuance
    • 16.3.6. Digital Credential Presentation
    • 16.3.7. Digital Credential Revocation Check Mechanisms
    • 16.3.8. National Data Interoperability Platform Specifications
    • 16.3.9. National Digital Identity Platform Specifications
    • 16.3.10. Security and Protection Profiles
• 17. How to contribute
  • 17.1. Acknowledgements
• 18. Open Source Releases
  • 18.1. 1. General Principles
  • 18.2. 2. Standard Requirements
    • 18.2.1. 2.1 Licensing
    • 18.2.2. 2.2 Code Management & Transparency
    • 18.2.3. 2.3 Security & Quality
  • 18.3. 3. Wallet Providers
    • 18.3.1. 3.1 Mandatory Open Source
  • 18.4. 4. Credential Issuers and Relying Parties
    • 18.4.1. 4.1 Integration components
    • 18.4.2. 4.2 Backend infrastructure
  • 18.5. 5. Responsible Disclosure and Vulnerability Management
• 19. Appendix
  • 19.1. Mobile Application Instance
    • 19.1.1. Mobile Application Instance Initialization
  • 19.2. e-Service PDND
    • 19.2.1. Requirements and Security Patterns
    • 19.2.2. PDND Voucher Issuance
    • 19.2.3. Key Retrieval
    • 19.2.4. e-Service Usage
  • 19.3. PDND e-Service Template
    • 19.3.1. PDND Template e-service definition and guidelines
  • 19.4. Test Plans
    • 19.4.1. Structure of the Test Matrix