Key storage and management interfaces​

[riittapartala]

Summary

Implementation of key management and storage interfaces to the reference implementation allowing the keys to be stored in an external solution (e.g. cloud or NFC card). Currently extensions for key management are supported only on configuration level in the apps.

The wallet-core/kit modules are refactored to support multiple implementations of the SecureArea interface for key management per document. Wallet core will provide a default secure area implementation based on AndroidKeystore. Support for multiple secure areas will enable wallet-core consumers to select a specific secure area for managing and storing keys for each document individually during the issuing process.

ARF: 4.2.1 Interfaces and protocols: The Secure Cryptographic Interface (SCI)

Scope

• Support interfaces for multiple implementations of the SecureArea interface for key management. For example, it will be possible to implement an on-device, remote cloud and external secure areas.
• Support interfaces each document choosing one of the available secure areas for key management
• Continue to provide a default secure area implementation based on AndroidKeystore/SecureEnclave.

Out of scope:
Implementation of remote cloud or external secure areas (implementors have all the relative interfaces to proceed with such implementations)

Technical break-down

List the associated technical tasks that fall under this epic.

• Secure Area protocol and default iOS implementations eudi-lib-ios-wallet-kit#112
• Enable Multiple SecureArea Implementations in wallet-core for Key Management eudi-lib-android-wallet-core#93
  • Decouple DocumentManagerImpl from AndroidKeystore-Based SecureArea and Support Custom Implementations eudi-lib-android-wallet-document-manager#47
  • Decouple TransferManagerImpl from AndroidKeystore-Based SecureArea eudi-lib-android-iso18013-data-transfer#33

Note

If you have any questions or comments about the features listed on the roadmap or wish to suggest new features, please reach out via Discussion