August brought one Yivi app release and one release of the Go library underneath it. App version 8.2.0 was published on 14 August and reached the App Store, Google Play and F-Droid. Version 1.3.0 of irmago, the Go implementation doing the wallet's actual work, was published on 12 August, and app 8.2.0 pins that version.
The EUDI wallet ecosystem is being built for Level of Assurance "high", which means resistance against attackers with a high attack potential, up to and including state actors. Yet almost every cryptographic mechanism it standardises on today, from the signatures on your credentials to the TLS between its servers, is exactly the kind of asymmetric cryptography that a large quantum computer breaks. This post is about that gap, and about why "we will get to it later" is a harder position to defend for a high-assurance wallet than for almost any other system on the internet.
A first look at the new trust system coming to the Yivi wallet: the ways an issuer or verifier can prove who it is, why a valid signature is not the same as a party you should trust, how the EU's new ETSI TS 119 602 trust lists became our backbone, and what it will take to earn the wallet's top trust level.
A field guide to the attestation triad behind a Level of Assurance High wallet, WIA, WUA and key attestation, why the EU Age Verification App failed exactly here, and how app attestation closes the gap.
A security analysis of the EU Age Verification Wallet reveals a privacy-first design with a critical trust gap that undermines its security guarantees.