Skip to main content

OWASP MAS EUDI Wallet profile

External requirement set

This is not one of the Dutch scheme documents. It is a requirement set published by the OWASP Mobile Application Security (MAS) project, which the Dutch cybersecurity certification scheme uses. Texts © OWASP Foundation, licensed under CC BY 4.0. Source: OWASP MAS-EUDIW.

How the Dutch scheme uses it​

NL-CS Part 1 section 4.4 says that "the required test set is built on OWASP MAS". The scheme references OWASP MAS material and does not reproduce it; the evaluation plan pins the version of every OWASP deliverable used and records its draft status where applicable (NL-CS Part 1 §4.4, p. 14). The section lists:

  • OWASP MASVS v2.1.0, whose categories structure the required test set;
  • OWASP MASWE v1.0: required tests and the test-to-requirement mapping are identified by MASWE identifier;
  • OWASP MASTG for the test procedures, in the version current when the evaluation plan is issued;
  • the OWASP MAS testing profiles. The baseline combination for the wallet at assurance level high is L2 + R + P, marked "[FOR REVIEW]";
  • the OWASP MAS EUDI Wallet profile (W), "applied on top". NL-CS Part 1 describes it as "Draft as at the date of this version and not yet normative".

The same test set is referred to for penetration testing (EN 17640 task 6.10) in NL-CS Part 2 §4.3 (p. 14), and in the evaluation instruction NL-CS Part 3 §4.7 (p. 11). The draft protection profile's mapping of each FSR and RSR to OWASP MAS shall be re-keyed to MASWE v1.0 identifiers before issue (NL-CS Part 1 §4.3, p. 13).

Different numbering in NL-CS-WI

NL-CS-WI Annex C maps the Wallet Instance requirements to "OWASP Requirements" with an earlier numbering and wording. For example, its "#9 - The app rotates cryptographic keys regularly" is #15 in version v1.0 below. The numbers in Annex C do not refer to this list.

About this version​

  • Catalogue: EUDI Wallet MAS Profile – Security Requirements, version v1.0, status Final, last updated 15.09.2026.
  • Authors: Carlos Holguera, Jeroen Beckers, Sven Schleier. Reviewers: Erik van Zuuren, Chris DeVuyst, Petteri Ihalainen.
  • Requirements: 78. Requirement #75 is marked "OUT OF SCOPE for the OWASP MAS EUDIW Profile"; the OWASP web page lists the other 77, with the same texts.
  • Each requirement is mapped to an OWASP MASWE weakness and MASVS category, and to the threats (TR), technical threats (TT) and risks (R) of the risk register for European Digital Identity Wallets.
  • Official downloads: Requirements Catalogue (spreadsheet) and Practical Guidelines (PDF), both linked from the OWASP MAS-EUDIW page.
  • All 78 requirements are also in the requirement search and the requirement data sets.

MASVS-STORAGE​

#1 — The app encrypts sensitive data stored in private storage.​

MASWE: MASWE-0001: Sensitive Data Stored Unencrypted in Private Storage

#2 — The app encrypts sensitive data stored outside of private storage.​

MASWE: MASWE-0002: Sensitive Data Stored Unencrypted Outside of Private Storage

#3 — The app stores cryptographic keys inside the platform-provided secure keystore.​

MASWE: MASWE-0003: Cryptographic Keys Stored Outside of Platform Keystore

#4 — The app does not hardcode sensitive data in the application package.​

MASWE: MASWE-0004: Sensitive Data Hardcoded in the App Package

#5 — The app excludes sensitive data from application logs.​

MASWE: MASWE-0005: Insertion of Sensitive Data into Logs

  • Threats: TR33 - An attacker can extract logs or parts of them.
  • Technical threats: TT1 - Physical attacks - 1.2 Information leakage, TT2 - Errors and misconfigurations - 2.3 Development-time errors and system misconfigurations
  • Risks: R6 - Data disclosure
  • Example assets: Runtime / Crash Logs, Transaction / Usage Logs

#6 — The app excludes sensitive data from backups.​

MASWE: MASWE-0006: Sensitive Data Not Excluded From Backup

  • Threats: TR48 - An attacker can modify the content of backup and recovery data that should be exclusively under the user's control., TR54 - An attacker can read the content of backup and recovery data that should be exclusively under the user's control.
  • Technical threats: TT1 - Physical attacks - 1.1 Theft, TT1 - Physical attacks - 1.2 Information leakage, TT1 - Physical attacks - 1.3 Tampering
  • Risks: R5 - Data theft, R6 - Data disclosure, R8 - Data loss
  • Example assets: Migration Object, Other Backup Data

MASVS-CRYPTO​

#7 — The app properly encrypts sensitive data.​

MASWE: MASWE-0007: Improper Encryption

#8 — The app properly hashes sensitive data.​

MASWE: MASWE-0008: Improper Hashing

  • Threats: TR0x05 - An attacker can abuse the cryptographic implementation of the solution
  • Technical threats: TT2 - Errors and misconfigurations - 2.3 Development-time errors and system misconfigurations
  • Risks: R6 - Data disclosure, R7 - Data manipulation
  • Baseline configurations: approved cryptographic algorithms

#9 — The app properly uses Message Authentication Codes (MACs).​

MASWE: MASWE-0009: Improper Use of Message Authentication Code (MAC)

  • Threats: TR0x05 - An attacker can abuse the cryptographic implementation of the solution
  • Technical threats: TT2 - Errors and misconfigurations - 2.3 Development-time errors and system misconfigurations
  • Risks: R6 - Data disclosure, R7 - Data manipulation
  • Baseline configurations: approved cryptographic algorithms

#10 — The app properly generates cryptographic signatures.​

MASWE: MASWE-0010: Improper Generation of Cryptographic Signatures

#11 — The app properly verifies cryptographic signatures.​

MASWE: MASWE-0011: Improper Verification of Cryptographic Signature

#12 — The app properly generates random numbers.​

MASWE: MASWE-0012: Improper Random Number Generation

#13 — The app securely generates cryptographic keys.​

MASWE: MASWE-0013: Improper Cryptographic Key Generation

#14 — The app derives cryptographic keys using approved key derivation functions.​

MASWE: MASWE-0014: Improper Cryptographic Key Derivation

  • Threats: TR0x05 - An attacker can abuse the cryptographic implementation of the solution
  • Technical threats: TT2 - Errors and misconfigurations - 2.3 Development-time errors and system misconfigurations
  • Risks: R6 - Data disclosure, R7 - Data manipulation
  • Example assets: PIN Private Key, PIN Salt
  • Baseline configurations: approved cryptographic algorithms

#15 — The app rotates cryptographic keys regularly.​

MASWE: MASWE-0015: Cryptographic Key Rotation Not Implemented

#16 — The app restricts access to cryptographic keys.​

MASWE: MASWE-0016: Cryptographic Key Access Not Restricted

#17 — The app verifies that the device has a secure lock configured.​

MASWE: MASWE-0017: Device Secure Lock Not Enforced

  • Threats: TR131 - An attacker can steal an unlocked wallet device., TR0x02 - An attacker can execute sensitive functionality that should be protected by additional authentication.
  • Technical threats: TT2 - Errors and misconfigurations - 2.3 Development-time errors and system misconfigurations
  • Risks: R6 - Data disclosure, R7 - Data manipulation
  • Baseline configurations: Device Integrity State

MASVS-AUTH​

#18 — The app enforces authentication and authorization on its components.​

MASWE: MASWE-0018: Lack of Authentication or Authorization on App Components

  • Threats: TR0x11 - An attacker can bypass authentication and authorization of app components., TR0x13 - An attacker can obtain sensitive information through the clipboard
  • Technical threats: TT5 - Malicious actions - 5.2 Phishing and spoofing, TT1 - Physical attacks - 1.2 Information leakage
  • Risks: R1 - Creation or use of an existing electronic identity, R2 - Creation or use of a fake electronic identity, R3 - Creation or use of fake attributes

#19 — The app enables auto-fill support for credential providers.​

MASWE: MASWE-0019: Lack of Auto-fill Support for Credential Providers

  • Threats: TR0x05 - An attacker can abuse the cryptographic implementation of the solution, TR0x12 - An attacker can obtain sensitive information through shoulder surfing, TR0x13 - An attacker can obtain sensitive information through the clipboard
  • Technical threats: TT5 - Malicious actions - 5.2 Phishing and spoofing, TT5 - Malicious actions - 5.6 Supply chain attacks
  • Risks: R6 - Data disclosure
  • Example assets: Pseudonyms and Passkeys, Person Identification Data (PID)

#20 — The app implements local authentication securely.​

MASWE: MASWE-0020: Local Authentication Can Be Bypassed

#21 — The app does not allow fallback to non-biometric credentials for sensitive transactions.​

MASWE: MASWE-0021: Fallback to Non-biometric Credentials Allowed for Sensitive Transactions

  • Threats: TR0x05 - An attacker can abuse the cryptographic implementation of the solution
  • Technical threats: TT5 - Malicious actions - 5.2 Phishing and spoofing, TT2 - Errors and misconfigurations - 2.3 Development-time errors and system misconfigurations
  • Risks: R6 - Data disclosure
  • Example assets: Biometric Data / Templates, PIN
  • Baseline configurations: maximum failed authentication attempts

#22 — The app invalidates keys after any enrollment of new biometric data.​

MASWE: MASWE-0022: Crypto Keys Not Invalidated on New Biometric Enrollment

#23 — The app enforces step-up authentication before granting access to sensitive functionality.​

MASWE: MASWE-0023: Step-Up Authentication Not Implemented for Sensitive Actions

  • Threats: TR131 - An attacker can steal an unlocked wallet device., TR0x02 - An attacker can execute sensitive functionality that should be protected by additional authentication.
  • Technical threats: TT5 - Malicious actions - 5.2 Phishing and spoofing
  • Risks: R6 - Data disclosure, R7 - Data manipulation, R9 - Unauthorised transaction
  • Example assets: PIN, Biometric Data / Templates, Transactional Data
  • Baseline configurations: maximum failed authentication attempts

#24 — The app makes sensitive data inaccessible after session termination.​

MASWE: MASWE-0024: Sensitive Data Accessible After Session Termination

  • Threats: TR131 - An attacker can steal an unlocked wallet device., TR0x03 - An attacker can access sensitive data after session termination
  • Technical threats: TT5 - Malicious actions - 5.2 Phishing and spoofing, TT5 - Malicious actions - 5.3 Replay of messages
  • Risks: R6 - Data disclosure
  • Example assets: User Session State, PIN Private Key

#25 — The app ensures non-repudiation for critical actions.​

MASWE: MASWE-0025: Lack of Non-Repudiation for Critical Actions

  • Threats: TR0x05 - An attacker can abuse the cryptographic implementation of the solution, TR132 - An attacker can manipulate the system to prevent certain events from being logged.
  • Technical threats: TT1 - Physical attacks - 1.3 Tampering, TT2 - Errors and misconfigurations - 2.3 Development-time errors and system misconfigurations
  • Risks: R11 - Repudiation
  • Example assets: Hardware-Bound Private Key, User Consent Records

MASVS-NETWORK​

#26 — The app encrypts all network traffic.​

MASWE: MASWE-0026: Network Traffic Not Encrypted

  • Threats: TR31 - A request can be leaked to an attacker., TR105 - An attacker can perform man-in-the-middle attacks., TR0x05 - An attacker can abuse the cryptographic implementation of the solution
  • Technical threats: TT5 - Malicious actions - 5.1 Interception of information
  • Risks: R6 - Data disclosure, R14 - Surveillance
  • Example assets: Network Traffic
  • Baseline configurations: encrypted network traffic

#27 — The app validates certificates for all network traffic.​

MASWE: MASWE-0027: Insecure Certificate Validation

  • Threats: TR31 - A request can be leaked to an attacker., TR105 - An attacker can perform man-in-the-middle attacks., TR0x05 - An attacker can abuse the cryptographic implementation of the solution
  • Technical threats: TT5 - Malicious actions - 5.1 Interception of information
  • Risks: R6 - Data disclosure, R14 - Surveillance
  • Example assets: Trust Anchors and CA Certificates, Network Traffic
  • Baseline configurations: encrypted network traffic

#28 — The app correctly implements identity pinning.​

MASWE: MASWE-0028: Insecure Identity Pinning

  • Threats: TR31 - A request can be leaked to an attacker., TR105 - An attacker can perform man-in-the-middle attacks., TR0x05 - An attacker can abuse the cryptographic implementation of the solution
  • Technical threats: TT5 - Malicious actions - 5.1 Interception of information
  • Risks: R6 - Data disclosure, R9 - Unauthorised transaction, R14 - Surveillance
  • Example assets: Trust Anchors and CA Certificates, Network Traffic
  • Baseline configurations: encrypted network traffic

MASVS-PLATFORM​

#29 — The app securely handles deep links.​

MASWE: MASWE-0029: Insecure Deep Links

  • Threats: TR0x14 - An attacker can abuse deep links
  • Technical threats: TT1 - Physical attacks - 1.2 Information leakage
  • Risks: R6 - Data disclosure, R9 - Unauthorised transaction
  • Example assets: Authorization Codes and Access Tokens

#30 — The app uses the clipboard securely and only with user consent.​

MASWE: MASWE-0030: Improper Use of the Clipboard

  • Threats: TR0x11 - An attacker can bypass authentication and authorization of app components., TR0x13 - An attacker can obtain sensitive information through the clipboard
  • Technical threats: TT5 - Malicious actions - 5.2 Phishing and spoofing, TT1 - Physical attacks - 1.2 Information leakage
  • Risks: R6 - Data disclosure
  • Example assets: Person Identification Data (PID), User PII (other collected data)

#31 — The app only permits trusted app extensions to interact with it.​

MASWE: MASWE-0031: Allowing Untrusted App Extensions

  • Threats: TR0x15 - An attacker can abuse app extensions
  • Technical threats: TT1 - Physical attacks - 1.2 Information leakage
  • Risks: R5 - Data theft, R6 - Data disclosure

#32 — The app securely handles intents.​

MASWE: MASWE-0032: Insecure Intents

#33 — The app does not expose sensitive native functionality to WebView content.​

MASWE: MASWE-0033: Sensitive Native Functionality Exposed in WebViews

  • Threats: TR0x17 - An attacker can abuse WebViews
  • Technical threats: TT1 - Physical attacks - 1.2 Information leakage
  • Risks: R5 - Data theft, R6 - Data disclosure, R9 - Unauthorised transaction, R10 - Transaction manipulation
  • Example assets: PIN, Critical Private Keys (PID / attestation proof keys)

#34 — The app only allows trusted WebView content to access local resources.​

MASWE: MASWE-0034: WebViews Allow Access to Local Resources with Untrusted Content

  • Threats: TR0x17 - An attacker can abuse WebViews
  • Technical threats: TT1 - Physical attacks - 1.2 Information leakage
  • Risks: R5 - Data theft, R6 - Data disclosure, R9 - Unauthorised transaction, R10 - Transaction manipulation
  • Example assets: Wallet App Code & Resources

#35 — The app only allows trusted content in WebViews.​

MASWE: MASWE-0035: WebViews Loading Untrusted Content

  • Threats: TR0x17 - An attacker can abuse WebViews
  • Technical threats: TT1 - Physical attacks - 1.2 Information leakage
  • Risks: R5 - Data theft, R6 - Data disclosure, R9 - Unauthorised transaction, R10 - Transaction manipulation

#36 — The app does not unnecessarily expose sensitive data through its user interface.​

MASWE: MASWE-0036: Unnecessary Exposure of Sensitive Data via the User Interface

  • Threats: TR0x09 - An attacker can abuse the app via accessibility services, TR0x12 - An attacker can obtain sensitive information through shoulder surfing
  • Technical threats: TT1 - Physical attacks - 1.2 Information leakage
  • Risks: R4 - Identify theft, R5 - Data theft, R6 - Data disclosure, R9 - Unauthorised transaction, R10 - Transaction manipulation
  • Example assets: Person Identification Data (PID), PIN, User PII (other collected data)

#37 — The app does not unnecessarily expose sensitive data through system notifications.​

MASWE: MASWE-0037: Unnecessary Exposure of Sensitive Data via Notifications

  • Threats: TR0x09 - An attacker can abuse the app via accessibility services, TR0x12 - An attacker can obtain sensitive information through shoulder surfing
  • Technical threats: TT1 - Physical attacks - 1.2 Information leakage
  • Risks: R4 - Identify theft, R5 - Data theft, R6 - Data disclosure, R9 - Unauthorised transaction, R10 - Transaction manipulation
  • Example assets: Transactional Data, User PII (other collected data), Person Identification Data (PID)

#38 — The app removes or masks sensitive data from its views when moved to the background, when being recorded or when a screenshot is taken.​

MASWE: MASWE-0038: Insufficient Protection of Sensitive Data from Screenshots or Screen Recordings

  • Threats: TR0x03 - An attacker can access sensitive data after session termination, TR0x09 - An attacker can abuse the app via accessibility services
  • Technical threats: TT1 - Physical attacks - 1.2 Information leakage
  • Risks: R1 - Creation or use of an existing electronic identity, R5 - Data theft, R6 - Data disclosure, R9 - Unauthorised transaction, R10 - Transaction manipulation, R13 - Service disruption
  • Example assets: Person Identification Data (PID), PIN, Transactional Data

#39 — The app protects its sensitive screens against overlay attacks.​

MASWE: MASWE-0039: App Vulnerable to Overlay Attacks

  • Threats: TR0x06 - An attacker can abuse an outdated system OS., TR0x09 - An attacker can abuse the app via accessibility services
  • Technical threats: TT1 - Physical attacks - 1.2 Information leakage
  • Risks: R5 - Data theft, R6 - Data disclosure, R9 - Unauthorised transaction, R10 - Transaction manipulation, R13 - Service disruption
  • Example assets: PIN, Person Identification Data (PID)

#40 — The app prevents sensitive data from being exposed to, or captured by, accessibility services.​

MASWE: MASWE-0040: Sensitive Data Leaked via Accessibility Services

  • Threats: TR0x09 - An attacker can abuse the app via accessibility services
  • Risks: R5 - Data theft, R6 - Data disclosure, R9 - Unauthorised transaction, R10 - Transaction manipulation
  • Example assets: PIN, Person Identification Data (PID)

MASVS-CODE​

#41 — The app detects if it is running on an unsupported OS version and reacts appropriately.​

MASWE: MASWE-0041: Running on a Recent Platform Version Not Ensured

  • Threats: TR0x06 - An attacker can abuse an outdated system OS.
  • Technical threats: TT5 - Malicious actions - 5.7 Malware
  • Risks: R5 - Data theft, R6 - Data disclosure, R13 - Service disruption
  • Baseline configurations: minimum OS version, Device Integrity State

#42 — The app targets the latest platform version.​

MASWE: MASWE-0042: Latest Platform Version Not Targeted

  • Threats: TR0x06 - An attacker can abuse an outdated system OS.
  • Technical threats: TT5 - Malicious actions - 5.7 Malware
  • Risks: R5 - Data theft, R6 - Data disclosure, R13 - Service disruption
  • Baseline configurations: latest platform version

#43 — The app detects if it must be updated and reacts appropriately.​

MASWE: MASWE-0043: Enforced Updating Not Implemented

  • Threats: TR0x01 - An attacker can abuse a known vulnerability because the user did not update their application
  • Technical threats: TT5 - Malicious actions - 5.5 Software vulnerabilities
  • Risks: R5 - Data theft, R6 - Data disclosure, R7 - Data manipulation, R13 - Service disruption
  • Baseline configurations: outdated app version

#44 — The app's third-party components are regularly checked for known vulnerabilities.​

MASWE: MASWE-0044: Dependencies with Known Vulnerabilities

  • Threats: TR0x01 - An attacker can abuse a known vulnerability because the user did not update their application
  • Technical threats: TT5 - Malicious actions - 5.6 Supply chain attacks
  • Risks: R5 - Data theft, R6 - Data disclosure, R7 - Data manipulation, R13 - Service disruption
  • Example assets: Third-Party Libraries

#45 — The app uses the compiler-provided security features of the platform.​

MASWE: MASWE-0045: Compiler-Provided Security Features Not Used

  • Threats: TR0x08 - An attacker can modify the app during runtime
  • Technical threats: TT5 - Malicious actions - 5.5 Software vulnerabilities
  • Risks: R5 - Data theft, R6 - Data disclosure, R7 - Data manipulation, R9 - Unauthorised transaction, R10 - Transaction manipulation

#46 — The app does not use deprecated APIs or functionality.​

MASWE: MASWE-0046: Use of Deprecated APIs or Functionality

  • Threats: TR0x05 - An attacker can abuse the cryptographic implementation of the solution
  • Technical threats: TT5 - Malicious actions - 5.5 Software vulnerabilities
  • Risks: R1 - Creation or use of an existing electronic identity, R5 - Data theft, R6 - Data disclosure, R7 - Data manipulation, R9 - Unauthorised transaction, R11 - Repudiation
  • Example assets: Third-Party Libraries

#47 — The app uses standard APIs for security-critical functionality.​

MASWE: MASWE-0047: Using Non-Standard APIs for Security-Critical Functionality

  • Threats: TR0x05 - An attacker can abuse the cryptographic implementation of the solution
  • Technical threats: TT5 - Malicious actions - 5.6 Supply chain attacks, TT5 - Malicious actions - 5.2 Phishing and spoofing
  • Risks: R1 - Creation or use of an existing electronic identity, R4 - Identify theft, R5 - Data theft, R6 - Data disclosure, R7 - Data manipulation, R9 - Unauthorised transaction, R11 - Repudiation

#48 — The app package does not contain malicious code.​

MASWE: MASWE-0048: Malicious Code Included in the App

  • Threats: TR0x07 - An attacker can modify the app package.
  • Risks: R2 - Creation or use of a fake electronic identity, R7 - Data manipulation, R9 - Unauthorised transaction, R10 - Transaction manipulation, SR2 - Reputational damage
  • Example assets: Wallet App Code & Resources, Third-Party Libraries

#49 — The app loads dynamic code safely from trusted sources.​

MASWE: MASWE-0049: Unsafe Dynamic Code Loading

  • Threats: TR0x08 - An attacker can modify the app during runtime
  • Technical threats: TT5 - Malicious actions - 5.5 Software vulnerabilities
  • Risks: R5 - Data theft, R6 - Data disclosure, R7 - Data manipulation, R9 - Unauthorised transaction, R10 - Transaction manipulation
  • Example assets: Wallet App Code & Resources

#50 — The app securely handles untrusted data.​

MASWE: MASWE-0050: Unsafe Handling of Untrusted Data

  • Threats: TR0x08 - An attacker can modify the app during runtime
  • Technical threats: TT5 - Malicious actions - 5.5 Software vulnerabilities
  • Risks: R5 - Data theft, R6 - Data disclosure, R7 - Data manipulation, R9 - Unauthorised transaction, R10 - Transaction manipulation

MASVS-RESILIENCE​

#51 — The app detects if it runs on a rooted/jailbroken device and reacts appropriately.​

MASWE: MASWE-0051: Root/Jailbreak Detection Not Implemented

  • Threats: TR0x07 - An attacker can modify the app package., TR0x08 - An attacker can modify the app during runtime
  • Risks: R7 - Data manipulation, R10 - Transaction manipulation
  • Baseline configurations: Device Integrity State

#52 — The app detects when it is running inside an app-virtualization environment.​

MASWE: MASWE-0052: App Virtualization Environment Detection Not Implemented

  • Threats: TR0x08 - An attacker can modify the app during runtime
  • Technical threats: TT5 - Malicious actions - 5.7 Malware
  • Risks: R7 - Data manipulation, R10 - Transaction manipulation
  • Baseline configurations: Device Integrity State

#53 — The app detects when it is running in an emulated or virtual device environment.​

MASWE: MASWE-0053: Emulated or Virtual Device Detection Not Implemented

  • Threats: TR0x08 - An attacker can modify the app during runtime
  • Technical threats: TT5 - Malicious actions - 5.7 Malware
  • Risks: R7 - Data manipulation, R10 - Transaction manipulation
  • Baseline configurations: Device Integrity State

#54 — The app implements device attestation.​

MASWE: MASWE-0054: Device Attestation Not Implemented

  • Threats: TR0x08 - An attacker can modify the app during runtime
  • Technical threats: TT1 - Physical attacks - 1.3 Tampering
  • Risks: R7 - Data manipulation, R10 - Transaction manipulation
  • Example assets: Key Attestation
  • Baseline configurations: Device Integrity State

#55 — The app detects attacks by malware.​

MASWE: MASWE-0055: Malware Detection Not Implemented

  • Threats: TR127 - An attacker can control a malware to access data stored in the wallet., TR0x08 - An attacker can modify the app during runtime
  • Risks: R7 - Data manipulation, R10 - Transaction manipulation
  • Baseline configurations: Device Integrity State, App Integrity State

#56 — The app implements app attestation.​

MASWE: MASWE-0056: App Attestation Not Implemented

  • Threats: TR56 - An attacker can propose an application that mimics a specific legitimate wallet to users., TR0x07 - An attacker can modify the app package.
  • Technical threats: TT1 - Physical attacks - 1.3 Tampering
  • Risks: R7 - Data manipulation, R10 - Transaction manipulation
  • Example assets: Wallet Instance Attestation (WIA)
  • Baseline configurations: App Integrity State

#57 — The app verifies the integrity of its resources.​

MASWE: MASWE-0057: App Resources Integrity Not Verified

  • Threats: TR0x07 - An attacker can modify the app package.
  • Technical threats: TT1 - Physical attacks - 1.3 Tampering
  • Risks: R7 - Data manipulation, R10 - Transaction manipulation
  • Example assets: Wallet App Code & Resources
  • Baseline configurations: App Integrity State

#58 — The app detects unauthorized changes to its code and execution flow at runtime.​

MASWE: MASWE-0058: Runtime Code Integrity Not Verified

  • Threats: TR0x08 - An attacker can modify the app during runtime
  • Technical threats: TT1 - Physical attacks - 1.3 Tampering
  • Risks: R7 - Data manipulation, R10 - Transaction manipulation
  • Example assets: Wallet App Code & Resources
  • Baseline configurations: App Integrity State

#59 — The app implements code obfuscation.​

MASWE: MASWE-0059: Code Obfuscation Not Implemented

  • Threats: TR0x07 - An attacker can modify the app package.
  • Technical threats: TT1 - Physical attacks - 1.3 Tampering
  • Risks: R7 - Data manipulation, R10 - Transaction manipulation
  • Example assets: Wallet App Code & Resources

#60 — The app applies resource obfuscation to hinder reverse engineering.​

MASWE: MASWE-0060: Resource Obfuscation Not Implemented

  • Threats: TR0x07 - An attacker can modify the app package.
  • Technical threats: TT1 - Physical attacks - 1.3 Tampering
  • Risks: R7 - Data manipulation, R10 - Transaction manipulation
  • Example assets: Wallet App Code & Resources

#61 — The app does not contain debug artifacts.​

MASWE: MASWE-0061: Debug Artifacts Not Removed

  • Threats: TR0x07 - An attacker can modify the app package.
  • Technical threats: TT5 - Malicious actions - 5.7 Malware
  • Risks: R7 - Data manipulation, R10 - Transaction manipulation
  • Example assets: Wallet App Code & Resources

#62 — The app applies application-level payload encryption in addition to transport-layer encryption.​

MASWE: MASWE-0062: No Application-Level Payload Encryption

#63 — The app disables debug mechanisms.​

MASWE: MASWE-0063: Debug Mechanisms Not Disabled

  • Threats: TR0x08 - An attacker can modify the app during runtime
  • Technical threats: TT5 - Malicious actions - 5.7 Malware
  • Risks: R7 - Data manipulation, R10 - Transaction manipulation

#64 — The app detects debugger attachment at runtime and responds to protect sensitive operations.​

MASWE: MASWE-0064: Debugger Detection Not Implemented

  • Threats: TR0x08 - An attacker can modify the app during runtime
  • Technical threats: TT5 - Malicious actions - 5.7 Malware
  • Risks: R7 - Data manipulation, R10 - Transaction manipulation
  • Baseline configurations: App Integrity State

#65 — The app detects dynamic analysis tools and responds to protect sensitive operations.​

MASWE: MASWE-0065: Dynamic Analysis Tools Detection Not Implemented

  • Threats: TR0x08 - An attacker can modify the app during runtime
  • Technical threats: TT5 - Malicious actions - 5.7 Malware
  • Risks: R7 - Data manipulation, R10 - Transaction manipulation
  • Baseline configurations: App Integrity State

MASVS-PRIVACY​

#66 — The app adequately manages permissions.​

MASWE: MASWE-0066: Inadequate Permission Management

  • Threats: "TR0x18 - The app provider or third parties can collect, share, or otherwise process personal data without the user being adequately informed or having given valid consent.", "TR0x21 - An attacker, malicious SDK, or compromised app component can obtain sensitive user data or access privacy sensitive device capabilities."
  • Technical threats: TT1 - Physical attacks - 1.2 Information leakage
  • Risks: R6 - Data disclosure, R14 - Surveillance, SR3 - Legal non-compliance
  • Example assets: User PII (other collected data)
  • Baseline configurations: user collected/shared data

#67 — The app uses anonymization or pseudonymisation measures.​

MASWE: MASWE-0067: Lack of Anonymization or Pseudonymisation Measures

  • Threats: TR39 - An attacker can unlawfully trace wallet users using unique/traceable identifiers., TR85 - An attacker can track and trace a user by using person identification data of the user where identification of the user is not required., "TR0x19 - The app provider or third parties can identify, link, profile, or track users beyond what is necessary."
  • Technical threats: TT1 - Physical attacks - 1.2 Information leakage
  • Risks: R6 - Data disclosure, R14 - Surveillance, SR3 - Legal non-compliance
  • Example assets: Pseudonyms and Passkeys, User PII (other collected data)

#68 — The app does not use persistent or unique identifiers in a way that enables user tracking.​

MASWE: MASWE-0068: Incorrect Use of Identifiers for User Tracking

  • Threats: TR39 - An attacker can unlawfully trace wallet users using unique/traceable identifiers., TR85 - An attacker can track and trace a user by using person identification data of the user where identification of the user is not required., "TR0x19 - The app provider or third parties can identify, link, profile, or track users beyond what is necessary."
  • Technical threats: TT1 - Physical attacks - 1.2 Information leakage
  • Risks: R6 - Data disclosure, R14 - Surveillance, SR3 - Legal non-compliance
  • Example assets: Pseudonyms and Passkeys
  • Baseline configurations: allowed tracking domain

#69 — The app uses privacy-preserving functionality.​

MASWE: MASWE-0069: Usage of Non-Privacy-Preserving Functionality

  • Threats: "TR0x18 - The app provider or third parties can collect, share, or otherwise process personal data without the user being adequately informed or having given valid consent.", "TR0x20 - The app provider or third parties can access, disclose, retain, or otherwise use personal data beyond the user's choices."
  • Technical threats: TT1 - Physical attacks - 1.2 Information leakage
  • Risks: R6 - Data disclosure, R14 - Surveillance, SR3 - Legal non-compliance
  • Example assets: Embedded Disclosure Policy, Pseudonyms and Passkeys

#70 — The app informs the user about the privacy implications before performing an action.​

MASWE: MASWE-0070: Inadequate Awareness for Privacy Relevant Actions

  • Threats: TR39 - An attacker can unlawfully trace wallet users using unique/traceable identifiers., TR85 - An attacker can track and trace a user by using person identification data of the user where identification of the user is not required., "TR0x19 - The app provider or third parties can identify, link, profile, or track users beyond what is necessary."
  • Technical threats: TT1 - Physical attacks - 1.2 Information leakage
  • Risks: R6 - Data disclosure, R14 - Surveillance, SR3 - Legal non-compliance
  • Example assets: User Consent Records, Transactional Data

#71 — The app uses adequate defaults for privacy relevant actions.​

MASWE: MASWE-0071: Inadequate Defaults for Privacy Relevant Actions

  • Threats: TR39 - An attacker can unlawfully trace wallet users using unique/traceable identifiers., TR85 - An attacker can track and trace a user by using person identification data of the user where identification of the user is not required., "TR0x19 - The app provider or third parties can identify, link, profile, or track users beyond what is necessary."
  • Technical threats: TT1 - Physical attacks - 1.2 Information leakage
  • Risks: R6 - Data disclosure, R14 - Surveillance, SR3 - Legal non-compliance
  • Example assets: User PII (other collected data), Embedded Disclosure Policy
  • Baseline configurations: user collected/shared data

#72 — The app provides an adequate privacy policy.​

MASWE: MASWE-0072: Inadequate Privacy Policy

  • Threats: TR129 - Wallet providers can access objects in the wallet., TR130 - Wallet providers can access evidence generated in the wallet., "TR0x18 - The app provider or third parties can collect, share, or otherwise process personal data without the user being adequately informed or having given valid consent."
  • Technical threats: TT1 - Physical attacks - 1.2 Information leakage
  • Risks: R6 - Data disclosure, R14 - Surveillance, SR3 - Legal non-compliance
  • Example assets: User PII (other collected data)

#73 — The app adequately declares all user collected data.​

MASWE: MASWE-0073: Inadequate Data Collection Declarations

  • Threats: TR39 - An attacker can unlawfully trace wallet users using unique/traceable identifiers., TR85 - An attacker can track and trace a user by using person identification data of the user where identification of the user is not required., "TR0x19 - The app provider or third parties can identify, link, profile, or track users beyond what is necessary.", "TR0x18 - The app provider or third parties can collect, share, or otherwise process personal data without the user being adequately informed or having given valid consent."
  • Technical threats: TT1 - Physical attacks - 1.2 Information leakage
  • Risks: R6 - Data disclosure, R14 - Surveillance, SR3 - Legal non-compliance
  • Example assets: User PII (other collected data)
  • Baseline configurations: user collected/shared data

#74 — The app adequately declares all tracking domains it connects to.​

MASWE: MASWE-0074: Inadequate Tracking Domains Declarations

  • Threats: TR39 - An attacker can unlawfully trace wallet users using unique/traceable identifiers., TR85 - An attacker can track and trace a user by using person identification data of the user where identification of the user is not required., "TR0x19 - The app provider or third parties can identify, link, profile, or track users beyond what is necessary.", "TR0x18 - The app provider or third parties can collect, share, or otherwise process personal data without the user being adequately informed or having given valid consent."
  • Technical threats: TT1 - Physical attacks - 1.2 Information leakage
  • Risks: R6 - Data disclosure, R14 - Surveillance, SR3 - Legal non-compliance
  • Example assets: User PII (other collected data)
  • Baseline configurations: allowed tracking domain

#75 — The app offers reproducible builds. (OUT OF SCOPE for the OWASP MAS EUDIW Profile)​

MASWE: MASWE-0075: Non-Reproducible Builds · out of scope for the profile

  • Threats: TR0x07 - An attacker can modify the app package.
  • Technical threats: TT1 - Physical attacks - 1.3 Tampering
  • Risks: SR2 - Reputational damage

#76 — The app provides adequate controls to manage user data.​

MASWE: MASWE-0076: Lack of Proper Data Management Controls

  • Threats: "TR0x20 - The app provider or third parties can access, disclose, retain, or otherwise use personal data beyond the user's choices."
  • Technical threats: TT1 - Physical attacks - 1.2 Information leakage
  • Risks: R6 - Data disclosure, R14 - Surveillance, SR3 - Legal non-compliance
  • Example assets: User PII (other collected data)
  • Baseline configurations: user collected/shared data

#77 — The app provides adequate controls over the visibility of user data.​

MASWE: MASWE-0077: Inadequate Data Visibility Controls

  • Threats: "TR0x20 - The app provider or third parties can access, disclose, retain, or otherwise use personal data beyond the user's choices."
  • Technical threats: TT1 - Physical attacks - 1.2 Information leakage
  • Risks: R6 - Data disclosure, R14 - Surveillance, SR3 - Legal non-compliance
  • Example assets: User PII (other collected data)
  • Baseline configurations: user collected/shared data

#78 — The app requests user consent prior to any data processing.​

MASWE: MASWE-0078: Inadequate or Ambiguous User Consent Mechanisms

  • Threats: "TR0x18 - The app provider or third parties can collect, share, or otherwise process personal data without the user being adequately informed or having given valid consent."
  • Technical threats: TT1 - Physical attacks - 1.2 Information leakage
  • Risks: R6 - Data disclosure, R14 - Surveillance, SR3 - Legal non-compliance
  • Example assets: User Consent Records

Assets​

The assets the requirements refer to, as defined in the catalogue. It is up to the user of the profile to map the relevant assets to the requirements.

AS1 — Person Identification Data (PID)​

Core set of identity attributes issued to the user at Level of Assurance High by a PID Provider, including the issuer signature.

Used by: #1, #2, #7, #19, #30, #36, #37, #38, #39, #40

AS2 — Attestations ((Q)EAA / PuB-EAA)​

Electronic attestations of attributes (qualified, public-sector or non-qualified), e.g. driving licences or diplomas; attributes plus issuer signature, selectively disclosable.

Used by: #1, #2, #7

AS3 — Wallet Unit Attestation (WUA)​

A signed object attesting to the hardware security properties and component compliance of the Wallet Unit; the WUA private key never resides in the app (signed by the Wallet Provider backend); decrypted only when needed, re-encrypted immediately after.

Used by: –

AS4 — Wallet Instance Attestation (WIA)​

A signed object asserting the integrity and genuineness of the installed mobile application (Wallet Instance); revocable via Token Status List.

Used by: #11, #56

AS5 — Pseudonyms and Passkeys​

User-chosen or issuer-provided identifiers (incl. FIDO2/passkey material) for pseudonymous authentication towards Relying Parties without enabling tracking.

Used by: #19, #67, #68, #69

AS6 — Embedded Disclosure Policy​

A set of rules embedded in an attestation by its provider defining which Relying Parties are authorized to receive it; evaluated by the wallet before presentation.

Used by: #69, #71

AS7 — Transactional Data​

Specific data points (e.g. payment amount, payee) contained in a presentation request that must be shown to and approved by the User.

Used by: #23, #32, #37, #38, #70

AS8 — Migration Object​

A list of the current PIDs and attestations (explicitly excluding private keys) used to restore the wallet content on a new device.

Used by: #6

AS9 — User PII (other collected data)​

Personally identifiable information collected by the app outside PID/attestations (e.g. e-mail, device identifiers) as declared in the privacy manifest.

Used by: #1, #2, #7, #30, #36, #37, #66, #67, #71, #72, #73, #74, #76, #77

AS10 — Critical Private Keys (PID / attestation proof keys)​

Private keys bound to PID and other device-bound attestations, used to sign proofs of possession during presentation; managed exclusively by the WSCA/WSCD (in remote-HSM architectures they never reach the app).

Used by: #4, #10, #13, #16, #22, #33

AS11 — Non-critical Cryptographic Keys​

Keys used for less sensitive attestations and operations that do not require Level of Assurance High protection.

Used by: #3, #13, #15

AS12 — Hardware-Bound Private Key​

A unique, non-exportable device key used to sign instructions sent to the backend, serving as the possession factor of user authentication.

Used by: #10, #16, #22, #25

AS13 — Wallet Key Encryption Key (KEK)​

A hardware-bound key used exclusively to wrap (encrypt) the local database encryption key; never leaves the secure hardware.

Used by: #16

AS14 — Database Encryption Key & IV​

The AES-256 key and Initialization Vector required to unlock the local encrypted (SQLCipher) database; stored on mobile storage only in wrapped form, decryptable solely via the KEK inside the SE/TEE.

Used by: #16

AS15 — PIN Private Key​

A P-256 private key derived on-the-fly from PIN + PIN Salt for a specific instruction and discarded immediately after use; never persisted.

Used by: #1, #2, #3, #7, #10, #14, #20, #24

AS16 — WSCA Secure-Channel Keys​

Credentials/keys used by the Wallet Instance to establish the mutually authenticated secure channel to the WSCA; compromise enables full identity takeover.

Used by: –

AS17 — TLS / Secure-Channel Session Keys​

Ephemeral session keys protecting network communication (TLS 1.3) and application-level payload encryption between app, backend and counterparties.

Used by: #15, #62

AS18 — Random Numbers (CSPRNG output)​

Cryptographically secure random values used for key derivation, IVs, nonces, challenges and tokens.

Used by: #12

AS19 — PIN Salt​

32 random bytes used as input for the on-the-fly derivation of the PIN private key; never stored together with the PIN itself.

Used by: #1, #2, #7, #12, #14

AS20 — PIN Public Key​

The public counterpart of the PIN private key, used by the backend to verify the user knowledge factor; sent to the backend during enrollment - the wallet retains only an HMAC of this key inside its WB Certificate.

Used by: #1, #2, #7

AS21 — Hardware Public Key​

The public counterpart of the hardware-bound device key, used by the backend to verify instruction signatures.

Used by: –

AS22 — Infrastructure Public Keys​

Public keys (e.g. WB Response Signing Public Key, WUA Signing public key) used by the app to verify signed data coming from the backend; contained within the Wallet Configuration.

Used by: –

AS23 — Configuration Public Key​

The pinned key used by the application to verify the digital signature of the Wallet Configuration JWT (root of the configuration trust chain), preventing a malicious server from supplying false settings.

Used by: #3

AS24 — Wallet Backend (WB) Certificate​

A WB-signed JWT binding the wallet identity and its public keys (incl. HMAC of the PIN public key); issued during enrollment and presented with every backend instruction.

Used by: –

AS25 — Trust Anchors and CA Certificates​

Self-signed certificates and trust anchors (from the EU Trusted Lists) used to authenticate the backend, PID/attestation issuers and Relying Parties, incl. identity-pinning material; contained within the Wallet Configuration.

Used by: #11, #27, #28

AS26 — Intermediate Signing Certificates​

Certificates in the chain between a Trust Anchor and the final entity certificate, validated during chain verification.

Used by: –

AS27 — Access Certificates (Providers & Relying Parties)​

Certificates issued to PID Providers, Attestation Providers and Relying Parties, presented to the wallet during transactions to authenticate the counterparty.

Used by: #1, #2, #4, #7, #11

AS28 — Registration Certificates​

Certificates detailing the specific data types an entity (issuer or Relying Party) is registered and authorized to request or issue.

Used by: –

AS29 — Qualified Certificates (PuB-EAA / QSeal)​

Qualified certificates used by public sector bodies and QTSPs to sign attestations; validated by the wallet as part of PuB-EAA verification.

Used by: –

AS30 — Revocation & Status Data (Status Lists, CRLs)​

Attestation/Certificate revocation and status information (e.g. Token Status Lists, Attestation Status Lists, CRLs) fetched to check validity of attestations, WIAs and certificates.

Used by: –

AS31 — PIN​

The knowledge factor for user authentication and authorization of sensitive transactions; entered by the user per transaction and used only for on-the-fly derivation of the PIN private key.

Used by: #20, #21, #23, #33, #36, #38, #39, #40

AS32 — Biometric Data / Templates​

Fingerprint, face or iris templates referenced for the inherence factor; managed entirely by the platform biometric API and never accessible to the app.

Used by: #20, #21, #23

AS33 — Authorization Codes and Access Tokens​

Short-lived OAuth2/OpenID4VCI/OpenID4VP protocol tokens used during issuance and presentation of credentials.

Used by: #4, #29, #32

AS34 — User Session State​

Session context of an authenticated wallet user (unlock state, timeouts, retry counters); must be invalidated on termination and contextual state changes.

Used by: #24

AS35 — Wallet Configuration​

A signed JWT containing service URLs, trust anchors for certificate pinning, and version-pinning information; periodically fetched from the backend and signature-verified by the app.

Used by: #1, #2, #7

AS36 — Configuration URL​

The permanent bootstrap address where the app fetches the latest Wallet Configuration.

Used by: –

AS37 — Service URLs​

Official URLs of the Wallet Backend, PID issuer and other relevant services, delivered inside the signed Wallet Configuration.

Used by: –

AS38 — Transaction / Usage Logs​

The local record of all issuance and disclosure events performed by the Wallet Unit (presentation requests, Relying Party identities, presented attributes, timestamps), viewable by the user.

Used by: #5

AS39 — Runtime / Crash Logs​

Diagnostics sent to the Wallet Provider backend for maintenance (uncaught runtime errors, UX/telemetry data).

Used by: #5

AS40 — User Consent Records​

Records of explicit, informed user consent for data collection, processing and sharing (GDPR compliance artifacts).

Used by: #25, #70, #78

AS41 — Other Backup Data​

Device or cloud backup archives that could include app data; sensitive wallet data must be excluded or encrypted.

Used by: #6

AS42 — Network Traffic​

All data transmitted between the app and backend/issuers/Relying Parties.

Used by: #26, #27, #28, #62

AS43 — Wallet App Code & Resources​

The application binary, resources and packaged assets whose integrity the app must verify (anti-tampering, obfuscation, no debug artifacts or hardcoded secrets).

Used by: #34, #48, #49, #57, #58, #59, #60, #61

AS44 — Third-Party Libraries​

External SDKs, frameworks and open-source dependencies bundled with the app; regularly scanned for known vulnerabilities (CVEs) and deprecated APIs.

Used by: #44, #46, #48

AS45 — Attestation Private Keys​

The actual private keys used to sign proofs of possession during disclosure; managed remotely within an HSM and never reach the mobile device.

Used by: –

AS46 — Attestation Wrapping Key​

Master AES-256-GCM key used to encrypt all attestation private keys stored in the WB database; never leaves the HSM.

Used by: –

AS47 — Infrastructure Private Keys​

Dedicated backend keys for signing WB certificates, instruction responses and Wallet Unit Attestations (incl. PIN Public Key Encryption/HMAC keys).

Used by: –

AS48 — Key Attestation​

A type of Wallet Unit Attestation that attests the certification and properties of a WSCA/WSCD or keystore available to the Wallet Unit, and that contains one or more public keys whose corresponding private keys are generated by and stored in that WSCA/WSCD or keystore, as well as a revocation reference for the WSCD or keystore.

Used by: #11, #54

Baseline configurations​

The configuration values the requirements refer to. The catalogue gives example values; the applicable values are set by the user of the profile.

CF01 — outdated app version​

The minimum App version allowed to run.

Example value: 8.3

Used by: #43

CF02 — minimum OS version​

The minimum OS the application is allowed to run on.

Example value: 13.0

Used by: #41

CF03 — secure key generation​

A list of algorithms and minimum key lengths.

Example value: RSA-2048 / AES-256

Used by: #13

CF04 — encrypted network traffic​

A list of accepted network-encryption protocols.

Example value: TLS 1.3 minimum

Used by: #26, #27, #28, #62

CF05 — latest platform version​

The platform version against which the app is built.

Example value: API 37

Used by: #42

CF06 — user collected/shared data​

A list of approved collected data categories and types.

Example value: Precise location, User ID, Address

Used by: #66, #71, #73, #76, #77

CF07 — platform-provided secure keystore​

The minimum requirement for hardware-backed keystores.

Example value: StrongBox / Secure Enclave

Used by: #1, #2, #3, #20

CF08 — key rotation​

A list of approved key lifetimes and usage counts.

Example value: defined per key class

Used by: #15

CF09 — key access restriction​

A list of minimum key access restrictions.

Example value: non-exportable

Used by: #16

CF10 — approved cryptographic algorithms​

A list of approved cryptographic algorithms.

Example value: SOG-IS ACM

Used by: #1, #2, #7, #8, #9, #10, #11, #12, #14

CF11 — allowed tracking domain​

A list of approved tracking domains.

Example value: none

Used by: #68, #74

CF12 — device integrity state​

A list of detection mechanisms to evaulate the trusted state of the device.

Example value: not rooted/jailbroken, no emulator/virtualization, secure lock screen configured).

Used by: #17, #41, #51, #52, #53, #54, #55

CF13 — app integrity state​

A list of detection mechanisms to evaulate the trusted state of the running application.

Example value: the installed binary is genuine and unmodified (matches the signed release), not repackaged or tampered with, running in release mode, and not being debugged, instrumented, or hooked at runtime. Verified via runtime integrity checks and app attestation (e.g. Play Integrity / App Attest), and asserted towards the backend through the Wallet Instance Attestation.

Used by: #55, #56, #57, #58, #64, #65

CF14 — maximum failed authentication attempts​

The number of consecutive failed local authentication attempts (PIN/biometric) permitted before the wallet instance is deactivated or protective action is taken on the retry counter.

Example value: 5.0

Used by: #20, #21, #23