WUH-8.3.1-Sec-02 — No operation before app-level authentication
After the initial setup of application-level authentication, no operation shall be possible on the wallet unit before application-level authentication. In particular, WSCA/WSCD authentication shall not be possible before being authenticated with application-level authentication.
| Property | Value |
|---|---|
| Section | 8.3.1 Auth |
| Owner | platform |
Mapped Controls
| Control | Title |
|---|---|
| SID-AUTH-01 | FIDO2/WebAuthn Passwordless Authentication |
| SID-AUTH-02 | JWT Bearer Token Session Management |
| SID-ACCESS-02 | Rate Limiting and Brute-Force Protection |
| SID-AUTH-05 | Wallet Unlock, Lockout, and PIN Security |
Source: ENISA – Security Requirements for European Digital Identity Wallets v0.5