A Wallet Unit Attestation is a credential from the wallet provider about one installed wallet. PID providers and attestation providers use it at issuance to confirm they are issuing into a genuine certified wallet rather than an impostor app. It is never shown to a verifier.
The ARF splits it in two. A Wallet Instance Attestation carries the identity, version and certification of the wallet solution. A Key Attestation carries the certification of the secure cryptographic device or keystore, plus the public keys whose private halves live inside it. Issuers want both before releasing a high-assurance credential, because they want to know where that credential is going to live.
It also gives a revocation point below the credential. If a wallet is compromised or a device is lost, the provider flips the status of the wallet instance, or of the secure device, in a status list referenced by the attestation. Issuers check that at every issuance.
Verifiers get none of this. A wallet is forbidden from presenting either attestation to a relying party. What a verifier gets instead is the device binding signature over its own nonce, which proves the credential is held in a secure device the issuer already vetted.
Defined in
ARF v3.0.0 Annex 1 and Annex 2 Topic 9 (WUA_01, WUA_07, WUA_09, WUA_24, WUA_26, WUA_27)
If you issue credentials, the WUA is what stops you issuing into an unknown app. It is the difference between issuing to a certified wallet and issuing to anything that speaks the protocol.
Authbound handles the protocols, formats, trust lists and revocation checks behind these terms. See what people build with them.
