What is the way to prove integrity of critical assets for Digital wallet?

/e/OS Smartphone Operating System
1

I’m trying to use digital wallet https://play.google.com/store/apps/details?id=io.igrant.mobileagent&pli=1

It doesn’t work and support explain next:

You need to enable Google services when it comes to custom ROMs on Android phones. We use Play integrity checks to ensure the HW/SW is intact to issue a Wallet Unit Attestation. This is based on EU Digital Identity Implementing Regulations for EUDI Wallets (Art 3 for example, EUDI Wallet - Integrity and core functionalities | iGrant.io DevDocs).

Law doesn’t force to use Google services, but anyway please share info about what are the other options to prove integrity of critical assets in custom ROM.

We already have many OSS DW Wallet and Agent Overview

2

From the perspective of the App, there’s no other option if the vendor implements play-integrity only.

There are other ways to attestation (grapheneos offers an alternative - to mostly Pixels) but it raises the cost of the vendor to implement more methods.

microg implements some of play-integrity with a fix marked for a 0.3.7 release - /e/OS updates their version regularly.

For /e/OS, check with SPIC if and what play-integrity level your device meets. If it shows basic integrity and you still see an App error, collect a stacktrace (logcat, logfox) for microg issues.

For some political overlap - in Sweden (where igrant / LCubed resides) - there’s a group who campaigns for independent platforms for e-id solutions.

2 Likes