MAS-EUDIW - EU Digital Identity Wallet
How to proceed when no MASTG TEST exists
The MASTG does not yet provide dedicated tests for every MASWE. Defining a weakness and defining a reliable, reproducible way to test for it are different tasks, and some areas require extensive research, validation, or refinement before they can be captured as formal MASTG TESTs. The guide also evolves continuously as platforms, frameworks, and testing techniques change.
Even when no dedicated MASTG TEST exists, you can still assess the weakness.
-
Start with the MASWE: Review its "Modes of Introduction" to understand the concrete conditions that may introduce the weakness and what should be tested.
-
Check related MASTG content: Look at similar or related existing MASTG TESTs, as they can provide useful testing patterns, structure, and inspiration for designing a new test. Also consult relevant MASTG KNOW, TECH, and TOOL entries, together with the official mobile platform documentation, to understand the topic and identify suitable testing techniques.
-
Contribute back: If you develop a reliable testing procedure, consider contributing a new MASTG TEST and a MASTG DEMO so others can reuse it.
The Netherlands joined forces with the OWASP MAS core team and worked to translate the applicable regulatory requirements into an OWASP MAS profile.
This work resulted in the OWASP MAS EUDI Wallet Profile Requirements Catalogue, which provides a list of requirements with which the EUDI Wallet Instance should comply, as well as a companion guide called the OWASP MAS EUDI Wallet Profile Practical Guidelines. The latter provides practical guidelines on applying these requirements and the OWASP MAS framework to sensitive and EUDI wallets.
The OWASP MAS EUDI Wallet Profile is currently being integrated into the Dutch national EUDI wallet certification scheme and the Dutch EUDIW Protection Profile.
This work was funded by the Dutch EUDI-program and built in collaboration between OWASP, MinBZK (NL), CCB (BE) and TRAFICOM (FI).
Learn more about the EU Digital Identity Wallet:
- eudi.dev: the developer portal for the EU Digital Identity Wallet reference implementation.
- EU Digital Identity Wallet Home: the European Commission's Digital Building Blocks wiki for the EU Digital Identity Wallet.
About the Profile¶
MAS-EUDIW draws on the large majority of the controls from all four existing MAS profiles and covers the assets unique to a digital identity system, such as Wallet Instance Attestations (WIA) and Person Identification Data (PID).
The profile's requirements are mapped to the Risk Register for European Digital Identity Wallets, linking each technical control to the high-level risks, system-related risks, technical threats, and wallet-specific threat scenarios it is designed to mitigate, as well as to the corresponding OWASP MASWE weakness. This provides a bridge between high-level regulatory requirements (such as eIDAS) and low-level technical tests.
The profile is built around two supporting concepts, Assets and Configurations, which are applied generically across requirements. It is the responsibility of the profile's user (the developer, issuer, or auditor) to map the relevant assets (e.g. usage logs, PIN salt, WIA, critical private keys) to the appropriate requirements, and to set the applicable configuration values (e.g. approved cryptographic algorithms, minimum OS version) based on their risk tolerance and current technology standards.
MAS-EUDIW is recommended for:
- EUDI Wallet Instances that need to demonstrate resistance against attackers with "high attack potential", as set out in Implementing Regulation (EU) 2015/1502.
- Other High Assurance (HA) apps that can benefit from applying a subset of, or extending, the same requirement set.
Documents¶
- OWASP MAS EUDI Wallet Profile Requirements Catalogue: the full list of requirements the EUDI Wallet Instance should comply with, mapped to the Risk Register for European Digital Identity Wallets and to OWASP MASWE.
- OWASP MAS EUDI Wallet Profile Practical Guidelines: a companion guide with practical guidance on applying the requirements and the OWASP MAS framework to sensitive and EUDI wallets.
Requirements¶
| Requirement | MASWE ID | Platform | MASVS ID | Tests | Status |
|---|---|---|---|---|---|
| The app encrypts sensitive data stored in private storage. | MASWE-0001: Sensitive Data Stored Unencrypted in Private Storage | MASVS-STORAGE-1 | 11 | ||
| The app encrypts sensitive data stored outside of private storage. | MASWE-0002: Sensitive Data Stored Unencrypted Outside of Private Storage | MASVS-STORAGE-1 | 4 | ||
| The app stores cryptographic keys inside the platform-provided secure keystore. | MASWE-0003: Cryptographic Keys Stored Outside of Platform Keystore | MASVS-STORAGE-1 | 3 | ||
| The app does not hardcode sensitive data in the application package. | MASWE-0004: Sensitive Data Hardcoded in the App Package | MASVS-STORAGE-1 | 0 | ||
| The app excludes sensitive data from application logs. | MASWE-0005: Insertion of Sensitive Data into Logs | MASVS-STORAGE-2 | 4 | ||
| The app excludes sensitive data from backups. | MASWE-0006: Sensitive Data Not Excluded From Backup | MASVS-STORAGE-2 | 4 | ||
| The app properly encrypts sensitive data. | MASWE-0007: Improper Encryption | MASVS-CRYPTO-1 | 10 | ||
| The app properly hashes sensitive data. | MASWE-0008: Improper Hashing | MASVS-CRYPTO-1 | 1 | ||
| The app properly uses Message Authentication Codes (MACs). | MASWE-0009: Improper Use of Message Authentication Code (MAC) | MASVS-CRYPTO-1 | 0 | ||
| The app properly generates cryptographic signatures. | MASWE-0010: Improper Generation of Cryptographic Signatures | MASVS-CRYPTO-1 | 0 | ||
| The app properly verifies cryptographic signatures. | MASWE-0011: Improper Verification of Cryptographic Signature | MASVS-CRYPTO-1 | 0 | ||
| The app properly generates random numbers. | MASWE-0012: Improper Random Number Generation | MASVS-CRYPTO-1 | 4 | ||
| The app securely generates cryptographic keys. | MASWE-0013: Improper Cryptographic Key Generation | MASVS-CRYPTO-2 | 2 | ||
| The app derives cryptographic keys using approved key derivation functions. | MASWE-0014: Improper Cryptographic Key Derivation | MASVS-CRYPTO-2 | 0 | ||
| The app rotates cryptographic keys regularly. | MASWE-0015: Cryptographic Key Rotation Not Implemented | MASVS-CRYPTO-2 | 0 | ||
| The app restricts access to cryptographic keys. | MASWE-0016: Cryptographic Key Access Not Restricted | MASVS-CRYPTO-2 | 0 | ||
| The app verifies that the device has a secure lock configured. | MASWE-0017: Device Secure Lock Not Enforced | MASVS-CRYPTO-2 | 4 | ||
| The app enforces authentication and authorization on its components. | MASWE-0018: Lack of Authentication or Authorization on App Components | MASVS-AUTH-1 | 6 | ||
| The app enables auto-fill support for credential providers. | MASWE-0019: Lack of Auto-fill Support for Credential Providers | MASVS-AUTH-1 | 0 | ||
| The app implements local authentication securely. | MASWE-0020: Local Authentication Can Be Bypassed | MASVS-AUTH-2 | 5 | ||
| The app does not allow fallback to non-biometric credentials for sensitive transactions. | MASWE-0021: Fallback to Non-biometric Credentials Allowed for Sensitive Transactions | MASVS-AUTH-2 | 3 | ||
| The app invalidates keys after any enrollment of new biometric data. | MASWE-0022: Crypto Keys Not Invalidated on New Biometric Enrollment | MASVS-AUTH-2 | 3 | ||
| The app enforces step-up authentication before granting access to sensitive functionality. | MASWE-0023: Step-Up Authentication Not Implemented for Sensitive Actions | MASVS-AUTH-3 | 0 | ||
| The app makes sensitive data inaccessible after session termination. | MASWE-0024: Sensitive Data Accessible After Session Termination | MASVS-AUTH-3 | 0 | ||
| The app ensures non-repudiation for critical actions. | MASWE-0025: Lack of Non-Repudiation for Critical Actions | MASVS-AUTH-3 | 0 | ||
| The app encrypts all network traffic. | MASWE-0026: Network Traffic Not Encrypted | MASVS-NETWORK-1 | 16 | ||
| The app validates certificates for all network traffic. | MASWE-0027: Insecure Certificate Validation | MASVS-NETWORK-1 | 9 | ||
| The app correctly implements identity pinning. | MASWE-0028: Insecure Identity Pinning | MASVS-NETWORK-2 | 4 | ||
| The app securely handles deep links. | MASWE-0029: Insecure Deep Links | MASVS-PLATFORM-1 | 5 | ||
| The app uses the clipboard securely and only with user consent. | MASWE-0030: Improper Use of the Clipboard | MASVS-PLATFORM-1 | 0 | ||
| The app only permits trusted app extensions to interact with it. | MASWE-0031: Allowing Untrusted App Extensions | MASVS-PLATFORM-1 | 1 | ||
| The app securely handles intents. | MASWE-0032: Insecure Intents | MASVS-PLATFORM-1 | 3 | ||
| The app does not expose sensitive native functionality to WebView content. | MASWE-0033: Sensitive Native Functionality Exposed in WebViews | MASVS-PLATFORM-2 | 0 | ||
| The app only allows trusted WebView content to access local resources. | MASWE-0034: WebViews Allow Access to Local Resources with Untrusted Content | MASVS-PLATFORM-2 | 13 | ||
| The app only allows trusted content in WebViews. | MASWE-0035: WebViews Loading Untrusted Content | MASVS-PLATFORM-2 | 5 | ||
| The app does not unnecessarily expose sensitive data through its user interface. | MASWE-0036: Unnecessary Exposure of Sensitive Data via the User Interface | MASVS-PLATFORM-3 | 12 | ||
| The app does not unnecessarily expose sensitive data through system notifications. | MASWE-0037: Unnecessary Exposure of Sensitive Data via Notifications | MASVS-PLATFORM-3 | 1 | ||
| The app removes or masks sensitive data from its views when moved to the background, when being recorded or when a screenshot is taken. | MASWE-0038: Insufficient Protection of Sensitive Data from Screenshots or Screen Recordings | MASVS-PLATFORM-3 | 6 | ||
| The app protects its sensitive screens against overlay attacks. | MASWE-0039: App Vulnerable to Overlay Attacks | MASVS-PLATFORM-3 | 0 | ||
| The app prevents sensitive data from being exposed to, or captured by, accessibility services. | MASWE-0040: Sensitive Data Leaked via Accessibility Services | MASVS-PLATFORM-3 | 1 | ||
| The app detects if it is running on an unsupported OS version and reacts appropriately. | MASWE-0041: Running on a Recent Platform Version Not Ensured | MASVS-CODE-1 | 1 | ||
| The app targets the latest platform version. | MASWE-0042: Latest Platform Version Not Targeted | MASVS-CODE-1 | 0 | ||
| The app detects if it must be updated and reacts appropriately. | MASWE-0043: Enforced Updating Not Implemented | MASVS-CODE-2 | 4 | ||
| The app's third-party components are regularly checked for known vulnerabilities. | MASWE-0044: Dependencies with Known Vulnerabilities | MASVS-CODE-3 | 4 | ||
| The app uses the compiler-provided security features of the platform. | MASWE-0045: Compiler-Provided Security Features Not Used | MASVS-CODE-3 | 5 | ||
| The app does not use deprecated APIs or functionality. | MASWE-0046: Use of Deprecated APIs or Functionality | MASVS-CODE-3 | 0 | ||
| The app uses standard APIs for security-critical functionality. | MASWE-0047: Using Non-Standard APIs for Security-Critical Functionality | MASVS-CODE-3 | 0 | ||
| The app package does not contain malicious code. | MASWE-0048: Malicious Code Included in the App | MASVS-CODE-3 | 0 | ||
| The app loads dynamic code safely from trusted sources. | MASWE-0049: Unsafe Dynamic Code Loading | MASVS-CODE-4 | 0 | ||
| The app securely handles untrusted data. | MASWE-0050: Unsafe Handling of Untrusted Data | MASVS-CODE-4 | 4 | ||
| The app detects if it runs on a rooted/jailbroken device and reacts appropriately. | MASWE-0051: Root/Jailbreak Detection Not Implemented | MASVS-RESILIENCE-1 | 4 | ||
| The app detects when it is running inside an app-virtualization environment. | MASWE-0052: App Virtualization Environment Detection Not Implemented | MASVS-RESILIENCE-1 | 0 | ||
| The app detects when it is running in an emulated or virtual device environment. | MASWE-0053: Emulated or Virtual Device Detection Not Implemented | MASVS-RESILIENCE-1 | 2 | ||
| The app implements device attestation. | MASWE-0054: Device Attestation Not Implemented | MASVS-RESILIENCE-1 | 0 | ||
| The app detects attacks by malware. | MASWE-0055: Malware Detection Not Implemented | MASVS-RESILIENCE-2 | 0 | ||
| The app implements app attestation. | MASWE-0056: App Attestation Not Implemented | MASVS-RESILIENCE-2 | 3 | ||
| The app verifies the integrity of its resources. | MASWE-0057: App Resources Integrity Not Verified | MASVS-RESILIENCE-2 | 2 | ||
| The app detects unauthorized changes to its code and execution flow at runtime. | MASWE-0058: Runtime Code Integrity Not Verified | MASVS-RESILIENCE-2 | 2 | ||
| The app implements code obfuscation. | MASWE-0059: Code Obfuscation Not Implemented | MASVS-RESILIENCE-3 | 3 | ||
| The app applies resource obfuscation to hinder reverse engineering. | MASWE-0060: Resource Obfuscation Not Implemented | MASVS-RESILIENCE-3 | 0 | ||
| The app does not contain debug artifacts. | MASWE-0061: Debug Artifacts Not Removed | MASVS-RESILIENCE-3 | 7 | ||
| The app applies application-level payload encryption in addition to transport-layer encryption. | MASWE-0062: No Application-Level Payload Encryption | MASVS-RESILIENCE-3 | 0 | ||
| The app disables debug mechanisms. | MASWE-0063: Debug Mechanisms Not Disabled | MASVS-RESILIENCE-4 | 3 | ||
| The app detects debugger attachment at runtime and responds to protect sensitive operations. | MASWE-0064: Debugger Detection Not Implemented | MASVS-RESILIENCE-4 | 4 | ||
| The app detects dynamic analysis tools and responds to protect sensitive operations. | MASWE-0065: Dynamic Analysis Tools Detection Not Implemented | MASVS-RESILIENCE-4 | 0 | ||
| The app adequately manages permissions. | MASWE-0066: Inadequate Permission Management | MASVS-PRIVACY-1 | 9 | ||
| The app uses anonymization or pseudonymisation measures. | MASWE-0067: Lack of Anonymization or Pseudonymisation Measures | MASVS-PRIVACY-2 | 0 | ||
| The app does not use persistent or unique identifiers in a way that enables user tracking. | MASWE-0068: Incorrect Use of Identifiers for User Tracking | MASVS-PRIVACY-2 | 0 | ||
| The app uses privacy-preserving functionality. | MASWE-0069: Usage of Non-Privacy-Preserving Functionality | MASVS-PRIVACY-2 | 0 | ||
| The app informs the user about the privacy implications before performing an action. | MASWE-0070: Inadequate Awareness for Privacy Relevant Actions | MASVS-PRIVACY-2 | 0 | ||
| The app uses adequate defaults for privacy relevant actions. | MASWE-0071: Inadequate Defaults for Privacy Relevant Actions | MASVS-PRIVACY-2 | 0 | ||
| The app provides an adequate privacy policy. | MASWE-0072: Inadequate Privacy Policy | MASVS-PRIVACY-3 | 0 | ||
| The app adequately declares all user collected data. | MASWE-0073: Inadequate Data Collection Declarations | MASVS-PRIVACY-3 | 3 | ||
| The app adequately declares all tracking domains it connects to. | MASWE-0074: Inadequate Tracking Domains Declarations | MASVS-PRIVACY-3 | 1 | ||
| The app provides adequate controls to manage user data. | MASWE-0076: Lack of Proper Data Management Controls | MASVS-PRIVACY-4 | 0 | ||
| The app provides adequate controls over the visibility of user data. | MASWE-0077: Inadequate Data Visibility Controls | MASVS-PRIVACY-4 | 0 | ||
| The app requests user consent prior to any data processing. | MASWE-0078: Inadequate or Ambiguous User Consent Mechanisms | MASVS-PRIVACY-4 | 0 |