Credentials stored only in encrypted form and no longer than needed
OID4VCI 1.0 §15.3SHOULDRoles: wallet
Requirement as recorded in the ProtocolSoup registry
Wallets SHOULD store Credentials only in encrypted form, and, wherever possible, use hardware-backed encryption. Wallets SHOULD not store Credentials longer than needed.
Read §15.3 in OID4VCI 1.0Self-test verdict
DeviationCommit 97df6a8Evaluated
This is ProtocolSoup's result against its own implementation at the commit shown. It is not a certification of ProtocolSoup or of any other product.
Tests
- TestIso18045ModerateNotClaimedWhenEnvUnset
./cmd/walletharness
Pass
Implementation
Decision record
Session-scoped in-memory credential storage is retained until the HashiCorp platform vault initiative. Cross-protocol security limitation for OID4VP presentations of the same held credentials; not an OID4VP normative storage deviation. Decision record is docs/packages/wallet.md (no separate ADR file).