Privasys Wallet

Privasys Wallet is a FIDO2/WebAuthn authenticator for web services running inside hardware-secure enclaves (Intel SGX/TDX, NVIDIA CC).

TESTING

The full sign-in flow needs a running enclave with a QR code. To evaluate without one:

1. Launch → Profile tab → "Set up" (biometric setup + hardware-bound key).
2. Profile tab: Personal Data (import / edit attributes, set a photo, "Verify & Import ID"), Drive, Account Recovery (email, recovery codes, guardians, 24-word phrase, devices).
3. Access tab: what can reach the user, each removable: live sessions, access granted to apps, connected accounts, registered credentials, sharing history. Empty on a fresh install. Floating QR button.
4. Settings tab: language, biometric grace period, verification mode, logs, About.
5. Drive (Profile → Drive): a client view of the user's confidential drive over an attested connection (needs a signed-in wallet). It lists files and lets the user approve or decline access requests. The wallet never uploads or stores files.
6. Push: tapping a sign-in push opens the approval screen whether the app is foreground, background, or cold-launched.
7. ID verification (real ePassport/eID, physical device, NFC): Profile → Verify & Import ID → scan the data page → hold the document to the phone → selfie. An enclave checks it, offers the verified attributes, then discards the images.
8. Access requests: an attested app can ask for limited, revocable access to something the user owns. The approval names both parties and may show a form the service needs (e.g. a mail password), sent only to that service over attested RA-TLS. Only an app can start this.
9. Passkey provider: Settings → General → AutoFill & Passwords → Privasys Wallet. Serves passkeys on this device.

DEMO: https://explorer.privasys.org, "Authenticate" tab, shows a QR. Open it on a computer and scan it from the Access tab. No account needed.

PERMISSIONS

• Camera: QR scanning, photographing the ID data page (its machine-readable zone unlocks the chip), and an optional profile selfie. Nothing is uploaded.
• Photos: the system picker, only to choose a profile photo. The app sees only the photo picked.
• NFC: reading a passport or ID card chip, only during verification.
• Face ID: unlocks the device-bound signing key. The ID-check selfie is matched against the chip photo inside the enclave and not retained.
• Push notifications: optional, for approvals and recovery alerts. The token goes only to relay.privasys.org and privasys.id.

ENCRYPTION

HTTPS (TLS 1.2/1.3), RA-TLS for enclave connections, ECDH-P256 + HKDF-SHA-256 + AES-256-GCM and XChaCha20-Poly1305, via OS crypto and standard libraries. No custom algorithms. ITSAppUsesNonExemptEncryption = NO (export-exempt).

NETWORK

• relay.privasys.org: sign-in relay
• as.privasys.org: attestation verification
• privasys.id: identity service; holds no personal data in readable form (recovery routing, encrypted backups only the user's phrase opens)
• The identity-verifier enclave: only during document verification
• OAuth issuers (Google / Microsoft / GitHub / LinkedIn): only on attribute import
• Enclave hosts the user connects to, and the service holding a resource the user grants access to, over attested RA-TLS
• api.developer.privasys.org: app listings and identity resolution for the approval screen

No analytics, advertising, or tracking SDKs.

SIGN-IN

The app is itself an authenticator: no username, no password, no account to issue. A hardware-bound key is generated on first launch by confirming the device's screen lock, which MUST be enrolled first (a device prerequisite, not a login).

Do not use "Recover Account": it restores an existing wallet from a 24-word phrase. On a fresh install use "Set up" on the Profile tab.

ACCOUNT DELETION

Data is on-device. Profile → Clear All Data. privasys.id keeps no readable personal data.