frida
The EU eID — eIDAS 2.0 / EUDI Wallet, done in Rust.
frida (from Old Norse friðr, "peace") is Nordisk's open, EU-aligned electronic-identity
service: a peer to Freja/BankID built on the European standard stack so a frida credential works
across the EUDI ecosystem — not a vendor silo. Two credential holders:
- Mobile app — hardware-backed device key (Secure Enclave / StrongBox), user-verified.
- Web + card reader — smartcard over PKCS#11; the card signs, the host never sees the key.
What it is, concretely
A Rust gRPC service (issuer + verifier) that runs two ways:
- Standalone (single server) — one high-speed binary (tonic/tokio) over an embedded key-value store (redb or rocksdb). No database service to stand up.
- Kubernetes (multi-server) — a
fridaoperator (CRDs:Issuer,Verifier,TrustRegistry) provisions and scales nodes; state is an append-only event log with acknowledgement (ACK) across nodes, and large transactional/audit volume goes to skade (the pure-Rust Iceberg lakehouse). WireGuard secures node-to-node traffic.
No relational database, ever. Persistence is a Store trait (in edda, following the existing
nornir-warehouse-trait pattern) with two backends: embedded redb/rocksdb for single-server,
and skade for large transactional/analytical volume. See docs/PROTOCOL.md.
Capabilities (auth + sign + the nice-to-haves)
| capability | standard | note |
|---|---|---|
| authentication | OpenID4VP | prove identity; pseudonymous per-RP option |
| signing | OpenID4VP over data | incl. QES (qualified e-signature) via a remote-signing path |
| credential issuance | OpenID4VCI | mint PID + attribute credentials |
| selective disclosure | SD-JWT VC | present just age_over_18, name, etc. |
| mobile driving licence / mdoc | ISO/IEC 18013-5 | proximity + online presentation |
| revocation / status | status lists | credential validity without phoning home per check |
| mandates / representation | eIDAS 2 | sign on behalf of a company |
| age verification | SD-JWT / mdoc | high EU demand, privacy-preserving |
| audit receipts | signed logs | non-repudiation for auth/sign events |
auth and sign are the core; the rest are the "what more is nice" — issuance, selective
disclosure, mandates, and QES are the ones that make it a real EUDI player.
Who uses it
Vetra's heimdal integrates frida as a provider (heimdal-frida) behind its
IdentityProvider trait, alongside Freja, BankID, and tyr. Anyone else can integrate frida
too — it speaks the open EU standards.
Repo layout (planned)
spec/ the credential profiles + gRPC service contract (the product)
proto/ .proto definitions (tonic)
crates/
frida-types/ shared credential/envelope types (COSE/JOSE, SD-JWT VC, mdoc)
frida-issuer/ OpenID4VCI issuer
frida-verifier/ OpenID4VP verifier
frida-server/ standalone gRPC binary
frida-operator/ Kubernetes operator (kube-rs)
Types shared with tyr (crypto primitives, credential envelopes) are expected to live in
edda/ rather than being duplicated here.
Status
Design. No protocol code yet — see docs/PROTOCOL.md.
License
0BSD (Zero-Clause BSD) — the most permissive option there is: use it for anything, no
attribution required. See LICENSE.