# frida
**The EU eID — eIDAS 2.0 / EUDI Wallet, done in Rust.**
`frida` (from Old Norse *friðr*, "peace") is Nordisk's open, EU-aligned electronic-identity
service: a peer to Freja/BankID built on the European standard stack so a `frida` credential works
across the EUDI ecosystem — not a vendor silo. Two credential holders:
- **Mobile app** — hardware-backed device key (Secure Enclave / StrongBox), user-verified.
- **Web + card reader** — smartcard over **PKCS#11**; the card signs, the host never sees the key.
## What it is, concretely
A **Rust gRPC service** (issuer + verifier) that runs two ways:
- **Standalone (single server)** — one high-speed binary (tonic/tokio) over an **embedded**
key-value store (**redb** or **rocksdb**). No database service to stand up.
- **Kubernetes (multi-server)** — a **`frida` operator** (CRDs: `Issuer`, `Verifier`,
`TrustRegistry`) provisions and scales nodes; state is an **append-only event log with
acknowledgement (ACK)** across nodes, and large transactional/audit volume goes to **skade**
(the pure-Rust Iceberg lakehouse). WireGuard secures node-to-node traffic.
**No relational database, ever.** Persistence is a `Store` trait (in `edda`, following the existing
`nornir-warehouse-trait` pattern) with two backends: embedded **redb/rocksdb** for single-server,
and **skade** for large transactional/analytical volume. See [`docs/PROTOCOL.md`](docs/PROTOCOL.md).
## Capabilities (auth + sign + the nice-to-haves)
| capability | standard | note |
|---|---|---|
| **authentication** | OpenID4VP | prove identity; pseudonymous per-RP option |
| **signing** | OpenID4VP over data | incl. **QES** (qualified e-signature) via a remote-signing path |
| **credential issuance** | OpenID4VCI | mint PID + attribute credentials |
| **selective disclosure** | SD-JWT VC | present just `age_over_18`, name, etc. |
| **mobile driving licence / mdoc** | ISO/IEC 18013-5 | proximity + online presentation |
| **revocation / status** | status lists | credential validity without phoning home per check |
| **mandates / representation** | eIDAS 2 | sign on behalf of a company |
| **age verification** | SD-JWT / mdoc | high EU demand, privacy-preserving |
| **audit receipts** | signed logs | non-repudiation for auth/sign events |
`auth` and `sign` are the core; the rest are the "what more is nice" — issuance, selective
disclosure, mandates, and QES are the ones that make it a real EUDI player.
## Who uses it
Vetra's **`heimdal`** integrates `frida` as a provider (`heimdal-frida`) behind its
`IdentityProvider` trait, alongside Freja, BankID, and `tyr`. Anyone else can integrate `frida`
too — it speaks the open EU standards.
## Repo layout (planned)
```
spec/ the credential profiles + gRPC service contract (the product)
proto/ .proto definitions (tonic)
crates/
frida-types/ shared credential/envelope types (COSE/JOSE, SD-JWT VC, mdoc)
frida-issuer/ OpenID4VCI issuer
frida-verifier/ OpenID4VP verifier
frida-server/ standalone gRPC binary
frida-operator/ Kubernetes operator (kube-rs)
```
Types shared with **`tyr`** (crypto primitives, credential envelopes) are expected to live in
**`edda/`** rather than being duplicated here.
## Status
**Design.** No protocol code yet — see [`docs/PROTOCOL.md`](docs/PROTOCOL.md).
## License
**0BSD** (Zero-Clause BSD) — the most permissive option there is: use it for anything, no
attribution required. See [`LICENSE`](LICENSE).