# frida

**The EU eID — eIDAS 2.0 / EUDI Wallet, done in Rust.**

`frida` (from Old Norse *friðr*, "peace") is Nordisk's open, EU-aligned electronic-identity
service: a peer to Freja/BankID built on the European standard stack so a `frida` credential works
across the EUDI ecosystem — not a vendor silo. Two credential holders:

- **Mobile app** — hardware-backed device key (Secure Enclave / StrongBox), user-verified.
- **Web + card reader** — smartcard over **PKCS#11**; the card signs, the host never sees the key.

## What it is, concretely

A **Rust gRPC service** (issuer + verifier) that runs two ways:

- **Standalone (single server)** — one high-speed binary (tonic/tokio) over an **embedded**
  key-value store (**redb** or **rocksdb**). No database service to stand up.
- **Kubernetes (multi-server)** — a **`frida` operator** (CRDs: `Issuer`, `Verifier`,
  `TrustRegistry`) provisions and scales nodes; state is an **append-only event log with
  acknowledgement (ACK)** across nodes, and large transactional/audit volume goes to **skade**
  (the pure-Rust Iceberg lakehouse). WireGuard secures node-to-node traffic.

**No relational database, ever.** Persistence is a `Store` trait (in `edda`, following the existing
`nornir-warehouse-trait` pattern) with two backends: embedded **redb/rocksdb** for single-server,
and **skade** for large transactional/analytical volume. See [`docs/PROTOCOL.md`](docs/PROTOCOL.md).

## Capabilities (auth + sign + the nice-to-haves)

| capability | standard | note |
|---|---|---|
| **authentication** | OpenID4VP | prove identity; pseudonymous per-RP option |
| **signing** | OpenID4VP over data | incl. **QES** (qualified e-signature) via a remote-signing path |
| **credential issuance** | OpenID4VCI | mint PID + attribute credentials |
| **selective disclosure** | SD-JWT VC | present just `age_over_18`, name, etc. |
| **mobile driving licence / mdoc** | ISO/IEC 18013-5 | proximity + online presentation |
| **revocation / status** | status lists | credential validity without phoning home per check |
| **mandates / representation** | eIDAS 2 | sign on behalf of a company |
| **age verification** | SD-JWT / mdoc | high EU demand, privacy-preserving |
| **audit receipts** | signed logs | non-repudiation for auth/sign events |

`auth` and `sign` are the core; the rest are the "what more is nice" — issuance, selective
disclosure, mandates, and QES are the ones that make it a real EUDI player.

## Who uses it

Vetra's **`heimdal`** integrates `frida` as a provider (`heimdal-frida`) behind its
`IdentityProvider` trait, alongside Freja, BankID, and `tyr`. Anyone else can integrate `frida`
too — it speaks the open EU standards.

## Repo layout (planned)

```
spec/                the credential profiles + gRPC service contract (the product)
proto/               .proto definitions (tonic)
crates/
  frida-types/         shared credential/envelope types (COSE/JOSE, SD-JWT VC, mdoc)
  frida-issuer/        OpenID4VCI issuer
  frida-verifier/      OpenID4VP verifier
  frida-server/        standalone gRPC binary
  frida-operator/      Kubernetes operator (kube-rs)
```

Types shared with **`tyr`** (crypto primitives, credential envelopes) are expected to live in
**`edda/`** rather than being duplicated here.

## Status

**Design.** No protocol code yet — see [`docs/PROTOCOL.md`](docs/PROTOCOL.md).

## License

**0BSD** (Zero-Clause BSD) — the most permissive option there is: use it for anything, no
attribution required. See [`LICENSE`](LICENSE).