Tips
Inside the GOV.UK Identity Wallet: Cryptography, Attestation, and Control
Marketing and Outreach Team
13 Oct 2025
9 Min Read
A deep look at how GOV.UK’s Identity Wallet uses verifiable credentials, attestation, and secure enclave technologies to protect user identities.
Inside the GOV.UK Identity Wallet: Cryptography, Attestation, and Control
The GOV.UK Identity Wallet introduces a new model of credential storage: one that places cryptographic control back into the hands of the user. At its core lies the W3C Verifiable Credentials framework, supported by device-based keys. Issuance occurs only after device attestation through Apple DeviceCheck or Android Key Attestation, ensuring integrity and isolation.
All credentials are encrypted using AES-256-GCM and signed with ECDSA P-256. Revocation and verification follow Status List 2021, ensuring offline verifiability even under network constraints. Proof presentation leverages SD-JWT, enabling selective disclosure and zero-knowledge predicates (“over 18”, “resident of UK”).
Threat vectors—relay attacks, malware injection, tampered wallets—are mitigated via secure boot, rollback protection, and mutual TLS across wallet endpoints. To further strengthen privacy, One Login employs per-service Decentralised Identifiers (DIDs), ensuring unlinkable interactions across government systems.
This cryptographically rich design positions the UK as a leader in privacy-respecting identity infrastructure, balancing usability with verifiable trust. For more, visit the GOV.UK Digital Identity Blog and OpenID Foundation.
Join our newsletter list
Sign up to get the most recent blog articles in your email every week.
Marketing and Outreach Team
AIC’s Marketing and Outreach Team builds visibility and trust across Defence and security. We deliver strategic campaigns, thought leadership, and stakeholder engagement while balancing transparency with discretion. Our mission is to position AIC as a trusted, innovative partner to the UK MoD and beyond.
