nordisk/frida

frida

The EU eID — eIDAS 2.0 / EUDI Wallet, done in Rust.

frida (from Old Norse friðr, "peace") is Nordisk's open, EU-aligned electronic-identity service: a peer to Freja/BankID built on the European standard stack so a frida credential works across the EUDI ecosystem — not a vendor silo. Two credential holders:

Mobile app — hardware-backed device key (Secure Enclave / StrongBox), user-verified.
Web + card reader — smartcard over PKCS#11; the card signs, the host never sees the key.

What it is, concretely

A Rust gRPC service (issuer + verifier) that runs two ways:

Standalone (single server) — one high-speed binary (tonic/tokio) over an embedded key-value store (redb or rocksdb). No database service to stand up.
Kubernetes (multi-server) — a frida operator (CRDs: Issuer, Verifier, TrustRegistry) provisions and scales nodes; state is an append-only event log with acknowledgement (ACK) across nodes, and large transactional/audit volume goes to skade (the pure-Rust Iceberg lakehouse). WireGuard secures node-to-node traffic.

No relational database, ever. Persistence is a Store trait (in edda, following the existing nornir-warehouse-trait pattern) with two backends: embedded redb/rocksdb for single-server, and skade for large transactional/analytical volume. See docs/PROTOCOL.md.

Capabilities (auth + sign + the nice-to-haves)

capability	standard	note
authentication	OpenID4VP	prove identity; pseudonymous per-RP option
signing	OpenID4VP over data	incl. QES (qualified e-signature) via a remote-signing path
credential issuance	OpenID4VCI	mint PID + attribute credentials
selective disclosure	SD-JWT VC	present just `age_over_18`, name, etc.
mobile driving licence / mdoc	ISO/IEC 18013-5	proximity + online presentation
revocation / status	status lists	credential validity without phoning home per check
mandates / representation	eIDAS 2	sign on behalf of a company
age verification	SD-JWT / mdoc	high EU demand, privacy-preserving
audit receipts	signed logs	non-repudiation for auth/sign events

auth and sign are the core; the rest are the "what more is nice" — issuance, selective disclosure, mandates, and QES are the ones that make it a real EUDI player.

Who uses it

Vetra's heimdal integrates frida as a provider (heimdal-frida) behind its IdentityProvider trait, alongside Freja, BankID, and tyr. Anyone else can integrate frida too — it speaks the open EU standards.

Repo layout (planned)

spec/                the credential profiles + gRPC service contract (the product)
proto/               .proto definitions (tonic)
crates/
  frida-types/         shared credential/envelope types (COSE/JOSE, SD-JWT VC, mdoc)
  frida-issuer/        OpenID4VCI issuer
  frida-verifier/      OpenID4VP verifier
  frida-server/        standalone gRPC binary
  frida-operator/      Kubernetes operator (kube-rs)

Types shared with tyr (crypto primitives, credential envelopes) are expected to live in edda/ rather than being duplicated here.

Status

Design. No protocol code yet — see docs/PROTOCOL.md.

License

0BSD (Zero-Clause BSD) — the most permissive option there is: use it for anything, no attribution required. See LICENSE.