ANSSI: Agence nationale de la sécurité des systèmes d'information

ANSSI (Agence nationale de la sécurité des systèmes d'information) is France's national authority for cybersecurity and information systems defense. Attached to the Secrétariat-Général de la Défense et de la Sécurité Nationale (SGDSN), ANSSI is responsible for securing French government information systems and critical infrastructure. In the EUDI Wallet ecosystem, ANSSI provides the security certification framework, cryptographic standards, and ongoing oversight for France Identité, the French national EUDI Wallet implementation.

ANSSI operates France's national security evaluation and certification scheme, which is critical for EUDI Wallet deployment. The certification process involves rigorous evaluation of the wallet application's security architecture, its cryptographic implementations, the secure element integration, and the resistance to both software and hardware attacks. Products can receive either CSPN (first-level) or Common Criteria (higher-level) certification depending on the assurance level required.

For the France Identité wallet, ANSSI has defined specific security requirements covering credential storage protection, user authentication mechanisms, communication channel security, and anti-tampering measures. These requirements align with the eIDAS 2.0 Level of Assurance High specifications while adding France-specific security controls based on ANSSI's threat model for digital identity systems.

ANSSI's certification is not a one-time assessment. The agency conducts ongoing security monitoring, vulnerability assessments, and periodic re-evaluations to ensure that the wallet maintains its security posture as threats evolve. This continuous certification approach is particularly important for digital identity systems that handle sensitive personal data over extended periods.

France Identité is the French EUDI Wallet, developed under ANSSI's security oversight. The wallet uses France's existing digital identity infrastructure, including the carte nationale d'identité électronique (CNIe) for identity proofing and the FranceConnect authentication platform for service integration. ANSSI's involvement ensures that these integrations meet the highest security standards.

ANSSI defines the cryptographic algorithms and key lengths that France Identité must use. This includes specifying the elliptic curves for digital signatures (P-256 and P-384), the symmetric encryption algorithms for credential storage (AES-256-GCM), and the key derivation functions for user authentication. These cryptographic choices are documented in ANSSI's RGS (Référentiel Général de Sécurité) guidelines.

The agency also evaluates the cloud-based components of France Identité, as the French wallet uses a hybrid architecture with both on-device and cloud-based credential storage. ANSSI ensures that cloud components are hosted on SecNumCloud-qualified infrastructure, providing sovereignty guarantees for citizen identity data.

At the European level, ANSSI contributes to the development of common security standards through its participation in the European Cybersecurity Certification Group and the SOG-IS (Senior Officials Group for Information Systems Security) mutual recognition agreement. These frameworks enable security certifications issued by ANSSI to be recognized by other EU member states, facilitating the cross-border acceptance of France Identité credentials.

ANSSI collaborates with ENISA on developing the EU Cybersecurity Certification Scheme for EUDI Wallets, which aims to establish a common evaluation methodology across all member states. This harmonization effort reduces the certification burden for wallet developers while ensuring consistent security levels across the European digital identity ecosystem.

The agency also participates in cross-border security incident response coordination, ensuring that security vulnerabilities discovered in one member state's wallet implementation are quickly communicated to other national authorities. This collaborative approach to security monitoring strengthens the overall resilience of the European digital identity infrastructure.