# Prerequisites

## User prerequisites

- An Android-powered device with:
  - Android SDK 28+
  - An active Google Account
  - [Device lock](https://support.google.com/android/answer/9079129) enabled
  - No existing VDC
- A physical identity document

> [!NOTE]
> **Note:** Only one VDC can be registered for a specific Google Account and device pair. Different VDCs can be registered to the same Google Account on different devices.

## Connection security

Connections between Google and Issuer servers must adhere to the following
requirements:

- Both Google and Issuers must present keys during TLS handshakes
- Servers must not offer `NULL` or anon ciphers during TLS handshakes
- Connections must support one of the following ciphers
  - `ECDHE-ECDSA-WITH-AES-128-GCM-SHA256`
  - `ECDHE-ECDSA-WITH-AES-256-GCM-SHA384`
  - `ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256`
  - `ECDHE-RSA-WITH-AES-128-GCM-SHA256`
  - `ECDHE-RSA-WITH-AES-256-GCM-SHA384`
  - `ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256`
- All Issuers are required to use mTLS when communicating with Google servers.

### Google to Issuer communication

When Google communicates to Issuer servers, Google will present a client
certificate. Issuers are responsible for pinning and validating this
certificate. Google will then validate a pinned server certificate against what
is presented by the Issuer.

### Issuer to Google communication

When Issuers communicate to Google servers using the Google Wallet Identity APIs, they must
present a client certificate. Google will validate this against a pinned
certificate.

> [!NOTE]
> **Note:** Issuers are not required to pin Google's server certificate. Instead, Issuers should validate the certificate using certificate authorities (CA).