## 1 Introduction  
With the upcoming new electronic Identification, Authentication and Trust Services (eIDAS) regulation, changes to the current eID ecosystem in Europe will be made. eIDAS as of 2014 [1] focuses on the interoperability of identities within the member states of the European Union (EU) for the use case of eGovernment. However, with the new regulation [2], further use cases should be made possible, such as universities, health, finance, online services, and mobility. One major change is the introduction of a wallet [3], described in detail in the architecture and reference framework [4]. These wallets are typically utilized within self-sovereign identities (SSI) as a place to store user credentials and further data. With the use of wallets on a smartphone, in the cloud, or hybrid, the user (holder) can send the user credentials to the service provider (verifier) in order to access a service. As the user is in control of their data, this paradigm may help to promote privacy. The verifier can verify that the credentials were actually issued by an identity provider (issuer) and sent by the holder using cryptographic signatures. These verifiable credentials (VCs) are a collection of claims that make statements about the holder, such as an email address and name. Information about all these entities is typically stored decentralized, utilizing distributed ledger technologies (DLTs), such as blockchain. However, other--already practically explored--methods could be used instead.  
For eIDAS, the protocols and type of storage still remain unclear. This means that DLT or other technologies (e. g., public key infrastructure (PKI) or European Telecommunications Standards Institute (ETSI) trust list) could be used in conjunction with the protocols of OpenID Connect (OIDC) [5], Self Issued OpenID Provider (SIOP) [6], OpenID for Verifiable Presentations (OpenID4 VP) [7], and OpenID Federation [8] and various standards for SSI. Either way, interoperability with existing infrastructure and security should be provided, as outlined by [PERSON] [9]. Although blockchains have been in use for years (see Bitcoin [10]), the application of SSI is relatively new and still evolving. Also, the security threats are not fully explored. Despite the urgent need for security, we found almost no previous literature on the threats to SSI.  
In order to provide a first step towards secure SSI, we briefly analyze current SSI wallets on the market and review the scientific literature. Here, we do not solely concentrate on SSI but take literature from neighboring areas (mainly cryptocurrencies) into account. We then evaluate their applicability to the current SSI systems and point out future work. The contribution is multifold: (1) a brief security analysis of current wallets; (2) a literature survey on threats related to SSI and their elements; and (3) an evaluation of the applicability and outline of future work.  
The remainder of the article is as follows: We first provide a brief background on SSI and define the terminology used in this article. Next, in Section 3, we motivate the survey with a security analysis of selected SSI wallets found in the Google Play Store. In Section 4, we outline our methodology, before we provide an overview of the literature survey in Section 5. This is followed by an in-depth summary of the vulnerabilities, threats, and attacks in Section 6 (blockchain applications) and Section 7 (SSI). Since we included related work outside SSI, we evaluate the applicability in Section 8. Additionally, we identify gaps, which lead to future work. Finally, we conclude the article.