ISO/IEC TS 23220-6:2025
(Main)Cards and security devices for personal identification — Building blocks for identity management via mobile devices — Part 6: Mechanism for use of certification on trustworthiness of secure area
Cards and security devices for personal identification — Building blocks for identity management via mobile devices — Part 6: Mechanism for use of certification on trustworthiness of secure area
This document specifies mechanism for use of certification on trustworthiness of secure area that is defined in ISO/IEC 23220-1. This document aims at enabling secure area providers to describe capabilities and confidence level of secure area for verification by eID issuers or mobile eID Attestation service providers, or both. This document specifies: — list of elements describing capabilities and confidence level of a secure area; — structure and management for use of a certificate, affixed or not to the secure area, containing that list of elements. This document refers to existing standards and applicable industry specifications which partly address the trustworthiness related issue (e.g. DLOA specified in GlobalPlatform specification GPC_SPE_095[ REF Reference_ref_3 \r \h 1 08D0C9EA79F9BACE118C8200AA004BA90B0200000008000000100000005200650066006500720065006E00630065005F007200650066005F0033000000 ], MDS specified in FIDO Alliance specification[ REF Reference_ref_4 \r \h 2 08D0C9EA79F9BACE118C8200AA004BA90B0200000008000000100000005200650066006500720065006E00630065005F007200650066005F0034000000 ], and SAAO specified in ISO/IEC TS 23220-3), and aims to minimize the differences between them.
Cartes et dispositifs de sécurité pour l’identification des personnes — Blocs fonctionnels pour la gestion des identités via les dispositifs mobiles — Partie 6: Mécanisme pour l'utilisation de la certification concernant la fiabilité de la zone protégée
General Information
Standards Content (Sample)
Technical
Specification
ISO/IEC TS 23220-6
First edition
Cards and security devices for
2025-10
personal identification — Building
blocks for identity management via
mobile devices —
Part 6:
Mechanism for use of certification
on trustworthiness of secure area
Cartes et dispositifs de sécurité pour l’identification des
personnes — Blocs fonctionnels pour la gestion des identités via
les dispositifs mobiles —
Partie 6: Mécanisme pour l'utilisation de la certification
concernant la fiabilité de la zone protégée
Reference number
© ISO/IEC 2025
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2025 – All rights reserved
ii
Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Abbreviated terms . 3
5 Mechanism for use of certification on trustworthiness of secure area . 3
6 List of elements describing capabilities of a secure area . 6
6.1 General .6
6.2 Elements of trustworthiness characteristics for secure area .7
6.2.1 General .7
6.2.2 Secure Environment Vendor Name .7
6.2.3 Secure Environment Certification Information .7
6.2.4 Secure environment operating system and version .8
6.2.5 Secure environment operating system vendor .8
6.2.6 SA-Application Provider name .9
6.2.7 SA-Application Version.9
6.2.8 SA-Application Certification Information .9
6.2.9 Cryptographic key generation.10
6.2.10 Cryptographic key destruction .11
6.2.11 Cryptographic key derivation.11
6.2.12 Cryptographic operation. 12
6.2.13 Random number generation . 13
6.2.14 Information flow control functions (Simple security attributes) .14
6.2.15 Stored data integrity monitoring . 15
6.2.16 Access control policy (Subset access control) . 15
6.2.17 Access control functions.16
6.2.18 Timing of authentication .17
6.2.19 User authentication before any action .17
6.2.20 Re-authenticating .17
6.2.21 Security management of functions .18
6.2.22 Security roles.19
6.2.23 Management of security functionality data .19
6.2.24 Management of security attributes . 20
6.2.25 Specification of management functions .21
6.2.26 Anonymity .21
6.2.27 Emanation . 22
6.2.28 Resistance to physical attack . 23
6.2.29 Testing .24
6.2.30 Failure with preservation of secure state . 25
6.2.31 Trusted path/channels . . 25
7 Encoding Trustworthiness Characteristic information .26
7.1 General . 26
7.2 Encoding trustworthiness certificate .27
Annex A (informative) Example of trustworthiness information of secure area .29
Annex B (informative) Certificate profile .33
Bibliography .35
© ISO/IEC 2025 – All rights reserved
iii
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical activity.
ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations,
governmental and non-governmental, in liaison with ISO and IEC, also take part in the work.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of document should be noted. This document was drafted in accordance with the editorial rules of the ISO/
IEC Directives, Part 2 (see www.iso.org/directives or www.iec.ch/members_experts/refdocs).
ISO and IEC draw attention to the possibility that the implementation of this document may involve the
use of (a) patent(s). ISO and IEC take no position concerning the evidence, validity or applicability of any
claimed patent rights in respect thereof. As of the date of publication of this document, ISO and IEC had not
received notice of (a) patent(s) which may be required to implement this document. However, implementers
are cautioned that this may not represent the latest information, which may be obtained from the patent
database available at www.iso.org/patents and https://patents.iec.ch. ISO and IEC shall not be held
responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO's adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT) see www.iso.org/iso/foreword.html.
In the IEC, see www.iec.ch/understanding-standards.
This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 17, Cards and security devices for personal identification.
A list of all parts in the ISO/IEC 23220 series can be found on the ISO and IEC websites.
Any feedback or questions on this document should be directed to the user’s national standards
body. A complete listing of these bodies can be found at www.iso.org/members.html and
www.iec.ch/national-committees.
© ISO/IEC 2025 – All rights reserved
iv
Introduction
Electronic ID-Applications (eID-Apps) are commonly used in badges and ID cards with integrated circuits
and allow users to complete electronic identification, authentication, or optionally, to create digital
signatures. Many different application areas have an essential need for these mechanisms and use different
means to provide these features (e.g. health system with health assurance cards or health professional
cards, financial sector with payment cards, governmental ID with national ID cards, electronic passports
or driver's licenses, educational systems with student cards or library cards, in the company sector with
employee cards and in the private sector with any kind of member cards).
Mobile devices (e.g. mobile phones or smart phones, wearable devices) are a central part of the daily life for
many individuals. They are not only used for communication, but also for emailing, access to social media,
gaming, shopping, banking, and storing of private content such as photos, videos and music. They are used
today as a personal device for business and private applications. With the ubiquity of mobile devices in
day-to-day activities there is a strong demand from users to have eID-Apps or services with identification/
authentication mechanisms on their mobile equipment, i.e. an mdoc app.
An mdoc app can be deployed to provide a number of different digital ID-documents. Additionally, it can
reside among other eID-Apps on a mobile device. Moreover, users can possess more than one mobile device
holding an mdoc app, which leads to enhanced mechanisms for the management of credentials and attributes.
The technical preconditions for the deployment of mdoc apps exist and they are partly standardized to
support security and privacy on a mobile device. Examples for containers of eID-App solutions are the
software-bas
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.