ISO/IEC DTS 18013-7

Personal identification — ISO-compliant driving licence — Part 7: Mobile driving licence (mDL) add-on functions

This document augments the capabilities of the mobile driving licence (mDL) standardized in ISO/IEC 18013-5 with the following additional functionality: — presentation of a mobile driving licence to a reader over the internet.

Identification des personnes — Permis de conduire conforme à l'ISO — Partie 7: Fonctionnalités supplémentaires pour permis de conduire sur téléphone mobile

General Information

• Status: Not Published
• ICS: 35.240.15 - Identification cards. Chip cards. Biometrics
• Technical Committee: ISO/IEC JTC 1/SC 17 - Cards and security devices for personal identification
• Drafting Committee: ISO/IEC JTC 1/SC 17/WG 10 - Motor vehicle driver licence and related documents
• Current Stage: 5020 - FDIS ballot initiated: 2 months. Proof sent to secretariat
• Start Date: 21-Feb-2025
• Due Date: 21-Feb-2025
• Completion Date: 21-Feb-2025

Relations

• Revises: ISO/IEC TS 18013-7:2024 - Personal identification — ISO-compliant driving licence — Part 7: Mobile driving licence (mDL) add-on functions
• Effective Date: 07-Jan-2025

Standards Content (Sample)

FINAL DRAFT
Technical
Specification
ISO/IEC DTS
18013-7
ISO/IEC JTC 1/SC 17
Personal identification — ISO-
Secretariat: BSI
compliant driving licence —
Voting begins on:
2025-02-21
Part 7:
Mobile driving licence (mDL) add-
Voting terminates on:
2025-04-18
on functions
Identification des personnes — Permis de conduire conforme à
l'ISO —
Partie 7: Fonctionnalités supplémentaires pour permis de
conduire sur téléphone mobile
RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT,
WITH THEIR COMMENTS, NOTIFICATION OF ANY
RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE
AND TO PROVIDE SUPPOR TING DOCUMENTATION.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO-
LOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE
TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL
TO BECOME STAN DARDS TO WHICH REFERENCE MAY BE
MADE IN NATIONAL REGULATIONS.
Reference number
FINAL DRAFT
Technical
Specification
ISO/IEC DTS
18013-7
ISO/IEC JTC 1/SC 17
Personal identification — ISO-
Secretariat: BSI
compliant driving licence —
Voting begins on:
Part 7:
Mobile driving licence (mDL) add-
Voting terminates on:
on functions
Identification des personnes — Permis de conduire conforme
à l'ISO —
Partie 7: Fonctionnalités supplémentaires pour permis de
conduire sur téléphone mobile
RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT,
WITH THEIR COMMENTS, NOTIFICATION OF ANY
RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE
AND TO PROVIDE SUPPOR TING DOCUMENTATION.
© ISO/IEC 2025
IN ADDITION TO THEIR EVALUATION AS
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO-
LOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL
or ISO’s member body in the country of the requester.
TO BECOME STAN DARDS TO WHICH REFERENCE MAY BE
MADE IN NATIONAL REGULATIONS.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland Reference number
© ISO/IEC 2025 – All rights reserved
ii
Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Abbreviated terms . 2
5 Conformance requirement . 2
6 mDL overview . 2
6.1 Standards context .2
6.2 Interfaces .2
6.3 Design objectives .3
6.4 Technical requirements .3
6.4.1 Data structures and data elements .3
6.4.2 Data model .3
6.4.3 Data exchange .4
6.4.4 Security mechanisms .5
6.5 Protocol considerations . .7
6.5.1 General .7
6.5.2 Discovery and invocation of mdoc using a custom URI scheme .7
6.5.3 Possible attack .7
7 mDL data model . 8
Annex A (normative) Mechanisms for device retrieval to a website . 9
Annex B (normative) Use of OID4VP to retrieve an mdoc .15
Annex C (normative) Digital credentials API retrieval .39
Bibliography .42

© ISO/IEC 2025 – All rights reserved
iii
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical activity.
ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations,
governmental and non-governmental, in liaison with ISO and IEC, also take part in the work.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of document should be noted. This document was drafted in accordance with the editorial rules of the ISO/
IEC Directives, Part 2 (see www.iso.org/directives or www.iec.ch/members_experts/refdocs).
ISO and IEC draw attention to the possibility that the implementation of this document may involve the
use of (a) patent(s). ISO and IEC take no position concerning the evidence, validity or applicability of any
claimed patent rights in respect thereof. As of the date of publication of this document, ISO and IEC had not
received notice of (a) patent(s) which may be required to implement this document. However, implementers
are cautioned that this may not represent the latest information, which may be obtained from the patent
database available at www.iso.org/patents and https://patents.iec.ch. ISO and IEC shall not be held
responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO's adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT) see www.iso.org/iso/foreword.html.
In the IEC, see www.iec.ch/understanding-standards.
This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 17, Cards and security devices for personal identification.
This second edition cancels and replaces the first edition (ISO/IEC TS 18013-7:2024), which has been
technically revised.
The main changes are as follows:
— Annex A.5, mdoc MAC authentication, was updated;
— normative Annex C, Digital credentials API retrieval, was added.
A list of all parts in the ISO/IEC 18013 series can be found on the ISO and IEC websites.
Any feedback or questions on this document should be directed to the user’s national standards
body. A complete listing of these bodies can be found at www.iso.org/members.html and
www.iec.ch/national-ommittees.

© ISO/IEC 2025 – All rights reserved
iv
Introduction
ISO/IEC 18013-5 describes interface and related requirements to facilitate ISO-compliant driving licence
functionality on a mobile device, standardizing the mobile driving licence (mDL) functionality.
This document augments the capabilities of the mDL by describing the interface and related requirements
for presentation to a mDL reader over the internet.
A mobile document conforming to this document primarily conveys the driving privileges associated with a
person. However, the transaction and security mechanisms in this document have been designed to support
other types of mobile documents, specifically including identification documents.
NOTE ISO/IEC 18013-5 places the onus on the mDL verifier to match data received (in an mdoc) to the person
presenting the mdoc. This edition of this document does not change that.

© ISO/IEC 2025 – All rights reserved
v
FINAL DRAFT Technical Specification ISO/IEC DTS 18013-7:2025(en)
Personal identification — ISO-compliant driving licence —
Part 7:
Mobile driving licence (mDL) add-on functions
1 Scope
This document augments the capabilities of the mobile driving licence (mDL) standardized in ISO/IEC 18013-5
with the following additional functionality:
— presentation of a mobile driving licence to a reader over the internet.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content constitutes
requirements of this document. For dated references, only the edition cited applies. For undated references,
the latest edition of the referenced document (including any amendments) applies.
ISO/IEC 18013-5, Personal identification — ISO-compliant driving licence — Part 5: Mobile driving licence
(mDL) application
RFC 4648, S. Josefsson, The Base16, Base32, and Base64 Data Encodings
RFC 5280, D. Cooper et al., Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List
(CRL) Profile
RFC 9101, N. Sakimura, The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR
RFC 9112, R. Fielding et al., HTTP/1.1
RFC 9180, R. Barnes et al., Hybrid Public Key Encryption
OID4VP (OpenID for Verifiable Presentations), O. Terbu et al., Draft 18, April 2023
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO/IEC 18013-5 and the following apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https:// www .iso .org/ obp
— IEC Electropedia: available at https:// www .electropedia .org/
3.1
mdoc reader
either device or service, or both, that can retrieve data from an mdoc and verify the authenticity of the data
Note 1 to entry: The mdoc reader includes, but is not limited to, the hardware and software components used.

© ISO/IEC 2025 – All rights reserved
4 Abbreviated terms
OID4VP OpenID for Verifiable Presentations
5 Conformance requirement
An mDL is in conformance with this document if it meets all the requirements specified directly or by
reference herein.
An mDL reader is in conformance with this document if it meets all the requirements specified directly or
referenced herein.
NOTE Conformance of an mDL or an mDL reader with ISO/IEC 18013-5 is not required for conformance with this
document, except for those clauses normatively referenced in this document. An mDL or an mDL reader conforming
with this document can also be in conformity with ISO/IEC 18013-5.
6 mDL overview
6.1 Standards context
ISO/IEC 18013-5 describes th
...

ISO/IEC TSDTS 18013-7:2024(en)
Second edition
2024-12
ISO/IEC JTC 1/SC 17
Secretariat: BSI
Date: 2025-02-05
Personal identification — ISO-compliant driving licence —
Part 7:
Mobile driving licence (mDL) add-on functions
Identification des personnes — Permis de conduire conforme à l'ISO —
Partie 7: Fonctionnalités supplémentaires pour permis de conduire sur téléphone mobile

FDIS stage
ISO/IEC TSDTS 18013-7:2024(:(en)
© ISO/IEC 20242025
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication
may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying,
or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO
at the address below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: + 41 22 749 01 11
E-mail: [e-mail]
Website: www.iso.org
Field Code Changed
Published in Switzerland
© ISO/IEC 20242025 – All rights reserved
ii
ISO/IEC TSDTS 18013-7:2024(:(en)
Contents
Foreword . iv
Introduction . v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Abbreviated terms . 2
5 Conformance requirement . 2
6 mDL overview . 2
6.1 Standards context . 2
6.2 Interfaces . 2
6.3 Design objectives . 3
6.4 Technical requirements . 4
6.5 Protocol considerations . 8
7 mDL data model . 9
Annex A (normative) Mechanisms for device retrieval to a website . 10
Annex B (normative) Use of OID4VP to retrieve an mdoc . 17
Annex C (normative) Digital credentials API retrieval . 47
Bibliography . 51

© ISO/IEC 20242025 – All rights reserved
iii
ISO/IEC TSDTS 18013-7:2024(:(en)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are members
of ISO or IEC participate in the development of International Standards through technical committees
established by the respective organization to deal with particular fields of technical activity. ISO and IEC
technical committees collaborate in fields of mutual interest. Other international organizations, governmental
and non-governmental, in liaison with ISO and IEC, also take part in the work.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of
document should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC
Directives, Part 2 (see www.iso.org/directives or www.iec.ch/members_experts/refdocs).
ISO and IEC draw attention to the possibility that the implementation of this document may involve the use of
(a) patent(s). ISO and IEC take no position concerning the evidence, validity or applicability of any claimed
patent rights in respect thereof. As of the date of publication of this document, ISO and IEC had not received
notice of (a) patent(s) which may be required to implement this document. However, implementers are
cautioned that this may not represent the latest information, which may be obtained from the patent database
available at www.iso.org/patents and https://patents.iec.ch. ISO and IEC shall not be held responsible for
identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO's adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT) see www.iso.org/iso/foreword.html.
In the IEC, see www.iec.ch/understanding-standards.
This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 17, Cards and security devices for personal identification.
This second edition cancels and replaces the first edition (ISO/IEC TS 18013-7:2024), which has been
technically revised.
The main changes are as follows:
— Annex A.5, mdoc MAC authentication, was updated;
— normative Annex C, Digital credentials API retrieval, was added.
A list of all parts in the ISO/IEC 18013 series can be found on the ISO websiteand IEC websites.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html and www.iec.ch/national-
ommittees.
© ISO/IEC 20242025 – All rights reserved
iv
ISO/IEC TSDTS 18013-7:2024(:(en)
Introduction
ISO/IEC 18013-5 describes interface and related requirements to facilitate ISO-compliant driving licence
functionality on a mobile device, standardizing the mobile driving licence (mDL) functionality.
This document augments the capabilities of the mDL by describing the interface and related requirements for
presentation to a mDL reader over the internet.
A mobile document conforming to this document primarily conveys the driving privileges associated with a
person. However, the transaction and security mechanisms in this document have been designed to support
other types of mobile documents, specifically including identification documents.
NOTE ISO/IEC 18013-5 places the onus on the mDL verifier to match data received (in an mdoc) to the person
presenting the mdoc. This versionedition of this document does not change this. that.
© ISO/IEC 20242025 – All rights reserved
v
ISO/IEC TSDTS 18013-7:2024(:(en)
Personal identification — ISO-compliant driving licence —
Part 7:
Mobile driving licence (mDL) add-on functions
1 Scope
This document augments the capabilities of the mobile driving licence (mDL) standardized in ISO/IEC 18013-
5 with the following additional functionality:
— presentation of a mobile driving licence to a reader over the internet.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content constitutes
requirements of this document. For dated references, only the edition cited applies. For undated references,
the latest edition of the referenced document (including any amendments) applies.
ISO/IEC 18013-5, Personal identification — ISO-compliant driving licence — Part 5: Mobile driving licence
(mDL) application
RFC 4648, S. Josefsson, The Base16, Base32, and Base64 Data Encodings
RFC 5280, D. Cooper et al., Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List
(CRL) Profile
RFC 8152, J. Schaad, CBOR Object Signing and Encryption (COSE), July 2017
RFC 9101, N. Sakimura, The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR
RFC 9112, R. Fielding et al., HTTP/1.1
RFC 9180, R. Barnes et al., Hybrid Public Key Encryption
OID4VP (OpenID for Verifiable Presentations), O. Terbu et al., Draft 18, April 2023
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO/IEC 18013-5 and the following
apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https://www.iso.org/obp
— IEC Electropedia: available at https://www.electropedia.org/
3.1
mdoc reader
either device or service, or both, that can retrieve data from an mdoc and verify the authenticity of the data
Note 1 to entry: The mdoc reader includes, but is not limited to, the hardware and software components used.
© ISO/IEC 20242025 – All rights reserved
ISO/IEC TSDTS 18013-7:2024(:(en)
4 Abbreviated terms
OID4VP OpenID for Verifiable Presentations
5 Conformance requirement
An mDL is in conformance with this document if it meets all the requirements specified directly or by reference
herein.
An mDL reader is in conformance with this document if it meets all the requirements specified directly or
referenced herein.
NOTE Conformance of an mDL or an mDL reader with ISO/IEC 18013-5 is not required for conformance with this
document, except for those clauses normatively referenced in this document. An mDL or an mDL reader conforming with
this document can also be in conformity with ISO/IEC 18013-5.
6 mDL overview
6.1 Standards context
ISO/IEC 18013-5 describes the interface and related requirements to specifically facilitate ISO-compliant
driving licence functionality on a mobile device. This document adds functionality by building on top of
ISO/IEC 18013-5.
The transaction and security mechanisms in this document have been designed to also be applicable to other
types of mobile documents besides the mobile driving licence.
6.2 Interfaces
Figure 1 shows the interfaces in scope for this document. The explanation of each interface is as follows:
— Interface 1 in Figure 1 is the interface between the issuing authority (IA) infrastructure and the mDL. This
interface is out of scope for this document.
— Interface 2 in Figure 1 is the interface between the mDL and the mDL reader. This interface is specified in
this document. The interface can be used for connection setup and for the device retrieval method.
— Interface 3 in Figure 1 is the interface between the IA infrastructure and the mDL reader. This interface is
defined in ISO/IEC 18013-5. No new requirements are added in this document.
© ISO/IEC 20242025 – All rights reserved
ISO/IEC TSDTS 18013-7:2024(:(en)

Figure 1 — mDL interfaces
6.3 Design objectives
The objectives underlying the requirements in this document include at least the following:
a) An mDL verifier together with an mDL reader is able to request and receive an mDL, and validate its
integrity and authenticity.
b) An mDL verifier not associated with the IA is able to verify the integrity and authenticity of an mDL.
c) An mDL verifier is enabled to confirm the binding between the person presenting the mDL and the mDL
holder.
© ISO/IEC 20242025 – All rights reserved
ISO/IEC TSDTS 18013-7:2024(:(en)
d) The interface between the mDL and the mDL reader supports the selective release of mDL data to an mDL
reader.
NOTE As in ISO/IEC 18013-5, the portrait image can be used for verifying that the person presenting the mDL is the
mDL holder. Depending on the transaction details, in an unattended transaction this data element might not be able to
serve the purpose of confirming that the person presenting the mDL is the mDL holder. Other methods can be used as
well but are out of scope of this document. Other mechanisms are described in References [1] and [2].
6.4 Technical requirements
6.4.1 Data structures and data elements
The descriptions and requirements for Concise Binary Object Representation (CBOR), Concise Data Definition
Language (CDDL), and version elements in ISO/IEC 18013-5 shall apply in this document.
Additionally, unless explicitly stated otherwise for a data structure, an mDL or mDL reader shall not give an
error solely on the basis that it does not know the data structure. This requirement also applies when the
CDDL definition of the data structure does not allow the presence of additional key-value pairs in the map,
next to the specified ones.
6.4.2 Data model
The data model is described in Clause 7. It describes the identifier and format of the data elements.
6.4.3 Data exchange
6.4.3.1 Overview
An mDL or mDL reader shall support at least one of the following flows and may support more:
a) Usingusing the device retrieval messages structures and transmission channel as defined in
6.4.3.26.4.3.2.;
b) Usingusing OID4VP as a transmission channel, as defined in Annex B.;
c) Usingusing the device retrieval request and response structure over an API, as defined in Annex CAnnex
C.
The different flows are depicted in Figure 2.
© ISO/IEC 20242025 – All rights reserved
ISO/IEC TSDTS 18013-7:2024(:(en
...