Digital identification has shifted from physical plastic cards to cryptographic records stored directly on personal devices. This evolution relies heavily on the mobile document, commonly known as an mDoc, which standardizes how digital IDs, driver's licenses, and high-assurance credentials are exchanged and verified.
An mDoc is a digital identity document created according to the ISO/IEC 18013-5 technical specification. Unlike simple scanned images or basic PDF copies of identification cards, an mDoc contains cryptographically signed data structures issued by trusted authorities. These credentials live natively on smartphones and allow users to prove identity traits—such as age or licensure—without exposing unnecessary personal information.
Core Architecture and Standards of mDocs
The foundation of any mobile document lies in its underlying data model and trust framework. Standardisation ensures that a credential issued by one jurisdiction can be read, authenticated, and trusted by a verifier anywhere else in the world.
The ISO/IEC 18013-5 Framework
The primary standard governing mobile documents is ISO/IEC 18013-5, which was originally designed for mobile driving licenses (mDLs) but scales to other identity documents like passports and national IDs.
- Data Structure: Information inside an mDoc is partitioned into secure namespaces using Concise Binary Object Representation (CBOR) and signed using JSON Web Signatures or similar cryptographic primitives.
- Issuer Signatures: Every mDoc includes a digital signature from the issuing authority (such as a department of motor vehicles or government registry). Verifiers check this signature to confirm the credential hasn't been altered.
- Device Binding: The credential is cryptographically bound to the secure hardware element of the user's smartphone, meaning it cannot be copied or cloned onto another device.
Privacy Through Selective Disclosure
Traditional plastic cards force users to display their entire identity profile—including home addresses, exact birth dates, and ID numbers—just to prove a single fact like legal drinking age. mDocs solve this through selective disclosure.
- Credential holders can present only the specific claims requested by a verifier.
- Cryptographic hashing allows a verifier to confirm that a "true" or "false" statement (e.g., "Is this person over 21?") is valid without reading the underlying birth date or name.
Verification Methods: Online vs. Offline Checks
One of the most powerful features of the mDoc specification is its flexibility in verification environments. Verifiers don't always need an active internet connection to check if an ID is genuine.
Offline Proximity Verification
In scenarios like a roadside traffic stop, a retail purchase, or a secure venue entry, network connectivity might be unavailable or unreliable. mDocs support offline verification using short-range communication protocols:
- Bluetooth Low Energy (BLE): The verifier's device establishes a secure, encrypted local session with the holder's smartphone.
- QR Code Presentation: A holder can display a dynamic QR code containing a cryptographically signed presentation package that the verifier's terminal scans and validates instantly.
- NFC Proximity: Tapping phones or devices together can initiate a secure data exchange channel.
Because the issuer's digital signature is embedded directly within the mDoc file, the verifier's device can mathematically validate authenticity offline by referencing the trusted root certificate of the issuing authority.
Remote Online Verification
When verifying an identity over the internet—such as opening a bank account or signing up for a digital service—mDocs use secure remote protocols. The holder's device establishes a secure connection with the verifier's web service, transmitting only the authorized data fields over an encrypted session.
Implementing mDocs: Practical Considerations for Developers
Integrating mobile identity documents into existing software architecture requires careful attention to cryptographic key management, user experience, and privacy laws.
Handling Trust Anchors
To verify an mDoc, an application must maintain a secure store of trusted root certificates issued by governing bodies.
- Applications must regularly sync certificate revocation lists (CRLs) or use online certificate status protocols to ensure compromised issuer keys are flagged immediately.
- Software development kits (SDKs) provided by platforms like MATTR Docs often abstract these cryptographic checks into manageable API calls.
Common Integration Pitfalls
- Failing to Validate Device Binding: Accepting a raw data export from an mDoc without verifying the hardware-bound signature leaves the system vulnerable to replay attacks.
- Over-Requesting Data: Requesting full identity payloads when only a simple verification check is required violates privacy principles and increases compliance burdens under data protection regulations like GDPR.
- Ignoring Offline Fallbacks: Designing verification workflows that strictly depend on cloud connectivity will cause failures in low-signal environments.
Frequently Asked Questions
What is the difference between an mDoc and a digital image of an ID?
A digital image (like a photo or PDF of a passport) is easily forged, lacks cryptographic protection, and cannot verify whether the document has been revoked. An mDoc is a cryptographically signed, interactive data file bound to device hardware that proves authenticity instantly.
Can an mDoc be tracked when used offline?
No. Offline verification via Bluetooth or QR codes happens peer-to-peer without routing data back to a central server, preserving the user's location privacy and browsing habits.
What happens if a smartphone running an mDoc is lost or stolen?
Because mDocs are bound to the secure hardware enclave of the phone and protected by device biometrics (such as Face ID or fingerprint scans), a finder cannot access the credential without the owner's biometric authentication. Furthermore, the user can remotely revoke the credential via their issuer portal.
Are mDocs legally recognized globally?
Adoption is growing rapidly as more countries and states update their legislation to recognize ISO/IEC 18013-5 compliant credentials as legal equivalents to physical identification cards for specific use cases like driving and travel.
