mdoc second-edition presentations

This guide covers device retrieval with ISO/IEC 18013-5 second-edition request features. For credential creation and OID4VCI, see Issue credentials.

The MSO remains version 1.0. A second-edition DeviceRequest uses version 1.1 when it contains second-edition request information. This is not a version 2.0 wire format.

Create a DeviceRequest

The wire message is CBOR. The JSON below shows the same fields in a readable form:

{
  "version": "1.1",
  "docRequests": [
    {
      "itemsRequest": {
        "docType": "org.iso.18013.5.1.mDL",
        "nameSpaces": {
          "org.iso.18013.5.1": {
            "family_name": false,
            "given_name": false,
            "document_number": false
          }
        },
        "requestInfo": {
          "alternativeDataElements": [
            ["org.iso.18013.5.1", "portrait"],
            ["org.iso.18013.5.1", "signature_usual_mark"]
          ],
          "issuerIdentifiers": ["base64url-authority-key-identifier"],
          "uniqueDocSetRequired": true,
          "maximumResponseSize": 65536
        }
      }
    }
  ]
}

Apply these rules when processing the request:

Field	Rule
alternativeDataElements	Select the first complete alternative set available in the document.
issuerIdentifiers	Match the X.509 AuthorityKeyIdentifier keyIdentifier, not a DER certificate.
uniqueDocSetRequired	When true, one document cannot satisfy two requested document sets.
maximumResponseSize	Measure the encoded CBOR response produced by the transport codec.

Reject a required request feature that the holder does not support. An optional request item may be omitted.

Read a DeviceResponse

DeviceResponse contains the selected documents and a status value:

{
  "version": "1.0",
  "status": 0,
  "documents": ["IssuerSigned", "DeviceSigned"]
}

The JSON is a readable representation; the actual response and signatures are CBOR and COSE.

Status	Meaning
0	Success
10	General error
11	Unknown document request
12	Unsupported request

A non-zero status must not include ordinary, encrypted, or zero-knowledge response documents.

Check status and issuer trust

Credential status is stored in the issuer-signed MSO data. The entry identifies the status-list URI and index. Retrieve the CWT Token Status List as application/statuslist+cwt, validate its COSE signature and validity period, then read the indexed bit.

The verifier must also validate the DSC chain, device authentication, reader authentication when required, and the selected trust policy. VICAL may supply admitted IACAs, but it does not contain credential status.

See Verify credentials and mdoc VICAL and CWT status.

Handle invalid input

Reject requests or responses with an issuer-identifier mismatch, duplicate document selection when uniqueness is required, an oversized encoded response, an unsupported required feature, the wrong docType, invalid reader authentication, invalid device authentication, stale status data, or an untrusted VICAL signer.