ISO/IEC 18013-5

ISO/IEC 18013-5 is an international standard, formally titled "Personal identification — ISO-compliant driving licence — Part 5: Mobile driving licence (mDL) application," that specifies the technical requirements for issuing and verifying a driving license using a mobile device. It defines a cryptographically secure data structure and a standardized communication protocol, enabling a holder's smartphone to present verifiable credential data to a relying party, such as a police officer or a merchant, without revealing unnecessary personal information. This standard is pivotal for creating interoperable digital driver's licenses that can be recognized and trusted across different jurisdictions and verification systems.

The core innovation of the standard is its focus on privacy-by-design and user consent. It employs a selective disclosure model, allowing the mDL holder to reveal only specific data attributes (e.g., "over 21") instead of the entire document. Communication typically occurs via proximity technologies like Bluetooth or NFC using a QR code initiation process, ensuring the verifier never directly accesses the holder's device. The data is signed by the issuing authority (e.g., a state's Department of Motor Vehicles) using Public Key Infrastructure (PKI), allowing the verifier to cryptographically authenticate the data's origin and integrity without an online connection.

For implementation, the standard details two primary operational models: the Device Retrieval model, where the verifier's device reads data directly from the holder's device, and the Holder Presented model, where the holder transfers data via a visual code. It specifies the mandatory and optional data elements (from the ISO/IEC 18013-1 physical card standard), cryptographic suites, and the structure of the Mobile Security Object (MSO), which contains the signed data. This technical rigor ensures that an mDL is as legally and functionally robust as its physical counterpart, while adding enhanced security against forgery and convenient portability.

The adoption of ISO/IEC 18013-5 is a significant step toward global digital identity frameworks. It is increasingly being piloted and enacted by government agencies worldwide as the foundation for official mobile driver's licenses. Furthermore, its design principles of verifiable credentials and minimal disclosure make it a influential blueprint for other forms of digital identity beyond driving permits, contributing to broader ecosystems like decentralized identity (SSI) and secure age verification.

ISO/IEC 18013-5 is an international technical standard published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) that defines the requirements for a mobile driving license (mDL). It specifies the data structure, security mechanisms, and communication protocols that allow a driver's license to be securely stored and presented from a mobile device. The standard's primary goal is to enable interoperability, ensuring an mDL issued in one jurisdiction can be reliably verified by a relying party (e.g., a police officer or a merchant) in another, using a standardized verification process.

The development of this standard was driven by the global need for a secure, privacy-preserving alternative to physical plastic cards. It builds upon the data elements defined in its predecessor, ISO/IEC 18013-2, which outlines the physical driver's license specifications. A core innovation of Part 5 is its support for selective disclosure, allowing the mDL holder to reveal only specific, necessary attributes (like age verification) without exposing their entire license data. This is achieved through cryptographic techniques, enhancing user privacy and data minimization.

The standard defines two primary operational models: the proximity model, which uses near-field communication (NFC) or Bluetooth for device-to-device data transfer, and the remote model for online verification. It meticulously details the mDL data format, the mDL reader requirements, and the authentication protocols that prevent forgery and replay attacks. By providing this common technical blueprint, ISO/IEC 18013-5 has become the foundational document guiding government implementations, technology vendors, and verifier ecosystems worldwide, moving digital identity credentials from proprietary solutions to a unified, global framework.

The standard specifies how an mDL (mobile driver's license) is created, stored, and presented. It defines a standardized data model for identity attributes—such as name, date of birth, and portrait—that can be shared from a holder's device to a verifier. This is achieved through a QR code or Near Field Communication (NFC) connection, which establishes a secure, encrypted data channel. The core mechanism ensures the verifier receives only the specific data elements the holder consents to share, a principle known as data minimization.

At the heart of the protocol is the ISO mDL Data Model, which structures identity data into a machine-readable format. This model includes mandatory and optional data groups, cryptographic security elements, and device authentication mechanisms. When a verification request is initiated, the mDL app on the holder's device creates a signed data structure that includes the requested attributes and proof that the data originated from an authorized, genuine mDL. This process leverages Public Key Infrastructure (PKI) to ensure the data's integrity and authenticity, preventing tampering and forgery.

The standard supports two primary operational modes: device retrieval and proximity-based transfer. In device retrieval, the verifier scans a QR code displayed by the holder, which contains a session establishment payload. In proximity transfer, an NFC tap initiates the secure data exchange. Both methods allow for selective disclosure, where the holder can choose to share only their age category instead of their exact birth date, for example. This balances verification needs with privacy protection.

For a verification to be trusted, the Issuer (e.g., a state DMV) must digitally sign the mDL data during issuance. The verifier's system must then validate this signature against a trusted root certificate from the issuing authority. The standard also defines Device Authentication to prove the mDL is presented from a genuine, secure element on the holder's registered device, not a screenshot or copied data file. This multi-layered cryptographic verification is what makes an ISO 18013-5 mDL a reliable digital credential.

Implementation of ISO/IEC 18013-5 enables a wide range of use cases, from age verification at retail points-of-sale to streamlined airport security checks and online identity proofing. Its interoperability is key; a standard-compliant mDL issued in one jurisdiction should be verifiable by a compliant reader in another. The protocol's design aligns with broader Self-Sovereign Identity (SSI) principles by giving individuals control over their personal data while providing a high-assurance, globally recognized standard for digital identity.