iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
ISO/IEC 18013-5:2021 defines the interfaces that let a mobile driving licence (mDL) carry authoritative licence data from an issuing authority to a holder’s wallet and then to a reader that can verify origin, integrity and holder binding. It is an interface specification, not a complete enterprise security policy: consent, private-key storage, lifecycle operations and several assurance controls remain implementation responsibilities.
What is ISO/IEC 18013-5?
ISO/IEC 18013-5:2021 is the fifth part of the ISO/IEC 18013 mobile driving-licence family. Its abstract says: “This document establishes interface specifications for the implementation of a driving licence in association with a mobile device.” The 2021 first edition is 152 pages and was published on 2021-09-30.
Part 5 defines three connected boundaries:
| Interface | Enterprise purpose |
|---|---|
| Issuing authority infrastructure | Provides authoritative licence attributes and issuer trust material to the mobile-licence ecosystem. |
| mDL and mobile device | Supports storing and presenting the licence through a holder-controlled device or wallet. |
| mDL and reader | Lets a reader retrieve data and perform authenticity, integrity and holder-binding checks. |
The standard enables a machine to obtain mDL data, tie that data to the mDL holder, authenticate its origin and verify its integrity. It does not, by itself, define every operational or platform-security decision needed to run a national or enterprise identity service.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Which trust actors and boundaries must be designed?
Issuing authority
The issuing authority is the authoritative source for licence attributes and issuer trust material. Its infrastructure is an explicit Part 5 interface endpoint, so architecture documents should identify the systems that create, approve, publish, update and status-check credentials.
#1 Best Overall
- Fully Compliant - Complies With All Major Industry Standards, Including Iso/Iec 7816, Usb Ccid, Pc/Sc, And Microsoft Whql. As Well As, Emv 2011 Ver 4.3 Level 1 And Gsa Fips 201.
- Seamless Integration - With Identiv-Specific Smartos You’Ll Get Easy, Complete Support Of All Major Contact Smart Card Ics And Technologies In One Simple Reader.
- Universal Compatibility - Works With Virtually All Contact Chip Cards And Pc Operating Systems, Including Windows, Macos, Linux And Android.
- Fast And Convenient- Shorten Your Transaction Time With A Reader That’S Optimized For Speed. It’S Ultra-Compact And Robust Design Is Streamlined For Mobile Operation, Making This Reader The Best Choice For Convenience, Security And Reliability.
- Ergonomic and cost efficient design
Holder wallet and mobile device
The wallet stores and presents the mDL on behalf of the licence holder. Part 5’s public abstract does not prescribe how mDL data or private keys are stored. Choosing a platform secure element, hardware-backed keystore or another protected mechanism is therefore an implementation decision that must be justified by the threat model, device fleet and recovery requirements.
mDL reader and verifier
An mDL reader is a device or service that retrieves mdoc data and verifies its authenticity. Verification does not end with a valid cryptographic object: the verifier must also match the received data to the person presenting the mdoc. That identity-binding step may use an approved visual, biometric, document or organizational procedure, but the enterprise must specify and govern it.
Trust and policy services
Certificate and issuer trust lists, status or revocation policy, consent user experience, audit, fraud controls and accessibility sit around the protocol interfaces. Consent acquisition and storage requirements are outside the public Part 5 abstract and must be stated in enterprise policy and platform-security design.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- Advanced Realtek Chipset; PIV, EMS, ISO-7816 & EMV2 2000 Level 1, CE, FCC, VCCI and Microsoft WHQL certifications.
- Supports ActivClient, AKO, OWA, DKO, JKO, NKO, BOL, GKO, Marinenet, AF Portal, Pure Edge Viewer, ApproveIt, DCO, DTS, LPS, Disa Enterprise Email and etc. CAC chip cards
- Sleek ergonomic flat design, precise slot, convenient to horizontally plug card
- Compatible with Windows10/11, Mac OS 10.15 or later. Driver free, plug and play.
- New generation DOD Military CAC USB smart chip card reader, no firmware upgrade requirements
How does an mDL prove it is genuine?
Design the cryptographic control plane around five outcomes rather than around an assumed algorithm list:
- Issuer authenticity. The reader validates that the presented data originated with the claimed issuing authority and that the authority is trusted under the verifier’s policy.
- Integrity. Signed or MAC-protected structures allow the reader to detect alteration after issuance, during device storage or in transit.
- Holder binding. The verifier combines mdoc evidence with an approved identity-binding procedure to establish that the credential belongs to the person presenting it.
- Session protection. For an online presentation, the protocol protects the exchange and records the relevant session transcript. ISO/IEC TS 18013-7 also identifies MacKeys and OID4VP mechanisms as protocol topics.
- Key lifecycle. The operator defines key generation, protected storage, backup policy, rotation, status or revocation, device loss, recovery and compromise response.
Do not infer a particular elliptic curve, hash, signature suite, certificate profile, secure-element requirement or key length from the public ISO summaries. Obtain the licensed normative edition and its applicable profiles before freezing those parameters in an implementation.
“This document also enables parties other than the issuing authority (e.g. other issuing authorities, or mDL verifiers in other countries) to: use a machine to obtain the mDL data; tie the mDL to the mDL holder; authenticate the origin of the mDL data; verify the integrity of the mDL data.” — International Organization for Standardization, ISO/IEC 18013-5:2021.
Rank #3
Identiv SCR3500 Smartfold Smart Card Reader | ISO7816 compliant reader with USB and SCR3500 for e-Banking, network log-on and ID access
- Compact And Lightweight Dongle Form-Factor Card Reader
- Accepts Cards In Id1 Format (Iso8716)
- Ccid Compliant
- Compact and lightweight dongle form-factor card reader
- Accepts cards in ID1 format (ISO8716)
Can an mDL work without internet?
It can, when the selected local device-retrieval engagement, trust material, credential status policy and reader operations are designed for disconnected use. “Offline” is therefore a deployment property to prove, not a blanket promise made by the standard abstract.
| Presentation path | Connectivity model | Important design questions |
|---|---|---|
| Device retrieval | Local reader-to-device engagement; may operate without a live network. | How are trust lists and status information refreshed? How are consent, requested attributes, replay resistance and failed exchanges handled? |
| Internet presentation | Reader receives the mDL over the internet. | How are session encryption, session transcripts, MacKeys, OID4VP and dependent HTTP, OAuth/JAR and X.509 components governed? |
| Issuer-assisted verification | Reader contacts issuing-authority infrastructure; Part 5 includes this as an interface and TS 18013-6 treats it as optional for testing. | What happens during issuer outage, high latency, status-service failure or a policy decision that requires current information? |
ISO/IEC TS 18013-7:2024 adds internet presentation to the Part 5 capabilities. Its scope describes “presentation of a mobile driving licence to a reader over the internet.” A program that needs this path should treat the 2024 document and its referenced protocol dependencies as an additional design surface rather than assuming local engagement semantics automatically apply online.
What does an mDL reader verify?
A reader implementation should make each decision observable and auditable:
Rank #4
- Establish the engagement and determine which attributes are requested for the transaction.
- Obtain the mdoc data through the selected local or online presentation path.
- Validate issuer trust material and the authenticity of the received structures.
- Check integrity protections and reject altered, malformed, incomplete or policy-incompatible data.
- Evaluate freshness, status or revocation according to the deployment’s connectivity and risk policy.
- Perform the approved holder-binding procedure and record whether the presented person matches the credential.
- Release only the attributes needed for the declared purpose, and create an audit record that meets retention and privacy policy.
TS 18013-7 defines an “mdoc reader” as an “either device or service, or both, that can retrieve data from an mdoc and verify the authenticity of the data.” The same specification keeps person-to-credential matching with the verifier, so a cryptographically authentic mdoc must not be treated as proof of identity without that additional check.
How should consent and data minimization work?
Use selective attribute requests as an architecture pattern. A reader asks for only the fields required for a transaction; the wallet shows the request, its purpose and the receiving party; the holder approves or denies release; and the verifier records the decision and the minimum data needed for its legal or operational obligation.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches- Define purpose limitation, retention and onward-sharing rules before integrating readers.
- Provide a clear denial path when a holder refuses optional attributes.
- Log requested and released fields separately so an audit can distinguish attempted over-collection from actual disclosure.
- Design accessible consent screens and recovery paths for device, language or communication impairments.
Part 5 does not prescribe how consent is obtained. Treat the wallet experience, consent evidence and policy enforcement as requirements owned by the enterprise and its platform-security team.
Best Value
- DOD Military CAC USB Smart Card Reader for Government ID, National ID, ActivClient, AKO, OWA, DKO, JKO, NKO, BOL, GKO, Marinenet, AF Portal, Pure Edge Viewer, ApproveIt, DCO, DTS, LPS, Disa Enterprise Email etc. CAC Cards
- Compatible with windows (32/64bit) XP/Vista/ 7/8/10, Mac OS X
- Sleek Ergonomic Design -Gloss Black Finish. EMS ready.ISO7816 Class A,B and C.
- What You Get: Saicoo CAC Smart Card Reader, 18-month warranty and lifetime technical support.
Enterprise key and credential lifecycle blueprint
Document these controls in a security architecture and assign an owner for each one:
- Issuance: authenticate the source record, authorize issuance and bind the credential to the intended holder.
- Device protection: select protected key storage based on threat model, supported devices and recovery objectives; do not present that choice as a Part 5 mandate.
- Distribution and update: protect initial provisioning and subsequent attribute or status updates, and define how stale data is detected.
- Loss and recovery: suspend or replace a credential when a device is lost, wiped or transferred, while preventing an old copy from being accepted.
- Rotation and compromise: rotate issuer and reader trust material, revoke or replace compromised keys, and distribute trust-list changes with an auditable effective time.
- Decommissioning: remove credentials and secrets when a licence expires, is withdrawn or reaches the end of a device or service lifecycle.
How do we test an ISO/IEC 18013-5 implementation?
ISO/IEC TS 18013-6:2025, published on 2025-11-28, defines functional conformity tests for mDL and reader interfaces. It also covers the reader-to-issuing-authority interface when that interface is included as an optional test target.
- Map the implementation. Trace every wallet, reader and issuing-authority interface to the applicable Part 5 requirement and record the edition used.
- Build positive vectors. Test normal retrieval, issuer-authentic data, intact integrity protections, valid holder binding and the attributes requested for each transaction type.
- Build negative vectors. Include altered fields, malformed structures, invalid trust material, expired or unavailable status, replayed sessions, unexpected attributes, denial of consent and interrupted transport.
- Exercise connectivity branches. Run local disconnected scenarios, degraded-network scenarios and issuer-assisted checks, recording latency, timeout and recovery behavior.
- Run the TS 18013-6 suite. Preserve test inputs, outputs, implementation version, trust-list state and pass/fail evidence so another assessor can reproduce the result.
- Add separate assurance work. Perform penetration testing, key-management review, privacy assessment, accessibility review and operational recovery testing. These activities complement TS 18013-6; they are not automatically ISO conformity tests.
TS 18013-6 excludes internal secure-area behavior, non-functional requirements and provisioning interfaces outside its stated scope. A passing functional-conformity result therefore does not certify the wallet’s hardware isolation, availability, privacy posture or disaster recovery.
Recommended Free Tools
Which edition should an architecture use?
| Document | Status and date | Architecture implication |
|---|---|---|
| ISO/IEC 18013-5:2021 | Edition 1; published 2021-09-30; 152 pages; listed as “To be revised.” | Baseline interface specification for mobile-device, reader and issuing-authority interactions. |
| ISO/IEC TS 18013-7:2024 | 2024 technical specification and public preview. | Adds internet presentation and identifies session, transcript, MacKeys and OID4VP topics. |
| ISO/IEC TS 18013-6:2025 | Published 2025-11-28. | Functional conformity testing for mDL and reader interfaces, with an optional issuer-interface target. |
| ISO/IEC DIS 18013-5 | Next Part 5 version under development. | Check the successor before freezing data structures, profiles, trust-list behavior or certification plans. |
Public previews and abstracts are not substitutes for the licensed normative texts. Date-stamp architecture decisions, record the exact edition and profile used, and re-run impact analysis when the revised Part 5 is published.
Quick Recap
Common implementation mistakes
- Calling a valid issuer signature proof that the presenting person is the licence holder.
- Assuming Part 5 mandates a secure element, a particular algorithm or a universal offline mode.
- Collecting every available attribute instead of requesting only the fields needed for the transaction.
- Testing only successful retrieval and omitting malformed data, replay, consent denial, stale status and outage recovery.
- Declaring conformity after functional tests while leaving key lifecycle, privacy, accessibility and operational controls unassessed.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
