ARF section 4.4.1 defines that proximity flow is when the User Device is physically near the Relying Part Instance. This implies that the flow occurs in different devices therefore the mDL reader can interact with the EUDI Wallet only in cross device scenario for the proximity flow (supervised or unsupervised). The mDL Reader implements only ARF section "4.4.2 Proximity presentation flows".
Same device
N/A
The same device flow is not applicable for the mDL Reader on the proximity flows as justified above.
The EUDI Wallet can be activated either by the mDL Holder (user) or it can be triggered by the mDL Reader using NFC according to ISO/IEC 18013-5 section 6.3.2.2. The standard does not specify if this is mandatory for the mDL Reader. Therefore, it is considered optional.
The server data retrieval method allows the issuing authority to have knowledge when the mDL holder presents the mDL to a specific mDL verifier. This is prohibited explicitly by articles 5a.16 and 5a.5(b) of [eIDAS] and [ARF] Annex 2 High level requirement "ProxId_02". Therefore, this method is excluded (not supported) from the mDL target solution.
According to section 6.3.2.4 of in ISO/IEC 18013-5 "When using device retrieval, the mDL and mDL reader communicate using mdoc request and mdoc response messages encoded with CBOR".
According to section 6.3.2.5 of ISO/IEC 18013-5 "For device retrieval using BLE, the mDL reader shall support the mdoc central client mode and mdoc peripheral server mode".
mdoc peripheral server mode
Mandatory
As above
BLE L2CAP
Optional
According to section 6.3.2.5 of ISO/IEC 18013-5 that states "…The mDL and mDL reader may support the BLE 2CAP transmission profile..."
Security Mechanism and Trust Relationships for Device Retrieval¶
Specification
Optionality
Description and Reference
Session Encryption
Mandatory (assumed)
Section 9.1.1 in ISO/IEC 18013-5 specifies that the session encryption applies to the device retrieval method. It does not specify explicitly it as mandatory. It is assumed that it is mandatory. Table 2 in ISO/IEC 18013-7 applies to remote presentation to an mDL reader over the internet and therefore is not applicable to the proximity flow.
Issuer data authentication
Mandatory
As above for section 9.1.2 in ISO/IEC 18013-5. Section 9.3.1 applies also specifying as a mandatory capability.
The verifier shall verify that the mDL Issuer did not revoke the mDL (Revocation of mDL)
Mandatory
ARF section 6.6.3.1, point 6 (and 6.3.6.7) The specification for mDL revocation via a status list or reference list is expected to be introduced in a future version of ISO/IEC 18013-5. Consequently, mDL Verifiers shall be capable to verify the validity status of the mDL by retrieving the status list or identifier list. ARF section 6.6.3.7 specifies that "Attestation Provider includes revocation information in the PID or attestation, if it is valid for longer than 24 hours."
The interface between the mDL and the mDL Reader shall support the selective release of mDL data to an mDL Reader as per ISO/IEC 18013-5 section 6.2 point (d) Additionally, ARF in High Level Requirements OIA_07 specify the support of selective disclosure of attributes from PIDs and attestations.
Section 9.3.3 in ISO/IEC 18013-5 specifies that "mdoc reader shall have access to certificate revocation information". An mDL reader needs access to the issuing authority's certificate authority (IACA) root certificate to verify issuer data authentication. It checks the status of the Document Signing certificate and the IACA certificate against the published CRLs. It confirms that the issuer's IACA certificate is present, and that it is listed as an issuer of the doctype "org.iso.18013.5.1.mDL".
ETSI LOTL support
Mandatory
The Reference Implementation supports ETSI trusted lists because of other use cases, see e.g. ARF Annex 2 requirement PuBPNot_03: "The format of the PuB-EAA Provider Trusted List SHALL comply with ETSI TS 119 612 v2.1.1 or with a suitable profile similarly derived from ETSI TS 102 231".
IACA retrieval via VICAL
Mandatory
[4th Driving Licence Directive] in Art. 5.7 mandates that the Commission shall adopt implementing acts [among others] for recognition of those driving licences by third country authorities. Annex C in ISO/IEC 18013-5 specifies the VICAL mechanism. It does not explicitly specify this mechanism as mandatory and therefore it is considered optional. This mechanism applies to the third countries.