Understanding the Shift in Digital Identity Verification
Digital identity verification is now divided between two key standards: ISO/IEC 18013-5 for mobile documents (mdocs) and the W3C Verifiable Credentials Data Model (VCDM). This isn't just a technical detail. Your choice affects how your systems handle data, how credentials are transferred, and whether you can verify identities across different regions and sectors.
The NIST National Cybersecurity Center of Excellence (NCCoE) recently showed that a single verifier could accept mobile driver's licenses in both mdoc and W3C VC formats. This proof-of-concept confirms that to achieve broad interoperability, you'll need to support both standards.
Key Findings
1. ISO mdocs vs. W3C VCs: Schema and Flexibility
ISO/IEC 18013-5 specifies the data elements and encoding for credentials, using CBOR for efficient data compression. This means you know the structure of a mobile driver's license before it arrives. In contrast, W3C Verifiable Credentials use JSON-LD, allowing issuers to define their own schemas. While this offers flexibility, it also requires your system to interpret various schemas.
2. In-Person vs. Online Use
ISO/IEC 18013-5 was initially designed for in-person credential presentation via NFC or Bluetooth. The newer ISO/IEC 18013-7 extends this to online scenarios, such as web-based onboarding and cross-border transactions. Many U.S. states use mdoc-based licenses at TSA checkpoints, and the format is being tested for online verification in financial institutions.
W3C Verifiable Credentials are inherently suited for web interactions, designed for environments where credentials move through browsers and apps. They're often used for remote verification, such as proving qualifications to employers or sharing membership status.
3. Open vs. Restricted Standardization
ISO/IEC standards are developed through national bodies and require purchase, while the W3C process is open and free. This openness affects participation in standards development and the speed of implementation iterations. For European markets, the EU Architecture Reference Framework and EUDI Wallet programs are pushing for interoperability with both formats.
4. Infrastructure Challenges
Your system must handle both mdoc and W3C VC formats, which involves parsing different data formats, validating cryptographic proofs, checking revocation status, and managing trust registries. While the NCCoE has shown it's possible, it requires significant effort.
5. Evolving Privacy Controls
Both standards support selective disclosure, but implementations differ. ISO mdocs use standardized mechanisms, while W3C VCs need additional specifications for similar results. Compliance with Data Minimisation requirements, such as those under the General Data Protection Regulation, demands careful verification of your chosen format's privacy controls.
What This Means for Your Team
As a Data Privacy Officer, choosing a digital credential system means selecting a trust model and governance structure. ISO mdocs offer predictability with standardized schemas and are suitable for regulated identity verification. W3C Verifiable Credentials provide flexibility for custom credentials and are ideal for decentralized systems.
However, you likely can't choose just one. Financial institutions need to verify mdocs, while enterprises may prefer W3C VCs for employee credentials. Your infrastructure must support both to avoid limiting credential acceptance.
Action Items by Priority
Priority 1: Map Your Use Cases
List scenarios where your organization issues or verifies credentials. Determine if they're in-person or remote, standardized or custom, and whether the issuer is governmental or private. ISO mdocs are best for high-assurance, standardized credentials; W3C VCs suit custom, web-based credentials.
Priority 2: Audit Your Infrastructure
Identify which formats your systems can currently handle. If only one, document requirements for supporting the other, including parsers, signature validation, revocation checking, and trust registry integration.
Priority 3: Review Data Minimisation Controls
Ensure your implementation requests only necessary attributes and limits data exposure. Test workflows to confirm selective disclosure works effectively.
Priority 4: Monitor Cross-Border Programs
Track interoperability requirements from the EU Architecture Reference Framework, EUDI Wallet, and similar programs. Supporting both formats is increasingly necessary.
Priority 5: Engage with Standards Development
Participate in the W3C process directly. Engage with ISO/IEC through national bodies. Provide feedback if current specifications don't meet your needs.
