11.2. Digital Credential Presentation

This section describes how a Relying Party Instance requests a Wallet Instance to present the PID and the Electronic Attestations of Attributes.

The remote flow uses [OpenID4VP], profiled by [OPENID4VC-HAIP]. The proximity flow uses [ISO18013-5]. [CIR2024/2982] requires both flows. The applicable Trust Framework is selected as specified in Selection at Presentation. PID presentation before EUDIW notification is specified in PID issuance before EUDIW notification. When an Embedded Disclosure Policy is stored with a Digital Credential, the Wallet Unit applies it before disclosure, as specified in Embedded Disclosure Policy (EDP).

In this section the following flows are described:

• Remote Flow, where the User presents a Digital Credential to a web Relying Party Instance. The user-agent and the Wallet Instance can be on the same device (Same Device Flow) or on different devices (Cross Device Flow).

• Proximity Flow, where the User presents a Digital Credential to a mobile Relying Party Instance. The User interacts with a Verifier using proximity technologies such as QR Codes and Bluetooth Low Energy (BLE).

Identity matching, after cryptographic verification of a presented Digital Credential, is specified in Identity Matching and Identity Reconciliation. Identity matching is not a presentation flow. Offline presentation and the storage of the bound private keys are specified in Keystore Requirements.

Credential Presentation Table of Contents

• 11.2.1. Remote Flow
  • 11.2.1.1. Authorization Request
  • 11.2.1.2. Endpoint Mix-Up Protection
  • 11.2.1.3. Request URI Request
  • 11.2.1.4. Request URI Response
    • 11.2.1.4.1. Request URI Endpoint Errors
  • 11.2.1.5. Request Object
  • 11.2.1.6. Authorization Response
    • 11.2.1.6.1. Authorization Response Errors
  • 11.2.1.7. Relying Party Response
    • 11.2.1.7.1. Relying Party Response Errors
  • 11.2.1.8. Status Endpoint
    • 11.2.1.8.1. Status Endpoint Errors
  • 11.2.1.9. Redirect URI
    • 11.2.1.9.1. Redirect URI Errors
• 11.2.2. Proximity Flow
  • 11.2.2.1. DeviceEngagement over QR Code
    • 11.2.2.1.1. Non-Normative Example with BLE as Data Retrieval
    • 11.2.2.1.2. Non-Normative Example with NFC as Data Retrieval
  • 11.2.2.2. DeviceEngagement over NFC
    • 11.2.2.2.1. Non-Normative Example
  • 11.2.2.3. SessionEstablishment over BLE
  • 11.2.2.4. SessionData over BLE
  • 11.2.2.5. SessionEstablishment over NFC
    • 11.2.2.5.1. Definitions (Acronyms and Commands)
  • 11.2.2.6. SessionData over NFC
  • 11.2.2.7. Device Engagement
    • 11.2.2.7.1. mdoc Request
    • 11.2.2.7.2. mdoc Response
    • 11.2.2.7.3. Session Termination
• 11.2.3. Identity Matching and Identity Reconciliation
  • 11.2.3.1. Identity Matching
  • 11.2.3.2. Identity Reconciliation
  • 11.2.3.3. Matching Patterns by Digital Credential Type
    • 11.2.3.3.1. Unique National Identifier Binding
    • 11.2.3.3.2. Attribute-Based Binding
  • 11.2.3.4. Supplementary Binding Methods
  • 11.2.3.5. Privacy and Selective Disclosure
  • 11.2.3.6. Application to User Attribute Deletion