PID/(Q)EAA Data Model¶

The Person Identification Data (PID) is issued by the PID Provider according to national laws. The main scope of the PID is allowing natural persons to be authenticated for the access to a service or to a protected resource. The User attributes provided within the Italian PID are the ones listed below:

Current Family Name

Current First Name

Date of Birth

Taxpayer identification number

The (Q)EAAs are issued by (Q)EAA Issuers to a Wallet Instance and MUST be provided in SD-JWT-VC or MDOC-CBOR data format.

The PID/(Q)EAA data format and the mechanism through which a digital credential is issued to the Wallet Instance and presented to a Relying Party are described in the following sections.

SD-JWT-VC Credential Format¶

The PID/(Q)EAA is issued in the form of a Digital Credential. The Digital Credential format is SD-JWT as specified in SD-JWT-VC.

SD-JWT MUST be signed using the Issuer's private key. SD-JWT MUST be provided along with a Type Metadata related to the issued Digital Credential according to Sections 6 and 6.3 of [SD-JWT-VC]. The payload MUST contain the _sd_alg claim described in the Section 4.1.1 SD-JWT and other claims specified in this section.

The claim _sd_alg indicates the hash algorithm used by the Issuer to generate the digests as described in Section 4.1.1 of SD-JWT. _sd_alg MUST be set to one of the specified algorithms in Section Cryptographic Algorithms.

Claims that are not selectively disclosable MUST be included in the SD-JWT as they are. The digests of the disclosures, along with any decoy if present, MUST be contained in the _sd array, as specified in Section 4.2.4.1 of SD-JWT.

Each digest value, calculated using a hash function over the disclosures, verifies the integrity and corresponds to a specific Disclosure. Each disclosure includes:

a random salt,

the claim name (only when the claim is an object element),

the claim value.

In case of nested object in a SD-JWT payload each claim, on each level of the JSON, should be individually selectively disclosable or not. Therefore _sd claim containing digests MAY appear multiple times at different level in the SD-JWT.

For each claim that is an array element the digests of the respective disclosures and decoy digests are added to the array in the same position of the original claim values as specified in Section 4.2.4.2 of SD-JWT.

In case of array elements, digest values are calculated using a hash function over the disclosures, containing:

a random salt,

the array element

In case of multiple array elements, the Issuer may hide the value of the entire array or any of the entry contained within the array, the Holder can disclose both the entire array and any single entry within the array, as defined in Section 4.2.6 of SD-JWT.

The Disclosures are provided to the Holder together with the SD-JWT in the Combined Format for Issuance that is an ordered series of base64url-encoded values, each separated from the next by a single tilde ('~') character as follows:

<Issuer-Signed-JWT>~<Disclosure 1>~<Disclosure 2>~...~<Disclosure N>

See SD-JWT-VC and SD-JWT for additional details.

PID/(Q)EAA SD-JWT parameters¶

The JOSE header contains the following mandatory parameters:

Claim	Description	Reference
typ	REQUIRED. It MUST be set to `dc+sd-jwt` as defined in SD-JWT-VC.	RFC 7515 Section 4.1.9.
alg	REQUIRED. Signature Algorithm.	RFC 7515 Section 4.1.1.
kid	REQUIRED. Unique identifier of the public key.	RFC 7515 Section 4.1.8.
trust_chain	OPTIONAL. JSON array containing the trust chain that proves the reliability of the issuer of the JWT.	[OID-FED] Section 4.3.
x5c	OPTIONAL. Contains the X.509 public key certificate or certificate chain [RFC 5280] corresponding to the key used to digitally sign the JWT.	RFC 7515 Section 4.1.8 and [SD-JWT-VC] Section 3.5.
vctm	OPTIONAL. JSON array of base64url-encoded Type Metadata JSON documents. In case of extended type metadata, this claim contains the entire chain of JSON documents.	[SD-JWT-VC] Section 6.3.5.

The following claims MUST be in the JWT payload. Some of these claims can be disclosed, these are listed in the following tables that specify whether a claim is selectively disclosable [SD] or not [NSD].

Claim	Description	Reference
iss	[NSD].URL string representing the PID/(Q)EAA Issuer unique identifier.	[RFC7519, Section 4.1.1].
sub	[NSD]. The identifier of the subject of the Digital Credential, the User, MUST be opaque and MUST NOT correspond to any anagraphic data or be derived from the User's anagraphic data via pseudonymization. Additionally, it is required that two different Credentials issued MUST NOT use the same `sub` value.	[RFC7519, Section 4.1.2].
iat	[SD].UNIX Timestamp with the time of JWT issuance, coded as NumericDate as indicated in RFC 7519.	[RFC7519, Section 4.1.6].
exp	[NSD].UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated in RFC 7519.	[RFC7519, Section 4.1.4].
status	[NSD]. It MUST be a valid JSON object containing the information on how to read the status of the Verifiable Credential. It MUST contain the JSON member status_assertion set to a JSON Object containing the credential_hash_alg claim indicating the Algorithm used for hashing the Digital Credential to which the Status Assertion is bound. It is RECOMMENDED to use sha-256.	Section 3.2.2.2 SD-JWT-VC and Section 11 OAUTH-STATUS-ASSERTION.
cnf	[NSD].JSON object containing the proof-of-possession key materials. By including a cnf (confirmation) claim in a JWT, the issuer of the JWT declares that the Holder is in control of the private key related to the public one defined in the cnf parameter. The recipient MUST cryptographically verify that the Holder is in control of that key.	[RFC7800, Section 3.1] and Section 3.2.2.2 SD-JWT-VC.
vct	[NSD]. Credential type value MUST be an HTTPS URL String and it MUST be set using one of the values obtained from the PID/(Q)EAA Issuer metadata. It is the identifier of the SD-JWT VC type and it MUST be set with a collision-resistant value as defined in Section 2 of RFC 7515. It MUST contain also the number of version of the Credential type (for instance: `https://issuer.example.org/v1.0/personidentificationdata`).	Section 3.2.2.2 SD-JWT-VC.
vct#integrity	[NSD].The value MUST be an "integrity metadata" string as defined in Section 3 of [W3C-SRI]. SHA-256, SHA-384 and SHA-512 MUST be supported as cryptographic hash functions. MD5 and SHA-1 MUST NOT be used. This claim MUST be verified according to Section 3.3.5 of [W3C-SRI].	Section 6.1 SD-JWT-VC, [W3C-SRI]
verification	[SD]. Object containing User authentication and User data verification information. When the Credential type is set to PersonIdentificationData, the verification claim MUST be included by the Issuer. Whn present, the verification claim MUST include the following sub-value: `assurance_level`: String identifying the level of identity assurance guaranteed during the User authentication process. `evidence`: Each entry of the array MUST contain the following members: `type`: It represents evidence type. It MUST be set to `vouch`. `time`: UNIX Timestamps with the time of the authentication or verification. `attestation`: It MUST contain the following members: `type`: It MUST be set to `digital_attestation`. `reference_number`: identifier of the authentication or verification response. `date_of_issuance`: date of issuance of the attestation. `voucher`: It MUST contains `organization` claim.	OIDC-IDA.

Note

Credential Type Metadata JSON Document MAY be retrieved directly from the URL contained in the claim vct, using the HTTP GET method or using the vctm header parameter if provided. Unlike specified in Section 6.3.1 of SD-JWT-VC the .well-known endpoint is not included in the current implementation profile. Implementers may decide to use it for interoperability with other systems.

Digital Credential Metadata Type¶

The Metadata type document MUST be a JSON object and contains the following parameters.

Claim	Description	Reference
name	REQUIRED. Human-readable name of the Digital Credential type. In case of multiple language, the language tags are added to member name, delimited by a # character as defined in RFC 5646 (e.g. name#it-IT).	[SD-JWT-VC] Section 6.2 and [OIDC] Section 5.2.
description	REQUIRED. A human-readable description of the Digital Credential type. In case of multiple language, the language tags are added to member name, delimited by a # character as defined in RFC 5646.	[SD-JWT-VC] Section 6.2 and [OIDC] Section 5.2.
extends	OPTIONAL. String Identitifier of an exteded metadata type document.	[SD-JWT-VC] Section 6.2.
extends#integrity	CONDITIONAL. REQUIRED if extends is present.	[SD-JWT-VC] Section 6.2.
schema	CONDITIONAL. REQUIRED if schema_uri is not present.	[SD-JWT-VC] Section 6.2.
schema_uri	CONDITIONAL. REQUIRED if schema is not present.	[SD-JWT-VC] Section 6.2.
schema_uri#integrity	CONDITIONAL. REQUIRED if schema_uri is present.	[SD-JWT-VC] Section 6.2.
data_source	REQUIRED. Object containing information about the data origin. It MUST contain the object `verification` with this following sub-value: `trust_framework`: MUST contain trust framework used for digital authentication towards Authentic Source system. `authentic_source`: MUST contain the following claims related to information about the Authentic Source: `organization_name` name of the Authentic Source. `organization_code` code identifier of the Authentic Source. `homepage_uri` uri pointing to the Authentic Source's homepage. `contacts` contact list for info and assistance. `logo_uri` URI pointing to the logo image.	This specification
display	REQUIRED. Array of objects, one for each language supported, containing display information for the Digital Credential type. It contains for each object the following properties: `lang`: language tag as defined in RFC 5646 Section 2. [REQUIRED]. `name`: human-readable label for the Digital Credential type. [REQUIRED]. `description`: human-readable description for the Digital Credential type. [REQUIRED]. `rendering`: object containing rendering methods supported by the Digital Credential type. [REQUIRED]. The rendering method svg_template MUST be supported. The `svg_templates` array of objects contains for each SVG template supported the following properties: `uri`: URI pointing to the SVG template. [REQUIRED]. `uri#integrity`: integrity metadata as defined in Section 3 of W3C-SRI. [REQUIRED]. `properties`: object containing SVG template properties. This property is REQUIRED if more than one SVG template is present. The object MUST contain at least one of the properties defined in SD-JWT-VC Section 8.1.2.1. If rendering method simple is also supported, the `simple` object contains the following properties: `logo`: object containing information about the logo to display. This property is REQUIRED. The object contains the following sub-values: `uri`: URI pointing to the logo image. [REQUIRED] `uri#integrity`: integrity metadata as defined in Section 3 of W3C-SRI. [REQUIRED]. `alt_text`: A string containing alternative text to display instead of the logo image. [OPTIONAL]. `background_color`: RGB color value as defined in W3C.CSS-COLOR for the background of the Digital Credential. [OPTIONAL]. `text_color`: RGB color value as defined in W3C.CSS-COLOR for the text of the Digital Credential. [OPTIONAL]. Note The use of the SVG template is recommended for all applications that support it.	[SD-JWT-VC] Section 8.
claims	REQUIRED. Array of objects containing information for displaying and validating Digital Credential claims. It contains for each Credential claim the following properties: `path`: array indicating the claim or claims that are being addressed. [REQUIRED]. `display`: array containing display information about the claim indicated in the `path`. The array contains an object for each language supported by the Digital Credential type. This property is REQUIRED. It contains the following members: `lang`: language tag as defined in RFC 5646 Section 2. [REQUIRED]. `label`: human-readable label for the claim. [REQUIRED]. `description`: human-readable description for the claim. [REQUIRED]. `sd`: string indicating whether the claim is selectively disclosable. It MUST be set to always if the claim is selectively disclosure or never if not. [REQUIRED]. `svg_id`: alphanumeric string containing ID of the claim referenced in the SVG template as defined in [SD-JWT-VC] Section 9. [REQUIRED].	[SD-JWT-VC] Section 9.

A non-normative Digital Credential metadata type is provided below.

{	
    "name": "Person Identification Data",
    "description": "Digital version of Person Identification Data",
    "template_uri": "https://pidprovider.example.org/v1.0/templatepid",	
    "schema_uri": "https://pidprovider.example.org/schema/v1.0/mdl",
    "schema_uri#integrity": "c8b708728e4c5756e35c03aeac257ca878d1f717d7b61f621be4d36dbd9b9c16",
    "data_source": {
        "verification": {
        "trust_framework": "pdnd",
        "authentic_source": {
            "organization_name": "Ministero degli Interni",
            "organization_code": "m_it",
            "contacts": [
                "informazioni@example.it",
                "protocollo@pec.example.it"
            ],
            "homepage_uri": "https://authsource.example.com/",
            "logo_uri": "https://authsource.example.com/img/logo.svg"
            }
        }	
    },		
    "display": [      
        {
          "lang": "it-IT",
          "name": "Dati di Identificazione Personale",
          "description": "Versione Digitale dei Dati di Identificazione Personale",
          "rendering": {
            "simple": {
              "logo": {
                "uri": "https://authsource.example.com/img/logo.png",
                "uri#integrity": "sha256-LmXfh-9cLlJNXN-TsMk-PmKjZ5t0WRL5ca_xGgX3c1V",
                "alt_text": "Logo del Ministero dell'interno"
              },
              "background_color": "#2e89d9",
              "text_color": "#030303"
            },
            "svg_templates": [
              {
                "uri": "https://authsource.example.com/svgtemplates/pid-credential-italian.svg",
                "uri#integrity": "sha256-8cLlJNXN-TsMk-PmKjZ5t0WRL5ca_xGgX3c1VLmXfh-9c",
                "properties": {
                  "orientation": "landscape",
                  "color_scheme": "light",
                  "contrast": "high"
                }
              }
            ]
          }
        },
        {
          "lang": "en-US",
          "name": "Person Identification Data",
          "description": "Digital version of Person Identification Data",
          "rendering": {
            "simple": {
              "logo": {
                "uri": "https://authsource.example.com/img/logo.png",
                "uri#integrity": "sha256-LmXfh-9cLlJNXN-TsMk-PmKjZ5t0WRL5ca_xGgX3c1V",
                "alt_text": "Ministry of the Interior logo"
              },
              "background_color": "#2e89d9",
              "text_color": "#030303"
            },
            "svg_templates": [
              {
                "uri": "https://authsource.example.com/svgtemplates/pid-credential-english.svg",
                "uri#integrity": "sha256-8cLlJNXN-TsMk-PmKjZ5t0WRL5ca_xGgX3c1VLmXfh-9c",
                "properties": {
                  "orientation": "landscape",
                  "color_scheme": "light",
                  "contrast": "high"
                }
              }
            ]
          }
        }
      ],
    "claims": [
        {
          "path": ["given_name"],
          "display": [
            {
              "lang": "it-IT",
              "label": "Nome",
              "description": "Nome/i attuale/i dell'utente a cui si riferiscono i dati di identificazione personale."
            },
            {
              "lang": "en-US",
              "label": "Name",
              "description": "Current first name(s), including middle name(s) of the user to whom the person identification data relates."
            }
          ],
          "sd": "always",
          "svg_id": "given_name"
        },
        {
          "path": ["family_name"],
          "display": [
            {
              "lang": "it-IT",
              "label": "Cognome",
              "description": "Cognome/i attuale/i dell'utente a cui si riferiscono i dati di identificazione personale."
            },
            {
              "lang": "en-US",
              "label": "Surname",
              "description": "Current last name(s) or surname(s) of the user to whom the person identification data relates."
            }
          ],
          "sd": "always",
          "svg_id": "family_name"
        },
        {
          "path": ["birth_date"],
          "display": [
           {
              "lang": "it-IT",
              "label": "Data di nascita",
              "description": "Giorno, mese e anno di nascita dell'utente a cui si riferiscono i dati identificativi."
            },
            {
              "lang": "en-US",
              "label": "Date of birth",
              "description": "Day, month, and year on which the user to whom the person identification data relates was born."
            }
          ],
          "sd": "always",
          "svg_id": "birth_date"
        },       
        {
            "path": ["personal_administrative_number"],
            "display": [
              {
                "lang": "it-IT",
                "label": "Codice fiscale",
                "description": "Codice di identificazione fiscale nazionale della persona fisica."
              },
              {
                "lang": "en-US",
                "label": "Tax identification number",
                "description": "National tax identification code of natural person." 
              }
            ],
            "sd": "always",
            "svg_id": "personal_administrative_number"
          }
      ]
}

PID Claims¶

Depending on the Digital Credential type vct, additional claims data MAY be added. The PID MUST support the following data:

Claim	Description	Reference
given_name	[SD]. Current First Name.	[OpenID Connect Core 1.0, Section 5.1]
family_name	[SD]. Current Family Name.	[OpenID Connect Core 1.0, Section 5.1]
birth_date	[SD]. Date of Birth.
personal_administrative_number	[SD]. National tax identification code of natural person as a String format. It MUST be set according to ETSI EN 319 412-1. For example `TINIT-<ItalianTaxIdentificationNumber>`

The PID attribute schema, which encompasses all potential User data, is defined in ARF v1.4, and furthermore detailed in the PID Rulebook.

PID Non-Normative Examples¶

In the following, the non-normative example of the payload of a PID represented in JSON format.

{
  "iss": "https://pidprovider.example.org",
  "sub": "NzbLsXh8uDCcd7noWXFZAfHkxZsRGC9Xs",
  "iat": 1683000000,
  "exp": 1883000000,
  "status": {
    "status_assertion": {
      "credential_hash_alg": "sha-256"
    }
  },
  "vct": "https://pidprovider.example.org/v1.0/personidentificationdata",
  "vct#integrity": "c5f73e250fe869f24d15118acce286c9bb56b63a443dc85af653cd73f6078b1f",
  "verification": {
    "assurance_level": "high",
    "evidence": [
    {
      "type": "vouch",
      "time": "2020-03-19T12:42Z",
      "attestation": {
        "type": "digital_attestation",
        "reference_number": "6485-1619-3976-6671",
        "date_of_issuance": "2020-03-19T12:43Z",
        "voucher": {
          "organization": "Ministero dell'interno"
        }
      }
    }
    ]
  },
  "given_name": "Mario",
  "family_name": "Rossi",
  "birth_date": "1980-01-10",
  "personal_administrative_number": "TINIT-XXXXXXXXXXXXXXXX"
}

The corresponding SD-JWT version for PID is given by

{
  "typ":"dc+sd-jwt",
  "alg":"ES256",
  "kid":"dB67gL7ck3TFiIAf7N6_7SHvqk0MDYMEQcoGGlkUAAw",
  "trust_chain" : [
   "NEhRdERpYnlHY3M5WldWTWZ2aUhm ...",
   "eyJhbGciOiJSUzI1NiIsImtpZCI6 ...",
   "IkJYdmZybG5oQU11SFIwN2FqVW1B ..."
  ]
}

{
  "_sd": [
    "4KfNcVziiuiktw8UMBaZQBRlLorpAhFz2ii37niYF2Q",
    "VQI-S1mT1Kxfq2o8J9io7xMMX2MIxaG9M9PeJVqrMcA",
    "Yrc-s-WSr4exEYtqDEsmRl7spoVfmBxixP12e4syqNE",
    "egljN30TYCjSEtzVszDFWbryYskAOEmM3TKT2X2fdpA",
    "s1XK5f2pM3-aFTauXhmvd9pyQTJ6FMUhc-JXfHrxhLk",
    "zVdghcmClMVWlUgGsGpSkCPkEHZ4u9oWj1SlIBlCc1o"
  ],
  "iss": "https://pidprovider.example.org",
  "exp": 1883000000,
  "sub": "NzbLsXh8uDCcd7noWXFZAfHkxZsRGC9Xs",
  "status": {
    "status_assertion": {
      "credential_hash_alg": "sha-256"
    }
  },
  "vct": "https://pidprovider.example.org/v1.0/personidentificationdata",
  "vct#integrity": "c5f73e250fe869f24d15118acce286c9bb56b63a443dc85af653cd73f6078b1f",
  "_sd_alg": "sha-256",
  "cnf": {
    "jwk": {
      "kty": "EC",
      "crv": "P-256",
      "x": "TCAER19Zvu3OHF4j4W4vfSVoHIP1ILilDls7vCeGemc",
      "y": "ZxjiWWbZMQGHVWKVQ4hbSIirsVfuecCE6t4jT9F2HZQ"
    }
  }
}

In the following the disclosure list is given

Claim iat:

SHA-256 Hash: Yrc-s-WSr4exEYtqDEsmRl7spoVfmBxixP12e4syqNE
Disclosure: WyIyR0xDNDJzS1F2ZUNmR2ZyeU5STjl3IiwgImlhdCIsIDE2ODMwMDAwMDBd
Contents: ["2GLC42sKQveCfGfryNRN9w", "iat", 1683000000]

Claim verification:

SHA-256 Hash: egljN30TYCjSEtzVszDFWbryYskAOEmM3TKT2X2fdpA
Disclosure: WyJlbHVWNU9nM2dTTklJOEVZbnN4QV9BIiwgInZlcmlmaWNhdGlvbiIsIHsi YXNzdXJhbmNlX2xldmVsIjogImhpZ2giLCAiZXZpZGVuY2UiOiB7InR5cGUi OiAidm91Y2giLCAidGltZSI6ICIyMDIwLTAzLTE5VDEyOjQyWiIsICJhdHRl c3RhdGlvbiI6IHsidHlwZSI6ICJkaWdpdGFsX2F0dGVzdGF0aW9uIiwgInJl ZmVyZW5jZV9udW1iZXIiOiAiNjQ4NS0xNjE5LTM5NzYtNjY3MSIsICJkYXRl X29mX2lzc3VhbmNlIjogIjIwMjAtMDMtMTlUMTI6NDNaIiwgInZvdWNoZXIi OiB7Im9yZ2FuaXphdGlvbiI6ICJNaW5pc3Rlcm8gZGVsbCdpbnRlcm5vIn19 fX1d
Contents: ["eluV5Og3gSNII8EYnsxA_A", "verification", {"assurance_level": "high", "evidence": {"type": "vouch", "time": "2020-03-19T12:42Z", "attestation": {"type": "digital_attestation", "reference_number": "6485-1619-3976-6671", "date_of_issuance": "2020-03-19T12:43Z", "voucher": {"organization": "Ministero dell'interno"}}}}]

Claim given_name:

SHA-256 Hash: zVdghcmClMVWlUgGsGpSkCPkEHZ4u9oWj1SlIBlCc1o
Disclosure: WyI2SWo3dE0tYTVpVlBHYm9TNXRtdlZBIiwgImdpdmVuX25hbWUiLCAiTWFy aW8iXQ
Contents: ["6Ij7tM-a5iVPGboS5tmvVA", "given_name", "Mario"]

Claim family_name:

SHA-256 Hash: VQI-S1mT1Kxfq2o8J9io7xMMX2MIxaG9M9PeJVqrMcA
Disclosure: WyJlSThaV205UW5LUHBOUGVOZW5IZGhRIiwgImZhbWlseV9uYW1lIiwgIlJv c3NpIl0
Contents: ["eI8ZWm9QnKPpNPeNenHdhQ", "family_name", "Rossi"]

Claim birth_date:

SHA-256 Hash: s1XK5f2pM3-aFTauXhmvd9pyQTJ6FMUhc-JXfHrxhLk
Disclosure: WyJRZ19PNjR6cUF4ZTQxMmExMDhpcm9BIiwgImJpcnRoX2RhdGUiLCAiMTk4 MC0wMS0xMCJd
Contents: ["Qg_O64zqAxe412a108iroA", "birth_date", "1980-01-10"]

Claim personal_administrative_number:

SHA-256 Hash: 4KfNcVziiuiktw8UMBaZQBRlLorpAhFz2ii37niYF2Q
Disclosure: WyJBSngtMDk1VlBycFR0TjRRTU9xUk9BIiwgInBlcnNvbmFsX2FkbWluaXN0 cmF0aXZlX251bWJlciIsICJUSU5JVC1YWFhYWFhYWFhYWFhYWFhYIl0
Contents: ["AJx-095VPrpTtN4QMOqROA", "personal_administrative_number", "TINIT-XXXXXXXXXXXXXXXX"]

The combined format for the PID issuance is given by

eyJhbGciOiAiRVMyNTYiLCAidHlwIjogImRjK3NkLWp3dCIsICJraWQiOiAiZEI2N2dM
N2NrM1RGaUlBZjdONl83U0h2cWswTURZTUVRY29HR2xrVUFBdyJ9.eyJfc2QiOiBbIjR
LZk5jVnppaXVpa3R3OFVNQmFaUUJSbExvcnBBaEZ6MmlpMzduaVlGMlEiLCAiVlFJLVM
xbVQxS3hmcTJvOEo5aW83eE1NWDJNSXhhRzlNOVBlSlZxck1jQSIsICJZcmMtcy1XU3I
0ZXhFWXRxREVzbVJsN3Nwb1ZmbUJ4aXhQMTJlNHN5cU5FIiwgImVnbGpOMzBUWUNqU0V
0elZzekRGV2JyeVlza0FPRW1NM1RLVDJYMmZkcEEiLCAiczFYSzVmMnBNMy1hRlRhdVh
obXZkOXB5UVRKNkZNVWhjLUpYZkhyeGhMayIsICJ6VmRnaGNtQ2xNVldsVWdHc0dwU2t
DUGtFSFo0dTlvV2oxU2xJQmxDYzFvIl0sICJleHAiOiAxODgzMDAwMDAwLCAiaXNzIjo
gImh0dHBzOi8vcGlkcHJvdmlkZXIuZXhhbXBsZS5vcmciLCAic3ViIjogIk56YkxzWGg
4dURDY2Q3bm9XWEZaQWZIa3hac1JHQzlYcyIsICJzdGF0dXMiOiB7InN0YXR1c19hc3N
lcnRpb24iOiB7ImNyZWRlbnRpYWxfaGFzaF9hbGciOiAic2hhLTI1NiJ9fSwgInZjdCI
6ICJodHRwczovL3BpZHByb3ZpZGVyLmV4YW1wbGUub3JnL3YxLjAvcGVyc29uaWRlbnR
pZmljYXRpb25kYXRhIiwgInZjdCNpbnRlZ3JpdHkiOiAiYzVmNzNlMjUwZmU4NjlmMjR
kMTUxMThhY2NlMjg2YzliYjU2YjYzYTQ0M2RjODVhZjY1M2NkNzNmNjA3OGIxZiIsICJ
fc2RfYWxnIjogInNoYS0yNTYiLCAiY25mIjogeyJqd2siOiB7Imt0eSI6ICJFQyIsICJ
jcnYiOiAiUC0yNTYiLCAieCI6ICJUQ0FFUjE5WnZ1M09IRjRqNFc0dmZTVm9ISVAxSUx
pbERsczd2Q2VHZW1jIiwgInkiOiAiWnhqaVdXYlpNUUdIVldLVlE0aGJTSWlyc1ZmdWV
jQ0U2dDRqVDlGMkhaUSJ9fX0.yjU0jPW4O4BZ8QBbeX6Lf227PH8MieTICJj10KUtooy
wCuB5uPpJa5gvF2NeH54QvDgEC8Ddvc1tdWKykDv5AA~WyIyR0xDNDJzS1F2ZUNmR2Zy
eU5STjl3IiwgImlhdCIsIDE2ODMwMDAwMDBd~WyJlbHVWNU9nM2dTTklJOEVZbnN4QV9
BIiwgInZlcmlmaWNhdGlvbiIsIHsiYXNzdXJhbmNlX2xldmVsIjogImhpZ2giLCAiZXZ
pZGVuY2UiOiB7InR5cGUiOiAidm91Y2giLCAidGltZSI6ICIyMDIwLTAzLTE5VDEyOjQ
yWiIsICJhdHRlc3RhdGlvbiI6IHsidHlwZSI6ICJkaWdpdGFsX2F0dGVzdGF0aW9uIiw
gInJlZmVyZW5jZV9udW1iZXIiOiAiNjQ4NS0xNjE5LTM5NzYtNjY3MSIsICJkYXRlX29
mX2lzc3VhbmNlIjogIjIwMjAtMDMtMTlUMTI6NDNaIiwgInZvdWNoZXIiOiB7Im9yZ2F
uaXphdGlvbiI6ICJNaW5pc3Rlcm8gZGVsbCdpbnRlcm5vIn19fX1d~WyI2SWo3dE0tYT
VpVlBHYm9TNXRtdlZBIiwgImdpdmVuX25hbWUiLCAiTWFyaW8iXQ~WyJlSThaV205UW5
LUHBOUGVOZW5IZGhRIiwgImZhbWlseV9uYW1lIiwgIlJvc3NpIl0~WyJRZ19PNjR6cUF
4ZTQxMmExMDhpcm9BIiwgImJpcnRoX2RhdGUiLCAiMTk4MC0wMS0xMCJd~WyJBSngtMD
k1VlBycFR0TjRRTU9xUk9BIiwgInBlcnNvbmFsX2FkbWluaXN0cmF0aXZlX251bWJlci
IsICJUSU5JVC1YWFhYWFhYWFhYWFhYWFhYIl0~

(Q)EAA non-normative examples¶

In the following, we provide a non-normative example of (Q)EAA in JSON.

{
  "iss": "https://issuer.example.org",
  "sub": "NzbLsXh8uDCcd7noWXFZAfHkxZsRGC9Xs",
  "iat": 1683000000,
  "exp": 1883000000,
  "status": {
    "status_assertion": {
      "credential_hash_alg": "sha-256"
    }
  },
  "vct": "https://issuer.example.org/v1.0/disabilitycard",
  "vct#integrity": "2e40bcd6799008085ffb1a1f3517efee335298fd976b3e655bfb3f4eaa11d171",
  "document_number": "XXXXXXXXXX",
  "given_name": "Mario",
  "family_name": "Rossi",
  "birth_date": "1980-01-10",
  "expiry_date": "2024-01-01",
  "personal_administrative_number": "TINIT-XXXXXXXXXXXXXXXX",
  "constant_attendance_allowance": true
}

The corresponding SD-JWT for the previous data is represented as follow, as decoded JSON for both header and payload.

{
  "typ":"dc+sd-jwt",
  "alg":"ES256",
  "kid":"d126a6a856f7724560484fa9dc59d195",
  "trust_chain" : [
   "NEhRdERpYnlHY3M5WldWTWZ2aUhm ...",
   "eyJhbGciOiJSUzI1NiIsImtpZCI6 ...",
   "IkJYdmZybG5oQU11SFIwN2FqVW1B ..."
  ]
}

{
  "_sd": [
    "Dx-6hjvrcxNzF0slU6ukNmzHoL-YvBN-tFa0T8X-bY0",
    "GE3Sjy_zAT34f8wa5DUkVB0FslaSJRAAc8I3lN11Ffc",
    "VQI-S1mT1Kxfq2o8J9io7xMMX2MIxaG9M9PeJVqrMcA",
    "Yrc-s-WSr4exEYtqDEsmRl7spoVfmBxixP12e4syqNE",
    "aBVdfcnxT0Z5RrwdxZSUhuUxz3gM2vcEZLeYIj61Kas",
    "s1XK5f2pM3-aFTauXhmvd9pyQTJ6FMUhc-JXfHrxhLk",
    "wgZ0suEkIh0U7lrsviuS-TaGhQIiO-h3CfG4Dd71ll8",
    "zVdghcmClMVWlUgGsGpSkCPkEHZ4u9oWj1SlIBlCc1o"
  ],
  "iss": "https://issuer.example.org",
  "exp": 1883000000,
  "sub": "NzbLsXh8uDCcd7noWXFZAfHkxZsRGC9Xs",
  "status": {
    "status_assertion": {
      "credential_hash_alg": "sha-256"
    }
  },
  "vct": "https://issuer.example.org/v1.0/disabilitycard",
  "vct#integrity": "2e40bcd6799008085ffb1a1f3517efee335298fd976b3e655bfb3f4eaa11d171",
  "_sd_alg": "sha-256",
  "cnf": {
    "jwk": {
      "kty": "EC",
      "crv": "P-256",
      "x": "TCAER19Zvu3OHF4j4W4vfSVoHIP1ILilDls7vCeGemc",
      "y": "ZxjiWWbZMQGHVWKVQ4hbSIirsVfuecCE6t4jT9F2HZQ"
    }
  }
}

In the following the disclosure list is given:

Claim iat:

SHA-256 Hash: Yrc-s-WSr4exEYtqDEsmRl7spoVfmBxixP12e4syqNE
Disclosure: WyIyR0xDNDJzS1F2ZUNmR2ZyeU5STjl3IiwgImlhdCIsIDE2ODMwMDAwMDBd
Contents: ["2GLC42sKQveCfGfryNRN9w", "iat", 1683000000]

Claim document_number:

SHA-256 Hash: Dx-6hjvrcxNzF0slU6ukNmzHoL-YvBN-tFa0T8X-bY0
Disclosure: WyJlbHVWNU9nM2dTTklJOEVZbnN4QV9BIiwgImRvY3VtZW50X251bWJlciIs ICJYWFhYWFhYWFhYIl0
Contents: ["eluV5Og3gSNII8EYnsxA_A", "document_number", "XXXXXXXXXX"]

Claim given_name:

SHA-256 Hash: zVdghcmClMVWlUgGsGpSkCPkEHZ4u9oWj1SlIBlCc1o
Disclosure: WyI2SWo3dE0tYTVpVlBHYm9TNXRtdlZBIiwgImdpdmVuX25hbWUiLCAiTWFy aW8iXQ
Contents: ["6Ij7tM-a5iVPGboS5tmvVA", "given_name", "Mario"]

Claim family_name:

SHA-256 Hash: VQI-S1mT1Kxfq2o8J9io7xMMX2MIxaG9M9PeJVqrMcA
Disclosure: WyJlSThaV205UW5LUHBOUGVOZW5IZGhRIiwgImZhbWlseV9uYW1lIiwgIlJv c3NpIl0
Contents: ["eI8ZWm9QnKPpNPeNenHdhQ", "family_name", "Rossi"]

Claim birth_date:

SHA-256 Hash: s1XK5f2pM3-aFTauXhmvd9pyQTJ6FMUhc-JXfHrxhLk
Disclosure: WyJRZ19PNjR6cUF4ZTQxMmExMDhpcm9BIiwgImJpcnRoX2RhdGUiLCAiMTk4 MC0wMS0xMCJd
Contents: ["Qg_O64zqAxe412a108iroA", "birth_date", "1980-01-10"]

Claim expiry_date:

SHA-256 Hash: aBVdfcnxT0Z5RrwdxZSUhuUxz3gM2vcEZLeYIj61Kas
Disclosure: WyJBSngtMDk1VlBycFR0TjRRTU9xUk9BIiwgImV4cGlyeV9kYXRlIiwgIjIw MjQtMDEtMDEiXQ
Contents: ["AJx-095VPrpTtN4QMOqROA", "expiry_date", "2024-01-01"]

Claim personal_administrative_number:

SHA-256 Hash: wgZ0suEkIh0U7lrsviuS-TaGhQIiO-h3CfG4Dd71ll8
Disclosure: WyJQYzMzSk0yTGNoY1VfbEhnZ3ZfdWZRIiwgInBlcnNvbmFsX2FkbWluaXN0 cmF0aXZlX251bWJlciIsICJUSU5JVC1YWFhYWFhYWFhYWFhYWFhYIl0
Contents: ["Pc33JM2LchcU_lHggv_ufQ", "personal_administrative_number", "TINIT-XXXXXXXXXXXXXXXX"]

Claim constant_attendance_allowance:

SHA-256 Hash: GE3Sjy_zAT34f8wa5DUkVB0FslaSJRAAc8I3lN11Ffc
Disclosure: WyJHMDJOU3JRZmpGWFE3SW8wOXN5YWpBIiwgImNvbnN0YW50X2F0dGVuZGFu Y2VfYWxsb3dhbmNlIiwgdHJ1ZV0
Contents: ["G02NSrQfjFXQ7Io09syajA", "constant_attendance_allowance", true]

The combined format for the (Q)EAA issuance is represented below:

eyJhbGciOiAiRVMyNTYiLCAidHlwIjogImRjK3NkLWp3dCIsICJraWQiOiAiZDEyNmE2
YTg1NmY3NzI0NTYwNDg0ZmE5ZGM1OWQxOTUifQ.eyJfc2QiOiBbIkR4LTZoanZyY3hOe
kYwc2xVNnVrTm16SG9MLVl2Qk4tdEZhMFQ4WC1iWTAiLCAiR0UzU2p5X3pBVDM0Zjh3Y
TVEVWtWQjBGc2xhU0pSQUFjOEkzbE4xMUZmYyIsICJWUUktUzFtVDFLeGZxMm84Sjlpb
zd4TU1YMk1JeGFHOU05UGVKVnFyTWNBIiwgIllyYy1zLVdTcjRleEVZdHFERXNtUmw3c
3BvVmZtQnhpeFAxMmU0c3lxTkUiLCAiYUJWZGZjbnhUMFo1UnJ3ZHhaU1VodVV4ejNnT
TJ2Y0VaTGVZSWo2MUthcyIsICJzMVhLNWYycE0zLWFGVGF1WGhtdmQ5cHlRVEo2Rk1Va
GMtSlhmSHJ4aExrIiwgIndnWjBzdUVrSWgwVTdscnN2aXVTLVRhR2hRSWlPLWgzQ2ZHN
ERkNzFsbDgiLCAielZkZ2hjbUNsTVZXbFVnR3NHcFNrQ1BrRUhaNHU5b1dqMVNsSUJsQ
2MxbyJdLCAiZXhwIjogMTg4MzAwMDAwMCwgImlzcyI6ICJodHRwczovL2lzc3Vlci5le
GFtcGxlLm9yZyIsICJzdWIiOiAiTnpiTHNYaDh1RENjZDdub1dYRlpBZkhreFpzUkdDO
VhzIiwgInN0YXR1cyI6IHsic3RhdHVzX2Fzc2VydGlvbiI6IHsiY3JlZGVudGlhbF9oY
XNoX2FsZyI6ICJzaGEtMjU2In19LCAidmN0IjogImh0dHBzOi8vaXNzdWVyLmV4YW1wb
GUub3JnL3YxLjAvZGlzYWJpbGl0eWNhcmQiLCAidmN0I2ludGVncml0eSI6ICIyZTQwY
mNkNjc5OTAwODA4NWZmYjFhMWYzNTE3ZWZlZTMzNTI5OGZkOTc2YjNlNjU1YmZiM2Y0Z
WFhMTFkMTcxIiwgIl9zZF9hbGciOiAic2hhLTI1NiIsICJjbmYiOiB7Imp3ayI6IHsia
3R5IjogIkVDIiwgImNydiI6ICJQLTI1NiIsICJ4IjogIlRDQUVSMTladnUzT0hGNGo0V
zR2ZlNWb0hJUDFJTGlsRGxzN3ZDZUdlbWMiLCAieSI6ICJaeGppV1diWk1RR0hWV0tWU
TRoYlNJaXJzVmZ1ZWNDRTZ0NGpUOUYySFpRIn19fQ.iKHrYC-a3lVgxbmcOvJInYgVGr
NdxDbPW6yFuBu_dwM1p2bNLQX2azLvlrz9DWcG6Juacqb1od0weet4C1adpw~WyIyR0x
DNDJzS1F2ZUNmR2ZyeU5STjl3IiwgImlhdCIsIDE2ODMwMDAwMDBd~WyJlbHVWNU9nM2
dTTklJOEVZbnN4QV9BIiwgImRvY3VtZW50X251bWJlciIsICJYWFhYWFhYWFhYIl0~Wy
I2SWo3dE0tYTVpVlBHYm9TNXRtdlZBIiwgImdpdmVuX25hbWUiLCAiTWFyaW8iXQ~WyJ
lSThaV205UW5LUHBOUGVOZW5IZGhRIiwgImZhbWlseV9uYW1lIiwgIlJvc3NpIl0~WyJ
RZ19PNjR6cUF4ZTQxMmExMDhpcm9BIiwgImJpcnRoX2RhdGUiLCAiMTk4MC0wMS0xMCJ
d~WyJBSngtMDk1VlBycFR0TjRRTU9xUk9BIiwgImV4cGlyeV9kYXRlIiwgIjIwMjQtMD
EtMDEiXQ~WyJQYzMzSk0yTGNoY1VfbEhnZ3ZfdWZRIiwgInBlcnNvbmFsX2FkbWluaXN
0cmF0aXZlX251bWJlciIsICJUSU5JVC1YWFhYWFhYWFhYWFhYWFhYIl0~WyJHMDJOU3J
RZmpGWFE3SW8wOXN5YWpBIiwgImNvbnN0YW50X2F0dGVuZGFuY2VfYWxsb3dhbmNlIiw
gdHJ1ZV0~

MDOC-CBOR¶

The PID/(Q)EAA MDOC-CBOR data model is defined in ISO/IEC 18013-5, the standard born for the the mobile driving license (mDL) use case.

The MDOC data elements MUST be encoded as defined in RFC 8949 - Concise Binary Object Representation (CBOR).

The PID encoded in MDOC-CBOR format uses the document type set to eu.europa.ec.eudiw.pid.1, according to the reverse domain approach defined in the EIDAS-ARF and ISO/IEC 18013-5.

The document's data elements utilize a consistent namespace for the mandatory Mobile Driving License attributes, while the national PID attributes use the domestic namespace eu.europa.ec.eudiw.pid.it.1, as outlined in this implementation profile.

In compliance with ISO/IEC 18013-5, the MDOC data model in the domestic namespace eu.europa.ec.eudiw.pid.it.1, requires the following attributes:

Attribute name	Description	Reference
version	tstr (text string). Version of the data structure being used. It's a way to track changes and updates to the standard or to a specific implementation profile. This allows for backward compatibility and understanding of the data if the standard or implementation evolves over time.	[ISO 18013-5#8.3.2.1.2]
status	uint (unsigned int). Status code. For example `"status":0` means OK (normal processing).	[ISO 18013-5#8.3.2.1.2.3]
documents	bstr (byte string). The collection of digital documents. Each document in this collection represents a specific type of data or information related to the Digital Credential.	[ISO 18013-5#8.3.2.1.2]

Each document within the documents collection MUST have the following structure:

Attribute name	Description	Reference
docType	tstr (text string). Document type. For the PID, the value MUST be set to `eu.europa.ec.eudiw.pid.1.` For an mDL, the value MUST be `org.iso.18013-5.1.mDL`.	[ISO 18013-5#8.3.2.1.2]
issuerSigned	bstr (byte string). It MUST contain the Mobile Security Object for Issuer data authentication and the data elements protected by Issuer data authentication.	[ISO 18013-5#8.3.2.1.2]

The issuerSigned object MUST have the following structure:

Attribute name	Description	Reference
nameSpaces	bstr (byte string) with tag 24 and major type 6. Returned data elements for the namespaces. It MAY be possible to have one or more namespaces. The nameSpaces MUST use the same value for the document type. However, it MAY have a domestic namespace to include attributes defined in this implementation profile. The value MUST be set to `eu.europa.ec.eudiw.pid.it.1`.	[ISO 18013-5#8.3.2.1.2]
issuerAuth	bstr (byte string). Contains Mobile Security Object (MSO), a COSE Sign1 Document, issued by the Credential Issuer.	[ISO 18013-5#9.1.2.4]

During the presentation of the MDOC-CBOR credential, in addition to the objects in the table above, a deviceSigned object MUST also be added. deviceSigned MUST NOT be included in the issued credential provided by the PID/(Q)EAA Issuer.

Attribute name	Description	Reference
deviceSigned	bstr (byte string). Data elements signed by the Wallet Instance during the presentation phase.	[ISO 18013-5#8.3.2.1.2]

Where the deviceSigned MUST have the following structure:

Attribute name	Description	Reference
nameSpaces	tstr (text string). Returned data elements for the namespaces. It MAY be possible to have one or more namespaces. It MAY be used for self-attested claims.	[ISO 18013-5#8.3.2.1.2]
deviceAuth	bstr (byte string). It MUST contain either the DeviceSignature or the DeviceMac element.	[ISO 18013-5#8.3.2.1.2]

Note

A deviceSigned object given during the presentation phase has two purposes:

It provides optional self-attested attributes in the nameSpaces object. If no self-attested attributes are provided by the Wallet Instance, the nameSpaces object MUST be included with an empty structure.

Provide a cryptographic proof attesting that the Holder is the legitimate owner of the Credential, by means of a deviceAuth object.

Note

The issuerSigned and the deviceSigned objects contain the nameSpaces object and the Mobile Security Object. The latter is the only signed object, while the nameSpaces object is not signed.

nameSpaces¶

The nameSpaces object contains one or more IssuerSignedItemBytes that are encoded using CBOR bitsring 24 tag (#6.24(bstr .cbor), marked with the CBOR Tag 24(<<... >>) and represented in the example using the diagnostic format). It represents the disclosure information for each digest within the Mobile Security Object and MUST contain the following attributes:

Name	Encoding	Description
digestID	integer	Reference value to one of the `ValueDigests` provided in the Mobile Security Object (issuerAuth).
random	bstr (byte string)	Random byte value used as salt for the hash function. This value SHALL be different for each IssuerSignedItem and it SHALL have a minimum length of 16 bytes.
elementIdentifier	tstr (text string)	Data element identifier.
elementValue	depends by the value, see the next table.	Data element value.

The elementIdentifier data that MUST be included in a PID/(Q)EAA are:

Namespace	Element identifier	Description
eu.europa.ec.eudiw.pid.1	issue_date	full-date (CBORTag 1004). Date when the PID/(Q)EAA was issued.
eu.europa.ec.eudiw.pid.1	expiry_date	full-date (CBORTag 1004). Date when the PID/(Q)EAA will expire.
eu.europa.ec.eudiw.pid.1	issuing_authority	tstr (text string). Name of administrative authority that has issued the PID/(Q)EAA.
eu.europa.ec.eudiw.pid.1	issuing_country	tstr (text string). Alpha-2 country code as defined in [ISO 3166].

Depending on the Digital Credential type, additional elementIdentifier data MAY be added. The PID MUST support the following data:

Namespace	Element identifier	Description
eu.europa.ec.eudiw.pid.1	given_name	tstr (text string). See PID Claims fields Section.
eu.europa.ec.eudiw.pid.1	family_name	tstr (text string). See PID Claims fields Section.
eu.europa.ec.eudiw.pid.1	birth_date	full-date (CBORTag 1004). See PID Claims fields Section.
eu.europa.ec.eudiw.pid.it.1	personal_administrative_number	tstr (text string). See PID Claims fields Section.

Mobile Security Object¶

The issuerAuth represents the Mobile Security Object which is a COSE Sign1 Document defined in RFC 9052 - CBOR Object Signing and Encryption (COSE): Structures and Process. It has the following data structure:

protected header
unprotected header
payload
signature.

The protected header MUST contain the following parameter encoded in CBOR format:

Element	Description	Reference
Signature algorithm	-7 means ES256, SHA-256.	RFC8152

Note

Only the Signature Algorithm MUST be present in the protected headers, other elements SHOULD not be present in the protected header.

The unprotected header MUST contain the following parameter:

Element	Description	Reference
x5chain	Identified with the label 33	RFC 9360 CBOR Object Signing and Encryption (COSE) - Header Parameters for Carrying and Referencing X.509 Certificates.

Note

The x5chain is included in the unprotected header with the aim to make the Holder able to update the X.509 certificate chain, related to the Mobile Security Object issuer, without invalidating the signature.

The payload MUST contain the MobileSecurityObject, without the content-type COSE Sign header parameter and encoded as a byte string (bstr) using the CBOR Tag 24.

The MobileSecurityObjectBytes MUST have the following attributes:

Element	Description	Reference
docType	See Table.	[ISO 18013-5#9.1.2.4]
version	See Table.	[ISO 18013-5#9.1.2.4]
validityInfo	Object containing issuance and expiration datetimes. It MUST contain the following sub-value: signed validFrom validUntil	[ISO 18013-5#9.1.2.4]
digestAlgorithm	According to the algorithm defined in the protected header.	[ISO 18013-5#9.1.2.4]
valueDigests	Mapped digest by unique id, grouped by namespace.	[ISO 18013-5#9.1.2.4]
deviceKeyInfo	It MUST contain the Wallet Instance's public key containing the following sub-values. deviceKey (REQUIRED). keyAuthorizations (OPTIONAL). keyInfo (OPTIONAL).	[ISO 18013-5#9.1.2.4]

Note

The private key related to the public key stored in the deviceKey object is used to sign the DeviceSignedItems object and proof the possession of the PID during the presentation phase (see the presentation phase with MDOC-CBOR).

MDOC-CBOR Examples¶

A non-normative example of a PID in MDOC-CBOR format is represented below using the AF Binary encoding:

a366737461747573006776657273696f6e63312e3069646f63756d656e747381a267646f6354797065781865752e6575726f70612e65632e65756469772e7069642e316c6973737565725369676e6564a26a697373756572417574688443a10126a1182159021930820215308201bca003020102021404ad06a30c1a6dc6e93be0e2e8f78dcafa7907c2300a06082a8648ce3d040302305b310b3009060355040613025a45312e302c060355040a0c25465053204d6f62696c69747920616e64205472616e73706f7274206f66205a65746f706961311c301a06035504030c1349414341205a65746573436f6e666964656e73301e170d3231303932393033333034355a170d3232313130333033333034345a3050311a301806035504030c114453205a65746573436f6e666964656e7331253023060355040a0c1c5a65746f70696120436974792044657074206f662054726166666963310b3009060355040613025a453059301306072a8648ce3d020106082a8648ce3d030107034200047c5545e9a0b15f4ff3ce5015121e8ad3257c28d541c1cd0d604fc9d1e352ccc38adef5f7902d44b7a6fc1f99f06eedf7b0018fd9da716aec2f1ffac173356c7da3693067301f0603551d23041830168014bba2a53201700d3c97542ef42889556d15b7ac4630150603551d250101ff040b3009060728818c5d050102301d0603551d0e04160414ce5fd758a8e88563e625cf056bfe9f692f4296fd300e0603551d0f0101ff040403020780300a06082a8648ce3d0403020347003044022012b06a3813ffec5679f3b8cddb51eaa4b95b0cbb1786b09405e2000e9c46618c02202c1f778ad252285ed05d9b55469f1cb78d773671f30fe7ab815371942328317c59032ad818590325a667646f6354797065781865752e6575726f70612e65632e65756469772e7069642e316776657273696f6e63312e306c76616c6964697479496e666fa3667369676e6564c074323032332d30322d32325430363a32333a35365a6976616c696446726f6dc074323032332d30322d32325430363a32333a35365a6a76616c6964556e74696cc074323032342d30322d32325430303a30303a30305a6c76616c756544696765737473a2781865752e6575726f70612e65632e65756469772e7069642e31ac015820a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a025820cd372fb85148700fa88095e3492d3f9f5beb43e555e5ff26d95f5a6adc36f8e6035820e67e72111b363d80c8124d28193926000980e1211c7986cacbd26aacc5528d48045820f7d062d662826ed95869851db06bb539b402047baee53a00e0aa35bfbe98265d0658202a132dbfe4784627b86aa3807cd19cfeff487aab3dd7a60d0ab119a72e736936075820bdca9e8dbca354e824e67bfe1533fa4a238b9ea832f23fb4271ebeb3a5a8f7200858202c0eaec2f05b6c7fe7982683e3773b5d8d7a01e33d04dfcb162add8bd99bee9a095820bfe220d85657ccec3c67e7db1df747e9148a152334bb6d4b65b273279bcc36ec0a582018e38144f5044301d6a0b4ec9d5f98d4cd950e6ea2c29b849cbd457da29b6ad30b58203c71d2f0efa09d9e3fbbdffd29204f6b292c9f79570aef72dd86c91f7a3aa5c50c582065743d58d89d45e52044758f546034fd13a4f994bc270cdfa7844f74eb3f4b6e0d5820b4a8eb5d523bffa17b41bda12ddc7da32ae1e5f7ff3dcc394a35401f16919bbf781b65752e6575726f70612e65632e65756469772e7069642e69742e31a10e58209d6c11644651126c94acdaf0803e86d4c71d15d3b2712a14295416734efd514d6d6465766963654b6579496e666fa1696465766963654b6579a401022001215820ba01aea44eee1e338eb2f04e279dbd51b34655783ee185150838c9a7a7c4db7122582025ba0044439a3871a7b975a0994a85e79b705a9ac263b3fe899b0a93412ee8c96f646967657374416c676f726974686d675348412d32353658400813c28fd62f2602cbc14724e5865733c44a0fca589b55c085ec9d5c725d6cce25ba0044439a3871a7b975a0994a85e79b705a9ac263b3fe899b0a93412ee8c96a6e616d65537061636573a2781865752e6575726f70612e65632e65756469772e7069642e3188d818586da4686469676573744944016672616e646f6d5820156df9227ad341eaa61aabd301106fd21bdc18820e01dfc16bcf5fecc447111b71656c656d656e744964656e7469666965726b6578706972795f646174656c656c656d656e7456616c7565d903ec6a323032342d30322d3232d818586fa4686469676573744944026672616e646f6d5820a3a1f13f05544d03a5b50b5fdb78465808393bcf3b7953a345fe28f820c7be0d71656c656d656e744964656e7469666965726d69737375616e63655f646174656c656c656d656e7456616c7565d903ec6a323032332d30322d3232d8185866a4686469676573744944036672616e646f6d5820852591f90f2c9ded57a03632e2c1322ab52a082a431e71a4149a6830c8f1ad0c71656c656d656e744964656e7469666965726f69737375696e675f636f756e7472796c656c656d656e7456616c7565624954d818587ca4686469676573744944046672616e646f6d5820d1d587b3512acce15c4f6b20944ceb002a464e4a158389788563408873c3fce571656c656d656e744964656e7469666965727169737375696e675f617574686f726974796c656c656d656e7456616c7565764d696e69737465726f2064656c6c27496e7465726e6fd8185864a4686469676573744944056672616e646f6d582094fdd7609c0e73dc8589b5cab11e1d9058cf8bff8a336da5f81fcba055396a0f71656c656d656e744964656e7469666965726a676976656e5f6e616d656c656c656d656e7456616c7565654d6172696fd8185865a4686469676573744944066672616e646f6d5820660c0a7bf79e0e0261ca1547a4294fb808aa70738f424b13ab1b9440b566ae1371656c656d656e744964656e7469666965726b66616d696c795f6e616d656c656c656d656e7456616c756565526f737369d818586ba4686469676573744944076672616e646f6d5820315c53491286488fa07f5c2ce67135ef5c9959c3469c99a14e9b6dc924f9eba571656c656d656e744964656e746966696572696269727468646174656c656c656d656e7456616c7565d903ec6a313935362d30312d3132d818587da4686469676573744944086672616e646f6d5820764ef39c9d01f3aa6a87f441603cfe853fba3cee3bc2c168bcc9e96271d6e06371656c656d656e744964656e74696669657269756e697175655f69646c656c656d656e7456616c7565781e78787878787878782d7878782d787878782d787878787878787878787878781b65752e6575726f70612e65632e65756469772e7069642e69742e3181d8185877a46864696765737449440d6672616e646f6d5820717df3f583b1484366c33a1f869f2b5d201d466a8b589c79ab1a2d85e595432571656c656d656e744964656e7469666965726d7461785f69645f6e756d6265726c656c656d656e7456616c75657554494e49542d585858585858585858585858585858

The Diagnostic Notation of the above MDOC-CBOR is given below:

{     
    "status": 0,     
    "version": "1.0",     
    "documents": [        
    {             
      "docType": "eu.europa.ec.eudiw.pid.1",                         
      "issuerSigned": {                
          "issuerAuth": [                
          << {1: -7} >>, % protected header with the value alg:ES256                    
          {                         
              33: h'30820215308201BCA003020102021404AD30C…'% 33->X5chain:COSE X_509  
          },
          <<                       
              24(<<    
                  {                            
                  "docType": "eu.europa.ec.eudiw.pid.1",                                
                  "version": "1.0",  
                  "validityInfo": {                                
                      "signed": 0("2023-02-22T06:23:56Z"),                                     
                      "validFrom": 0("2023-02-22T06:23:56Z"),                                   
                      "validUntil": 0("2024-02-22T00:00:00Z")                               
                  },
                  "valueDigests": { 
                      "eu.europa.ec.eudiw.pid.1": {        
                          1: h'0F1571A97FFB799CC8FCDF2BA4FC2909929…',                                          
                          2: h'0CDFE077400432C055A2B69596C90…',     
                          3: h'E2382149255AE8E955AF9B8984395…',                                        
                          4: h'BBC77E6CCA981A3AD0C3E544EDF86…',                                     
                          6: h'BB6E6C68D1B4B4EC5A2AE9206F5t4…',
                          7: h'F8A5966E6DAC9970E0334D8F75E25…'
                      },
                      "eu.europa.ec.eudiw.pid.it.1": {  
                          8: h'F9EE4D36F67DBD75E23311AC1C29…'
                      }
                  },                             
                  "deviceKeyInfo": {                              
                      "deviceKey": {                                  
                          1: 2, % kty:EC2 (Eliptic curves with x and y coordinate pairs)           
                          -1: 1, % crv:p256                     
                          -2: h'B820963964E53AF064686DD9218303494A…', % x-coordiantes                                        
                          -3: h'0A6DA0AF437E2943F1836F31C678D89298E9…'% y-ccordiantes                                     
                      }                            
                  },                             
                  "digestAlgorithm": "SHA-256"    
                  }                       
              >>)                     
          >>,                        
          h'1AD0D6A7313EFDC38FCD765852FA2BD43DEBF48BF5A580D'                 
          ],                 
          "nameSpaces": {
              "eu.europa.ec.eudiw.pid.1": [                         
              24(<<    
                  {      
                  "digestID": 1,                                  
                  "random": h'E0B70BCEFBD43686F345C9ED429343AA',                                 
                  "elementIdentifier": "expiry_date",                                
                  "elementValue": 1004("2024-02-22")                             
                  }                         
              >>), 
              24(<<             
                  {       
                  "digestID": 2,                                  
                  "random": h'AE84834F389EE69888665B90A3E4FCCE', 
                  "elementIdentifier": "issue_date",   
                  "elementValue": 1004("2023-02-22")                                
                  }
              >>),                         
              24(<<   
                  {                              
                  "digestID": 3,                                 
                  "random": h'960CB15A2EA9B68E5233CE902807AA95',                               
                  "elementIdentifier": "issuing_country",                               
                  "elementValue": "IT"                                                    
                  }                       
              >>), 
              24(<<       
                  {                        
                  "digestID": 4,    
                  "random": h'9D3774BD5994CCFED248674B32A4F76A', 
                  "elementIdentifier": "issuing_authority",   
                  "elementValue": "Ministero dell'Interno"  
                  }   
              >>),                 
              24(<<        
                  {                              
                  "digestID": 5,                         
                  "random": h'EB12193DC66C6174530CDC29B274381F', 
                  "elementIdentifier": "given_name",
                  "elementValue": "Mario"                             
                  }                         
              >>),            
              24(<<                            
                  {                               
                  "digestID": 6,                             
                  "random": h'DB143143538F3C8D41DC024F9CB25C9D',
                  "elementIdentifier": "family_name",  
                  "elementValue": "Rossi"    
                  } 
              >>),                         
              24(<<               
                  {                          
                  "digestID": 7, 
                  "random": h'6059FF1CE27B4997B4ADE1DE7B01DC60',
                  "elementIdentifier": "birth_date",
                  "elementValue": 1004("1956-01-12")% the tag 1004 defines the value    
                    is a full date 
                  }  
              >>)
              ],
              "eu.europa.ec.eudiw.pid.it.1": [
                  24(<<
                      {
                      "digestID": 8, 
                      "random": h'11aa7273a2d2daa973f5951f0c34c2fbae',
                      "elementIdentifier": "personal_administrative_number", 
                      "elementValue": "TINIT-XXXXXXXXXXXXXXX"
                      }                         
                  >>)                    
              ]            
          }  
      }           
    }
    ]
  }