PID/(Q)EAA Data Model

The Digital Credential Data Model structures Digital Credentials for secure, interoperable use. Key elements include:

• Credential Subject: The individual or entity receiving the Credential.

• Issuer: The PID/(Q)EAA Provider issuing and signing the Credential.

• Metadata: Details about the Credential, like type and validity.

• Claims: Information about the subject, such as identity or qualifications.

• Proof: Cryptographic verification of authenticity and legitimate ownership.

The Person Identification Data (PID) is issued by the PID Provider according to national laws. The main scope of the PID is allowing natural persons to be authenticated for the access to a service or to a protected resource. The User attributes provided within the Italian PID are the ones listed below:

• Current Family Name

• Current First Name

• Date of Birth

• Taxpayer identification number

The (Q)EAAs are issued by (Q)EAA Issuers to a Wallet Instance and MUST be provided in SD-JWT-VC or MDOC-CBOR data format.

The PID/(Q)EAA data format and the mechanism through which a digital credential is issued to the Wallet Instance and presented to a Relying Party are described in the following sections.

SD-JWT-VC Credential Format

The PID/(Q)EAA is issued in the form of a Digital Credential. The Digital Credential format is SD-JWT as specified in SD-JWT-VC.

SD-JWT MUST be signed using the Issuer's private key. SD-JWT MUST be provided along with a Type Metadata related to the issued Digital Credential according to Sections 6 and 6.3 of [SD-JWT-VC]. The payload MUST contain the _sd_alg claim described in the Section 4.1.1 SD-JWT and other claims specified in this section.

The claim _sd_alg indicates the hash algorithm used by the Issuer to generate the digests as described in Section 4.1.1 of SD-JWT. _sd_alg MUST be set to one of the specified algorithms in Section Cryptographic Algorithms.

Claims that are not selectively disclosable MUST be included in the SD-JWT as they are. The digests of the disclosures, along with any decoy if present, MUST be contained in the _sd array, as specified in Section 4.2.4.1 of SD-JWT.

Each digest value, calculated using a hash function over the disclosures, verifies the integrity and corresponds to a specific Disclosure. Each disclosure includes:

• a random salt,

• the claim name (only when the claim is an object element),

• the claim value.

In case of nested object in a SD-JWT payload each claim, on each level of the JSON, should be individually selectively disclosable or not. Therefore _sd claim containing digests MAY appear multiple times at different level in the SD-JWT.

For each claim that is an array element the digests of the respective disclosures and decoy digests are added to the array in the same position of the original claim values as specified in Section 4.2.4.2 of SD-JWT.

In case of array elements, digest values are calculated using a hash function over the disclosures, containing:

• a random salt,

• the array element

In case of multiple array elements, the Issuer may hide the value of the entire array or any of the entry contained within the array, the Holder can disclose both the entire array and any single entry within the array, as defined in Section 4.2.6 of SD-JWT.

The Disclosures are provided to the Holder together with the SD-JWT in the Combined Format for Issuance that is an ordered series of base64url-encoded values, each separated from the next by a single tilde ('~') character as follows:

<Issuer-Signed-JWT>~<Disclosure 1>~<Disclosure 2>~...~<Disclosure N>

See SD-JWT-VC and SD-JWT for additional details.

PID/(Q)EAA SD-JWT parameters

The JOSE header contains the following mandatory parameters:

Claim	Description	Reference
typ	REQUIRED. It MUST be set to dc+sd-jwt as defined in SD-JWT-VC.	RFC 7515 Section 4.1.9.
alg	REQUIRED. Signature Algorithm.	RFC 7515 Section 4.1.1.
kid	REQUIRED. Unique identifier of the public key.	RFC 7515 Section 4.1.8.
trust_chain	OPTIONAL. JSON array containing the trust chain that proves the reliability of the issuer of the JWT.	[OID-FED] Section 4.3.
x5c	OPTIONAL. Contains the X.509 public key certificate or certificate chain [RFC 5280] corresponding to the key used to digitally sign the JWT.	RFC 7515 Section 4.1.8 and [SD-JWT-VC] Section 3.5.
vctm	OPTIONAL. JSON array of base64url-encoded Type Metadata JSON documents. In case of extended type metadata, this claim contains the entire chain of JSON documents.	[SD-JWT-VC] Section 6.3.5.

The JWT payload contains the following claims. Some of these claims can be disclosed, these are listed in the following tables that specify whether a claim is selectively disclosable [SD] or not [NSD].

Claim	Description	Reference
iss	[NSD]. REQUIRED. URL string representing the PID/(Q)EAA Issuer unique identifier.	[RFC7519, Section 4.1.1].
sub	[NSD]. REQUIRED. The identifier of the subject of the Digital Credential, the User, MUST be opaque and MUST NOT correspond to any anagraphic data or be derived from the User's anagraphic data via pseudonymization. Additionally, it is required that two different Credentials issued MUST NOT use the same sub value.	[RFC7519, Section 4.1.2].
iat	[SD]. REQUIRED. UNIX Timestamp with the time of JWT issuance, coded as NumericDate as indicated in RFC 7519.	[RFC7519, Section 4.1.6].
exp	[NSD]. REQUIRED. UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated in RFC 7519.	[RFC7519, Section 4.1.4].
nbf	[NSD]. OPTIONAL. UNIX Timestamp with the start time of validity of the JWT, coded as NumericDate as indicated in RFC 7519.	[RFC7519, Section 4.1.4].
issuing_authority	[NSD]. REQUIRED. Name of the administrative authority that has issued the PID/(Q)EAA.	Commission Implementing Regulation EU_2024/2977.
issuing_country	[NSD]. REQUIRED. Alpha-2 country code, as specified in ISO 3166-1, of the country or territory of the PID/(Q)EAA Issuer.	Commission Implementing Regulation EU_2024/2977.
status	[NSD]. REQUIRED. JSON object containing the information on how to read the status of the Verifiable Credential. It MUST contain the JSON member status_assertion set to a JSON Object containing the credential_hash_alg claim indicating the Algorithm used for hashing the Digital Credential to which the Status Assertion is bound. It is RECOMMENDED to use sha-256.	Section 3.2.2.2 SD-JWT-VC and Section 11 OAUTH-STATUS-ASSERTION.
cnf	[NSD]. REQUIRED. JSON object containing the proof-of-possession key materials. By including a cnf (confirmation) claim in a JWT, the Issuer of the JWT declares that the Holder is in control of the private key related to the public one defined in the cnf parameter. The recipient MUST cryptographically verify that the Holder is in control of that key.	[RFC7800, Section 3.1] and Section 3.2.2.2 SD-JWT-VC.
vct	[NSD]. REQUIRED. Credential type value MUST be an HTTPS URL String and it MUST be set using one of the values obtained from the PID/(Q)EAA Issuer metadata. It is the identifier of the SD-JWT VC type and it MUST be set with a collision-resistant value as defined in Section 2 of RFC 7515. It MUST contain also the number of version of the Credential type (for instance: https://issuer.example.org/v1.0/personidentificationdata).	Section 3.2.2.2 SD-JWT-VC.
vct#integrity	[NSD]. REQUIRED. The value MUST be an "integrity metadata" string as defined in Section 3 of [W3C-SRI]. SHA-256, SHA-384 and SHA-512 MUST be supported as cryptographic hash functions. MD5 and SHA-1 MUST NOT be used. This claim MUST be verified according to Section 3.3.5 of [W3C-SRI].	Section 6.1 SD-JWT-VC, [W3C-SRI]
verification	[SD]. CONDITIONAL. REQUIRED if Credential type is set to PersonIdentificationData. Object containing User authentication and User data verification information. If present MUST include the following sub-value: trust_framework: String identifying the trust framework used for User authentication. It MUST be set using one of the values described in the trust_frameworks_supported map provided within the Credential Issuer Metadata. assurance_level: String identifying the level of identity assurance guaranteed during the User authentication process. evidence: Each entry of the array MUST contain the following members: type: It represents evidence type. It MUST be set to vouch. time: UNIX Timestamps with the time of the authentication or verification. attestation: It MUST contain the following members: type: It MUST be set to digital_attestation. reference_number: identifier of the authentication or verification response. date_of_issuance: date of issuance of the attestation. voucher: It MUST contains organization claim.	OIDC-IDA.

Note

Credential Type Metadata JSON Document MAY be retrieved directly from the URL contained in the claim vct, using the HTTP GET method or using the vctm header parameter if provided. Unlike specified in Section 6.3.1 of SD-JWT-VC the .well-known endpoint is not included in the current implementation profile. Implementers may decide to use it for interoperability with other systems.

Digital Credential Metadata Type

The Metadata type document MUST be a JSON object and contains the following parameters.

Claim	Description	Reference
name	REQUIRED. Human-readable name of the Digital Credential type. In case of multiple language, the language tags are added to member name, delimited by a # character as defined in RFC 5646 (e.g. name#it-IT).	[SD-JWT-VC] Section 6.2 and [OIDC] Section 5.2.
description	REQUIRED. A human-readable description of the Digital Credential type. In case of multiple language, the language tags are added to member name, delimited by a # character as defined in RFC 5646.	[SD-JWT-VC] Section 6.2 and [OIDC] Section 5.2.
extends	OPTIONAL. String Identitifier of an exteded metadata type document.	[SD-JWT-VC] Section 6.2.
extends#integrity	CONDITIONAL. REQUIRED if extends is present.	[SD-JWT-VC] Section 6.2.
schema	CONDITIONAL. REQUIRED if schema_uri is not present.	[SD-JWT-VC] Section 6.2.
schema_uri	CONDITIONAL. REQUIRED if schema is not present.	[SD-JWT-VC] Section 6.2.
schema_uri#integrity	CONDITIONAL. REQUIRED if schema_uri is present.	[SD-JWT-VC] Section 6.2.
data_source	REQUIRED. Object containing information about the data origin. It MUST contain the object verification with this following sub-value: trust_framework: MUST contain trust framework used for digital authentication towards Authentic Source system. authentic_source: MUST contain the following claims related to information about the Authentic Source: organization_name name of the Authentic Source. organization_code code identifier of the Authentic Source. homepage_uri uri pointing to the Authentic Source's homepage. contacts contact list for info and assistance. logo_uri URI pointing to the logo image.	This specification
display	REQUIRED. Array of objects, one for each language supported, containing display information for the Digital Credential type. It contains for each object the following properties: lang: language tag as defined in RFC 5646 Section 2. [REQUIRED]. name: human-readable label for the Digital Credential type. [REQUIRED]. description: human-readable description for the Digital Credential type. [REQUIRED]. rendering: object containing rendering methods supported by the Digital Credential type. [REQUIRED]. The rendering method svg_template MUST be supported. The svg_templates array of objects contains for each SVG template supported the following properties: uri: URI pointing to the SVG template. [REQUIRED]. uri#integrity: integrity metadata as defined in Section 3 of W3C-SRI. [REQUIRED]. properties: object containing SVG template properties. This property is REQUIRED if more than one SVG template is present. The object MUST contain at least one of the properties defined in SD-JWT-VC Section 8.1.2.1. If rendering method simple is also supported, the simple object contains the following properties: logo: object containing information about the logo to display. This property is REQUIRED. The object contains the following sub-values: uri: URI pointing to the logo image. [REQUIRED] uri#integrity: integrity metadata as defined in Section 3 of W3C-SRI. [REQUIRED]. alt_text: A string containing alternative text to display instead of the logo image. [OPTIONAL]. background_color: RGB color value as defined in W3C.CSS-COLOR for the background of the Digital Credential. [OPTIONAL]. text_color: RGB color value as defined in W3C.CSS-COLOR for the text of the Digital Credential. [OPTIONAL]. Note The use of the SVG template is recommended for all applications that support it.	[SD-JWT-VC] Section 8.
claims	REQUIRED. Array of objects containing information for displaying and validating Digital Credential claims. It contains for each Credential claim the following properties: path: array indicating the claim or claims that are being addressed. [REQUIRED]. display: array containing display information about the claim indicated in the path. The array contains an object for each language supported by the Digital Credential type. This property is REQUIRED. It contains the following members: lang: language tag as defined in RFC 5646 Section 2. [REQUIRED]. label: human-readable label for the claim. [REQUIRED]. description: human-readable description for the claim. [REQUIRED]. sd: string indicating whether the claim is selectively disclosable. It MUST be set to always if the claim is selectively disclosure or never if not. [REQUIRED]. svg_id: alphanumeric string containing ID of the claim referenced in the SVG template as defined in [SD-JWT-VC] Section 9. [REQUIRED].	[SD-JWT-VC] Section 9.

A non-normative Digital Credential metadata type is provided below.

{	
    "name": "Person Identification Data",
    "description": "Digital version of Person Identification Data",
    "template_uri": "https://pidprovider.example.org/v1.0/templatepid",	
    "schema_uri": "https://pidprovider.example.org/schema/v1.0/personidentificationdata",
    "schema_uri#integrity": "c8b708728e4c5756e35c03aeac257ca878d1f717d7b61f621be4d36dbd9b9c16",
    "data_source": {
        "verification": {
        "trust_framework": "pdnd",
        "authentic_source": {
            "organization_name": "Ministero dell'Interno",
            "organization_code": "m_it",
            "contacts": [
                "informazioni@example.it",
                "protocollo@pec.example.it"
            ],
            "homepage_uri": "https://authsource.example.com/",
            "logo_uri": "https://authsource.example.com/img/logo.svg"
            }
        }	
    },		
    "display": [      
        {
          "lang": "it-IT",
          "name": "Dati di Identificazione Personale",
          "description": "Versione Digitale dei Dati di Identificazione Personale",
          "rendering": {
            "simple": {
              "logo": {
                "uri": "https://authsource.example.com/img/logo.png",
                "uri#integrity": "sha256-LmXfh-9cLlJNXN-TsMk-PmKjZ5t0WRL5ca_xGgX3c1V",
                "alt_text": "Logo del Ministero dell'Interno"
              },
              "background_color": "#2e89d9",
              "text_color": "#030303"
            },
            "svg_templates": [
              {
                "uri": "https://authsource.example.com/svgtemplates/pid-credential-italian.svg",
                "uri#integrity": "sha256-8cLlJNXN-TsMk-PmKjZ5t0WRL5ca_xGgX3c1VLmXfh-9c",
                "properties": {
                  "orientation": "landscape",
                  "color_scheme": "light",
                  "contrast": "high"
                }
              }
            ]
          }
        },
        {
          "lang": "en-US",
          "name": "Person Identification Data",
          "description": "Digital version of Person Identification Data",
          "rendering": {
            "simple": {
              "logo": {
                "uri": "https://authsource.example.com/img/logo.png",
                "uri#integrity": "sha256-LmXfh-9cLlJNXN-TsMk-PmKjZ5t0WRL5ca_xGgX3c1V",
                "alt_text": "Ministry of the Interior logo"
              },
              "background_color": "#2e89d9",
              "text_color": "#030303"
            },
            "svg_templates": [
              {
                "uri": "https://authsource.example.com/svgtemplates/pid-credential-english.svg",
                "uri#integrity": "sha256-8cLlJNXN-TsMk-PmKjZ5t0WRL5ca_xGgX3c1VLmXfh-9c",
                "properties": {
                  "orientation": "landscape",
                  "color_scheme": "light",
                  "contrast": "high"
                }
              }
            ]
          }
        }
      ],
    "claims": [
        {
          "path": ["given_name"],
          "display": [
            {
              "lang": "it-IT",
              "label": "Nome",
              "description": "Nome/i attuale/i dell'utente a cui si riferiscono i dati di identificazione personale."
            },
            {
              "lang": "en-US",
              "label": "Name",
              "description": "Current first name(s), including middle name(s) of the user to whom the person identification data relates."
            }
          ],
          "sd": "always",
          "svg_id": "given_name"
        },
        {
          "path": ["family_name"],
          "display": [
            {
              "lang": "it-IT",
              "label": "Cognome",
              "description": "Cognome/i attuale/i dell'utente a cui si riferiscono i dati di identificazione personale."
            },
            {
              "lang": "en-US",
              "label": "Surname",
              "description": "Current last name(s) or surname(s) of the user to whom the person identification data relates."
            }
          ],
          "sd": "always",
          "svg_id": "family_name"
        },
        {
          "path": ["birth_date"],
          "display": [
           {
              "lang": "it-IT",
              "label": "Data di nascita",
              "description": "Giorno, mese e anno di nascita dell'utente a cui si riferiscono i dati identificativi."
            },
            {
              "lang": "en-US",
              "label": "Date of birth",
              "description": "Day, month, and year on which the user to whom the person identification data relates was born."
            }
          ],
          "sd": "always",
          "svg_id": "birth_date"
        },       
        {
            "path": ["personal_administrative_number"],
            "display": [
              {
                "lang": "it-IT",
                "label": "Codice fiscale",
                "description": "Codice di identificazione fiscale nazionale della persona fisica."
              },
              {
                "lang": "en-US",
                "label": "Tax identification number",
                "description": "National tax identification code of natural person." 
              }
            ],
            "sd": "always",
            "svg_id": "personal_administrative_number"
          }
      ]
}

PID Claims

Depending on the Digital Credential type vct, additional claims data MAY be added. The PID supports the following data:

Claim	Description	Reference
given_name	[SD]. REQUIRED. Current First Name.	Section 5.1 of OIDC and Commission Implementing Regulation EU_2024/2977
family_name	[SD]. REQUIRED. Current Family Name.	Section 5.1 of OIDC and Commission Implementing Regulation EU_2024/2977
birth_date	[SD]. REQUIRED. Date of Birth.	Commission Implementing Regulation EU_2024/2977
birth_place	[SD]. REQUIRED. Place of Birth.	Commission Implementing Regulation EU_2024/2977
nationality	[SD]. REQUIRED. One or more alpha-2 country codes as specified in ISO 3166-1.	Commission Implementing Regulation EU_2024/2977
personal_administrative_number	[SD]. CONDITIONAL. REQUIRED if tax_id_code is not present. National unique identifier of a natural person generated by ANPR as a String format.	Commission Implementing Regulation EU_2024/2977
tax_id_code	[SD]. CONDITIONAL. REQUIRED if personal_administrative_number is not present. National tax identification code of natural person as a String format. It MUST be set according to ETSI EN 319 412-1. For example TINIT-<ItalianTaxIdentificationNumber>

The PID attribute schema, which encompasses all potential User data, is defined in ARF v1.4, and furthermore detailed in the PID Rulebook.

PID Non-Normative Examples

In the following, the non-normative example of the payload of a PID represented in JSON format.

{
  "iss": "https://pidprovider.example.org",
  "sub": "NzbLsXh8uDCcd7noWXFZAfHkxZsRGC9Xs",
  "iat": 1683000000,
  "exp": 1883000000,
  "issuing_authority": "Istituto Poligrafico e Zecca dello Stato",
  "issuing_country": "IT",
  "status": {
    "status_assertion": {
      "credential_hash_alg": "sha-256"
    }
  },
  "vct": "https://pidprovider.example.org/v1.0/personidentificationdata",
  "vct#integrity": "c5f73e250fe869f24d15118acce286c9bb56b63a443dc85af653cd73f6078b1f",
  "verification": {
    "trust_framework": "it_cie",
    "assurance_level": "high",
    "evidence": [
    {
      "type": "vouch",
      "time": "2020-03-19T12:42Z",
      "attestation": {
        "type": "digital_attestation",
        "reference_number": "6485-1619-3976-6671",
        "date_of_issuance": "2020-03-19T12:43Z",
        "voucher": {
          "organization": "Ministero dell'Interno"
        }
      }
    }
    ]
  },
  "given_name": "Mario",
  "family_name": "Rossi",
  "birth_date": "1980-01-10",
  "birth_place": "Roma",
  "nationality": "IT",
  "personal_administrative_number": "XX00000XX",
  "tax_id_code": "TINIT-XXXXXXXXXXXXXXXX"
}

The corresponding SD-JWT version for PID is given by

{
  "typ":"dc+sd-jwt",
  "alg":"ES256",
  "kid":"dB67gL7ck3TFiIAf7N6_7SHvqk0MDYMEQcoGGlkUAAw",
  "trust_chain" : [
   "NEhRdERpYnlHY3M5WldWTWZ2aUhm ...",
   "eyJhbGciOiJSUzI1NiIsImtpZCI6 ...",
   "IkJYdmZybG5oQU11SFIwN2FqVW1B ..."
  ]
}

{
  "_sd": [
    "6WLNc09rBr-PwEtnWzxGKdzImjrpDxbr4qoIx838a88",
    "LqrtU2rlA51U97cMiYhqwa-is685bYiOJImp8a5KGNA",
    "VQI-S1mT1Kxfq2o8J9io7xMMX2MIxaG9M9PeJVqrMcA",
    "Yrc-s-WSr4exEYtqDEsmRl7spoVfmBxixP12e4syqNE",
    "h7Egl5H9gTPC_FCU845aadvsC--dTjy9Nrstxh-caRo",
    "hP79TuWGBwIN0j9NH_fxn8Cvj-dNH_R7nFleeWCE2I4",
    "s1XK5f2pM3-aFTauXhmvd9pyQTJ6FMUhc-JXfHrxhLk",
    "tSL-e1nLdWOU9sFMTCUu5P1tCzxA-TW-VWbHGzYtU7E",
    "zVdghcmClMVWlUgGsGpSkCPkEHZ4u9oWj1SlIBlCc1o"
  ],
  "iss": "https://pidprovider.example.org",
  "exp": 1883000000,
  "sub": "NzbLsXh8uDCcd7noWXFZAfHkxZsRGC9Xs",
  "issuing_authority": "Istituto Poligrafico e Zecca dello Stato",
  "issuing_country": "IT",
  "status": {
    "status_assertion": {
      "credential_hash_alg": "sha-256"
    }
  },
  "vct": "https://pidprovider.example.org/v1.0/personidentificationdata",
  "vct#integrity": "c5f73e250fe869f24d15118acce286c9bb56b63a443dc85af653cd73f6078b1f",
  "_sd_alg": "sha-256",
  "cnf": {
    "jwk": {
      "kty": "EC",
      "crv": "P-256",
      "x": "TCAER19Zvu3OHF4j4W4vfSVoHIP1ILilDls7vCeGemc",
      "y": "ZxjiWWbZMQGHVWKVQ4hbSIirsVfuecCE6t4jT9F2HZQ"
    }
  }
}

In the following the disclosure list is given

Claim iat:

• SHA-256 Hash: Yrc-s-WSr4exEYtqDEsmRl7spoVfmBxixP12e4syqNE

• Disclosure: WyIyR0xDNDJzS1F2ZUNmR2ZyeU5STjl3IiwgImlhdCIsIDE2ODMwMDAwMDBd

• Contents: ["2GLC42sKQveCfGfryNRN9w", "iat", 1683000000]

Claim verification:

• SHA-256 Hash: h7Egl5H9gTPC_FCU845aadvsC--dTjy9Nrstxh-caRo

• Disclosure: WyJlbHVWNU9nM2dTTklJOEVZbnN4QV9BIiwgInZlcmlmaWNhdGlvbiIsIHsi dHJ1c3RfZnJhbWV3b3JrIjogIml0X2NpZSIsICJhc3N1cmFuY2VfbGV2ZWwi OiAiaGlnaCIsICJldmlkZW5jZSI6IHsidHlwZSI6ICJ2b3VjaCIsICJ0aW1l IjogIjIwMjAtMDMtMTlUMTI6NDJaIiwgImF0dGVzdGF0aW9uIjogeyJ0eXBl IjogImRpZ2l0YWxfYXR0ZXN0YXRpb24iLCAicmVmZXJlbmNlX251bWJlciI6 ICI2NDg1LTE2MTktMzk3Ni02NjcxIiwgImRhdGVfb2ZfaXNzdWFuY2UiOiAi MjAyMC0wMy0xOVQxMjo0M1oiLCAidm91Y2hlciI6IHsib3JnYW5pemF0aW9u IjogIk1pbmlzdGVybyBkZWxsJ0ludGVybm8ifX19fV0

• Contents: ["eluV5Og3gSNII8EYnsxA_A", "verification", {"trust_framework": "it_cie", "assurance_level": "high", "evidence": {"type": "vouch", "time": "2020-03-19T12:42Z", "attestation": {"type": "digital_attestation", "reference_number": "6485-1619-3976-6671", "date_of_issuance": "2020-03-19T12:43Z", "voucher": {"organization": "Ministero dell'Interno"}}}}]

Claim given_name:

• SHA-256 Hash: zVdghcmClMVWlUgGsGpSkCPkEHZ4u9oWj1SlIBlCc1o

• Disclosure: WyI2SWo3dE0tYTVpVlBHYm9TNXRtdlZBIiwgImdpdmVuX25hbWUiLCAiTWFy aW8iXQ

• Contents: ["6Ij7tM-a5iVPGboS5tmvVA", "given_name", "Mario"]

Claim family_name:

• SHA-256 Hash: VQI-S1mT1Kxfq2o8J9io7xMMX2MIxaG9M9PeJVqrMcA

• Disclosure: WyJlSThaV205UW5LUHBOUGVOZW5IZGhRIiwgImZhbWlseV9uYW1lIiwgIlJv c3NpIl0

• Contents: ["eI8ZWm9QnKPpNPeNenHdhQ", "family_name", "Rossi"]

Claim birth_date:

• SHA-256 Hash: s1XK5f2pM3-aFTauXhmvd9pyQTJ6FMUhc-JXfHrxhLk

• Disclosure: WyJRZ19PNjR6cUF4ZTQxMmExMDhpcm9BIiwgImJpcnRoX2RhdGUiLCAiMTk4 MC0wMS0xMCJd

• Contents: ["Qg_O64zqAxe412a108iroA", "birth_date", "1980-01-10"]

Claim birth_place:

• SHA-256 Hash: tSL-e1nLdWOU9sFMTCUu5P1tCzxA-TW-VWbHGzYtU7E

• Disclosure: WyJBSngtMDk1VlBycFR0TjRRTU9xUk9BIiwgImJpcnRoX3BsYWNlIiwgIlJv bWEiXQ

• Contents: ["AJx-095VPrpTtN4QMOqROA", "birth_place", "Roma"]

Claim nationality:

• SHA-256 Hash: hP79TuWGBwIN0j9NH_fxn8Cvj-dNH_R7nFleeWCE2I4

• Disclosure: WyJQYzMzSk0yTGNoY1VfbEhnZ3ZfdWZRIiwgIm5hdGlvbmFsaXR5IiwgIklU Il0

• Contents: ["Pc33JM2LchcU_lHggv_ufQ", "nationality", "IT"]

Claim personal_administrative_number:

• SHA-256 Hash: 6WLNc09rBr-PwEtnWzxGKdzImjrpDxbr4qoIx838a88

• Disclosure: WyJHMDJOU3JRZmpGWFE3SW8wOXN5YWpBIiwgInBlcnNvbmFsX2FkbWluaXN0 cmF0aXZlX251bWJlciIsICJYWDAwMDAwWFgiXQ

• Contents: ["G02NSrQfjFXQ7Io09syajA", "personal_administrative_number", "XX00000XX"]

Claim tax_id_code:

• SHA-256 Hash: LqrtU2rlA51U97cMiYhqwa-is685bYiOJImp8a5KGNA

• Disclosure: WyJsa2x4RjVqTVlsR1RQVW92TU5JdkNBIiwgInRheF9pZF9jb2RlIiwgIlRJ TklULVhYWFhYWFhYWFhYWFhYWFgiXQ

• Contents: ["lklxF5jMYlGTPUovMNIvCA", "tax_id_code", "TINIT-XXXXXXXXXXXXXXXX"]

The combined format for the PID issuance is given by:

eyJhbGciOiAiRVMyNTYiLCAidHlwIjogImRjK3NkLWp3dCIsICJraWQiOiAiZEI2N2dM
N2NrM1RGaUlBZjdONl83U0h2cWswTURZTUVRY29HR2xrVUFBdyJ9.eyJfc2QiOiBbIjZ
XTE5jMDlyQnItUHdFdG5XenhHS2R6SW1qcnBEeGJyNHFvSXg4MzhhODgiLCAiTHFydFU
ycmxBNTFVOTdjTWlZaHF3YS1pczY4NWJZaU9KSW1wOGE1S0dOQSIsICJWUUktUzFtVDF
LeGZxMm84Sjlpbzd4TU1YMk1JeGFHOU05UGVKVnFyTWNBIiwgIllyYy1zLVdTcjRleEV
ZdHFERXNtUmw3c3BvVmZtQnhpeFAxMmU0c3lxTkUiLCAiaDdFZ2w1SDlnVFBDX0ZDVTg
0NWFhZHZzQy0tZFRqeTlOcnN0eGgtY2FSbyIsICJoUDc5VHVXR0J3SU4wajlOSF9meG4
4Q3ZqLWROSF9SN25GbGVlV0NFMkk0IiwgInMxWEs1ZjJwTTMtYUZUYXVYaG12ZDlweVF
USjZGTVVoYy1KWGZIcnhoTGsiLCAidFNMLWUxbkxkV09VOXNGTVRDVXU1UDF0Q3p4QS1
UVy1WV2JIR3pZdFU3RSIsICJ6VmRnaGNtQ2xNVldsVWdHc0dwU2tDUGtFSFo0dTlvV2o
xU2xJQmxDYzFvIl0sICJleHAiOiAxODgzMDAwMDAwLCAiaXNzIjogImh0dHBzOi8vcGl
kcHJvdmlkZXIuZXhhbXBsZS5vcmciLCAic3ViIjogIk56YkxzWGg4dURDY2Q3bm9XWEZ
aQWZIa3hac1JHQzlYcyIsICJpc3N1aW5nX2F1dGhvcml0eSI6ICJJc3RpdHV0byBQb2x
pZ3JhZmljbyBlIFplY2NhIGRlbGxvIFN0YXRvIiwgImlzc3VpbmdfY291bnRyeSI6ICJ
JVCIsICJzdGF0dXMiOiB7InN0YXR1c19hc3NlcnRpb24iOiB7ImNyZWRlbnRpYWxfaGF
zaF9hbGciOiAic2hhLTI1NiJ9fSwgInZjdCI6ICJodHRwczovL3BpZHByb3ZpZGVyLmV
4YW1wbGUub3JnL3YxLjAvcGVyc29uaWRlbnRpZmljYXRpb25kYXRhIiwgInZjdCNpbnR
lZ3JpdHkiOiAiYzVmNzNlMjUwZmU4NjlmMjRkMTUxMThhY2NlMjg2YzliYjU2YjYzYTQ
0M2RjODVhZjY1M2NkNzNmNjA3OGIxZiIsICJfc2RfYWxnIjogInNoYS0yNTYiLCAiY25
mIjogeyJqd2siOiB7Imt0eSI6ICJFQyIsICJjcnYiOiAiUC0yNTYiLCAieCI6ICJUQ0F
FUjE5WnZ1M09IRjRqNFc0dmZTVm9ISVAxSUxpbERsczd2Q2VHZW1jIiwgInkiOiAiWnh
qaVdXYlpNUUdIVldLVlE0aGJTSWlyc1ZmdWVjQ0U2dDRqVDlGMkhaUSJ9fX0.7lV6m1K
IsnwuJcR8DgrmRHBkLEXJcx7kVBI1rzlbBwZ_xMPwAd4Dfl06dyLKegdTZO1RDR3IDi-
JyiuNMFlZOQ~WyIyR0xDNDJzS1F2ZUNmR2ZyeU5STjl3IiwgImlhdCIsIDE2ODMwMDAw
MDBd~WyJlbHVWNU9nM2dTTklJOEVZbnN4QV9BIiwgInZlcmlmaWNhdGlvbiIsIHsidHJ
1c3RfZnJhbWV3b3JrIjogIml0X2NpZSIsICJhc3N1cmFuY2VfbGV2ZWwiOiAiaGlnaCI
sICJldmlkZW5jZSI6IHsidHlwZSI6ICJ2b3VjaCIsICJ0aW1lIjogIjIwMjAtMDMtMTl
UMTI6NDJaIiwgImF0dGVzdGF0aW9uIjogeyJ0eXBlIjogImRpZ2l0YWxfYXR0ZXN0YXR
pb24iLCAicmVmZXJlbmNlX251bWJlciI6ICI2NDg1LTE2MTktMzk3Ni02NjcxIiwgImR
hdGVfb2ZfaXNzdWFuY2UiOiAiMjAyMC0wMy0xOVQxMjo0M1oiLCAidm91Y2hlciI6IHs
ib3JnYW5pemF0aW9uIjogIk1pbmlzdGVybyBkZWxsJ0ludGVybm8ifX19fV0~WyI2SWo
3dE0tYTVpVlBHYm9TNXRtdlZBIiwgImdpdmVuX25hbWUiLCAiTWFyaW8iXQ~WyJlSTha
V205UW5LUHBOUGVOZW5IZGhRIiwgImZhbWlseV9uYW1lIiwgIlJvc3NpIl0~WyJRZ19P
NjR6cUF4ZTQxMmExMDhpcm9BIiwgImJpcnRoX2RhdGUiLCAiMTk4MC0wMS0xMCJd~WyJ
BSngtMDk1VlBycFR0TjRRTU9xUk9BIiwgImJpcnRoX3BsYWNlIiwgIlJvbWEiXQ~WyJQ
YzMzSk0yTGNoY1VfbEhnZ3ZfdWZRIiwgIm5hdGlvbmFsaXR5IiwgIklUIl0~WyJHMDJO
U3JRZmpGWFE3SW8wOXN5YWpBIiwgInBlcnNvbmFsX2FkbWluaXN0cmF0aXZlX251bWJl
ciIsICJYWDAwMDAwWFgiXQ~WyJsa2x4RjVqTVlsR1RQVW92TU5JdkNBIiwgInRheF9pZ
F9jb2RlIiwgIlRJTklULVhYWFhYWFhYWFhYWFhYWFgiXQ~

(Q)EAA non-normative examples

Below a non-normative example of (Q)EAA in JSON.

{
  "iss": "https://issuer.example.org",
  "sub": "NzbLsXh8uDCcd7noWXFZAfHkxZsRGC9Xs",
  "iat": 1683000000,
  "exp": 1883000000,
  "issuing_authority": "Istituto Poligrafico e Zecca dello Stato",
  "issuing_country": "IT",
  "status": {
    "status_assertion": {
      "credential_hash_alg": "sha-256"
    }
  },
  "vct": "https://issuer.example.org/v1.0/disabilitycard",
  "vct#integrity": "2e40bcd6799008085ffb1a1f3517efee335298fd976b3e655bfb3f4eaa11d171",
  "document_number": "XXXXXXXXXX",
  "given_name": "Mario",
  "family_name": "Rossi",
  "birth_date": "1980-01-10",
  "expiry_date": "2024-01-01",
  "personal_administrative_number": "XX00000XX",
  "constant_attendance_allowance": true
}

The corresponding SD-JWT for the previous data is represented as follow, as decoded JSON for both header and payload.

{
  "typ":"dc+sd-jwt",
  "alg":"ES256",
  "kid":"d126a6a856f7724560484fa9dc59d195",
  "trust_chain" : [
   "NEhRdERpYnlHY3M5WldWTWZ2aUhm ...",
   "eyJhbGciOiJSUzI1NiIsImtpZCI6 ...",
   "IkJYdmZybG5oQU11SFIwN2FqVW1B ..."
  ]
}

{
  "_sd": [
    "Dx-6hjvrcxNzF0slU6ukNmzHoL-YvBN-tFa0T8X-bY0",
    "GE3Sjy_zAT34f8wa5DUkVB0FslaSJRAAc8I3lN11Ffc",
    "VQI-S1mT1Kxfq2o8J9io7xMMX2MIxaG9M9PeJVqrMcA",
    "Yrc-s-WSr4exEYtqDEsmRl7spoVfmBxixP12e4syqNE",
    "aBVdfcnxT0Z5RrwdxZSUhuUxz3gM2vcEZLeYIj61Kas",
    "o1cHG8JbEEYv0HeJINYKbFLd-TnEDUuNzI1XpzV32aU",
    "s1XK5f2pM3-aFTauXhmvd9pyQTJ6FMUhc-JXfHrxhLk",
    "zVdghcmClMVWlUgGsGpSkCPkEHZ4u9oWj1SlIBlCc1o"
  ],
  "iss": "https://issuer.example.org",
  "exp": 1883000000,
  "sub": "NzbLsXh8uDCcd7noWXFZAfHkxZsRGC9Xs",
  "issuing_authority": "Istituto Poligrafico e Zecca dello Stato",
  "issuing_country": "IT",
  "status": {
    "status_assertion": {
      "credential_hash_alg": "sha-256"
    }
  },
  "vct": "https://issuer.example.org/v1.0/disabilitycard",
  "vct#integrity": "2e40bcd6799008085ffb1a1f3517efee335298fd976b3e655bfb3f4eaa11d171",
  "_sd_alg": "sha-256",
  "cnf": {
    "jwk": {
      "kty": "EC",
      "crv": "P-256",
      "x": "TCAER19Zvu3OHF4j4W4vfSVoHIP1ILilDls7vCeGemc",
      "y": "ZxjiWWbZMQGHVWKVQ4hbSIirsVfuecCE6t4jT9F2HZQ"
    }
  }
}

In the following the disclosure list is given:

Claim iat:

• SHA-256 Hash: Yrc-s-WSr4exEYtqDEsmRl7spoVfmBxixP12e4syqNE

• Disclosure: WyIyR0xDNDJzS1F2ZUNmR2ZyeU5STjl3IiwgImlhdCIsIDE2ODMwMDAwMDBd

• Contents: ["2GLC42sKQveCfGfryNRN9w", "iat", 1683000000]

Claim document_number:

• SHA-256 Hash: Dx-6hjvrcxNzF0slU6ukNmzHoL-YvBN-tFa0T8X-bY0

• Disclosure: WyJlbHVWNU9nM2dTTklJOEVZbnN4QV9BIiwgImRvY3VtZW50X251bWJlciIs ICJYWFhYWFhYWFhYIl0

• Contents: ["eluV5Og3gSNII8EYnsxA_A", "document_number", "XXXXXXXXXX"]

Claim given_name:

• SHA-256 Hash: zVdghcmClMVWlUgGsGpSkCPkEHZ4u9oWj1SlIBlCc1o

• Disclosure: WyI2SWo3dE0tYTVpVlBHYm9TNXRtdlZBIiwgImdpdmVuX25hbWUiLCAiTWFy aW8iXQ

• Contents: ["6Ij7tM-a5iVPGboS5tmvVA", "given_name", "Mario"]

Claim family_name:

• SHA-256 Hash: VQI-S1mT1Kxfq2o8J9io7xMMX2MIxaG9M9PeJVqrMcA

• Disclosure: WyJlSThaV205UW5LUHBOUGVOZW5IZGhRIiwgImZhbWlseV9uYW1lIiwgIlJv c3NpIl0

• Contents: ["eI8ZWm9QnKPpNPeNenHdhQ", "family_name", "Rossi"]

Claim birth_date:

• SHA-256 Hash: s1XK5f2pM3-aFTauXhmvd9pyQTJ6FMUhc-JXfHrxhLk

• Disclosure: WyJRZ19PNjR6cUF4ZTQxMmExMDhpcm9BIiwgImJpcnRoX2RhdGUiLCAiMTk4 MC0wMS0xMCJd

• Contents: ["Qg_O64zqAxe412a108iroA", "birth_date", "1980-01-10"]

Claim expiry_date:

• SHA-256 Hash: aBVdfcnxT0Z5RrwdxZSUhuUxz3gM2vcEZLeYIj61Kas

• Disclosure: WyJBSngtMDk1VlBycFR0TjRRTU9xUk9BIiwgImV4cGlyeV9kYXRlIiwgIjIw MjQtMDEtMDEiXQ

• Contents: ["AJx-095VPrpTtN4QMOqROA", "expiry_date", "2024-01-01"]

Claim personal_administrative_number:

• SHA-256 Hash: o1cHG8JbEEYv0HeJINYKbFLd-TnEDUuNzI1XpzV32aU

• Disclosure: WyJQYzMzSk0yTGNoY1VfbEhnZ3ZfdWZRIiwgInBlcnNvbmFsX2FkbWluaXN0 cmF0aXZlX251bWJlciIsICJYWDAwMDAwWFgiXQ

• Contents: ["Pc33JM2LchcU_lHggv_ufQ", "personal_administrative_number", "XX00000XX"]

Claim constant_attendance_allowance:

• SHA-256 Hash: GE3Sjy_zAT34f8wa5DUkVB0FslaSJRAAc8I3lN11Ffc

• Disclosure: WyJHMDJOU3JRZmpGWFE3SW8wOXN5YWpBIiwgImNvbnN0YW50X2F0dGVuZGFu Y2VfYWxsb3dhbmNlIiwgdHJ1ZV0

• Contents: ["G02NSrQfjFXQ7Io09syajA", "constant_attendance_allowance", true]

The combined format for the (Q)EAA issuance is represented below:

eyJhbGciOiAiRVMyNTYiLCAidHlwIjogImRjK3NkLWp3dCIsICJraWQiOiAiZDEyNmE2
YTg1NmY3NzI0NTYwNDg0ZmE5ZGM1OWQxOTUifQ.eyJfc2QiOiBbIkR4LTZoanZyY3hOe
kYwc2xVNnVrTm16SG9MLVl2Qk4tdEZhMFQ4WC1iWTAiLCAiR0UzU2p5X3pBVDM0Zjh3Y
TVEVWtWQjBGc2xhU0pSQUFjOEkzbE4xMUZmYyIsICJWUUktUzFtVDFLeGZxMm84Sjlpb
zd4TU1YMk1JeGFHOU05UGVKVnFyTWNBIiwgIllyYy1zLVdTcjRleEVZdHFERXNtUmw3c
3BvVmZtQnhpeFAxMmU0c3lxTkUiLCAiYUJWZGZjbnhUMFo1UnJ3ZHhaU1VodVV4ejNnT
TJ2Y0VaTGVZSWo2MUthcyIsICJvMWNIRzhKYkVFWXYwSGVKSU5ZS2JGTGQtVG5FRFV1T
npJMVhwelYzMmFVIiwgInMxWEs1ZjJwTTMtYUZUYXVYaG12ZDlweVFUSjZGTVVoYy1KW
GZIcnhoTGsiLCAielZkZ2hjbUNsTVZXbFVnR3NHcFNrQ1BrRUhaNHU5b1dqMVNsSUJsQ
2MxbyJdLCAiZXhwIjogMTg4MzAwMDAwMCwgImlzcyI6ICJodHRwczovL2lzc3Vlci5le
GFtcGxlLm9yZyIsICJzdWIiOiAiTnpiTHNYaDh1RENjZDdub1dYRlpBZkhreFpzUkdDO
VhzIiwgImlzc3VpbmdfYXV0aG9yaXR5IjogIklzdGl0dXRvIFBvbGlncmFmaWNvIGUgW
mVjY2EgZGVsbG8gU3RhdG8iLCAiaXNzdWluZ19jb3VudHJ5IjogIklUIiwgInN0YXR1c
yI6IHsic3RhdHVzX2Fzc2VydGlvbiI6IHsiY3JlZGVudGlhbF9oYXNoX2FsZyI6ICJza
GEtMjU2In19LCAidmN0IjogImh0dHBzOi8vaXNzdWVyLmV4YW1wbGUub3JnL3YxLjAvZ
GlzYWJpbGl0eWNhcmQiLCAidmN0I2ludGVncml0eSI6ICIyZTQwYmNkNjc5OTAwODA4N
WZmYjFhMWYzNTE3ZWZlZTMzNTI5OGZkOTc2YjNlNjU1YmZiM2Y0ZWFhMTFkMTcxIiwgI
l9zZF9hbGciOiAic2hhLTI1NiIsICJjbmYiOiB7Imp3ayI6IHsia3R5IjogIkVDIiwgI
mNydiI6ICJQLTI1NiIsICJ4IjogIlRDQUVSMTladnUzT0hGNGo0VzR2ZlNWb0hJUDFJT
GlsRGxzN3ZDZUdlbWMiLCAieSI6ICJaeGppV1diWk1RR0hWV0tWUTRoYlNJaXJzVmZ1Z
WNDRTZ0NGpUOUYySFpRIn19fQ.L-km4kT5RCMVd9S5ZuVxINxfiSOksgcQNTGb71EhjF
fkqptx-upFnx3KEHHmGFoyftiT1ScKHBUiWvBj32MAYg~WyIyR0xDNDJzS1F2ZUNmR2Z
yeU5STjl3IiwgImlhdCIsIDE2ODMwMDAwMDBd~WyJlbHVWNU9nM2dTTklJOEVZbnN4QV
9BIiwgImRvY3VtZW50X251bWJlciIsICJYWFhYWFhYWFhYIl0~WyI2SWo3dE0tYTVpVl
BHYm9TNXRtdlZBIiwgImdpdmVuX25hbWUiLCAiTWFyaW8iXQ~WyJlSThaV205UW5LUHB
OUGVOZW5IZGhRIiwgImZhbWlseV9uYW1lIiwgIlJvc3NpIl0~WyJRZ19PNjR6cUF4ZTQ
xMmExMDhpcm9BIiwgImJpcnRoX2RhdGUiLCAiMTk4MC0wMS0xMCJd~WyJBSngtMDk1Vl
BycFR0TjRRTU9xUk9BIiwgImV4cGlyeV9kYXRlIiwgIjIwMjQtMDEtMDEiXQ~WyJQYzM
zSk0yTGNoY1VfbEhnZ3ZfdWZRIiwgInBlcnNvbmFsX2FkbWluaXN0cmF0aXZlX251bWJ
lciIsICJYWDAwMDAwWFgiXQ~WyJHMDJOU3JRZmpGWFE3SW8wOXN5YWpBIiwgImNvbnN0
YW50X2F0dGVuZGFuY2VfYWxsb3dhbmNlIiwgdHJ1ZV0~

MDOC-CBOR

The PID/(Q)EAA MDOC-CBOR data model is defined in ISO/IEC 18013-5, the standard born for the the mobile driving license (mDL) use case.

The MDOC data elements MUST be encoded as defined in RFC 8949 - Concise Binary Object Representation (CBOR).

The PID encoded in MDOC-CBOR format uses the document type set to eu.europa.ec.eudiw.pid.1, according to the reverse domain approach defined in the EIDAS-ARF and ISO/IEC 18013-5.

The document's data elements utilize a consistent namespace for the mandatory Mobile Driving License attributes, while the national PID attributes use the domestic namespace eu.europa.ec.eudiw.pid.it.1, as outlined in this implementation profile.

In compliance with ISO/IEC 18013-5, the MDOC data model in the domestic namespace eu.europa.ec.eudiw.pid.it.1, requires the following attributes:

Attribute name	Description	Reference
version	tstr (text string). Version of the data structure being used. It's a way to track changes and updates to the standard or to a specific implementation profile. This allows for backward compatibility and understanding of the data if the standard or implementation evolves over time.	[ISO 18013-5#8.3.2.1.2]
status	uint (unsigned int). Status code. For example "status":0 means OK (normal processing).	[ISO 18013-5#8.3.2.1.2.3]
documents	bstr (byte string). The collection of digital documents. Each document in this collection represents a specific type of data or information related to the Digital Credential.	[ISO 18013-5#8.3.2.1.2]

Each document within the documents collection MUST have the following structure:

Attribute name	Description	Reference
docType	tstr (text string). Document type. For the PID, the value MUST be set to eu.europa.ec.eudiw.pid.1. For an mDL, the value MUST be org.iso.18013-5.1.mDL.	[ISO 18013-5#8.3.2.1.2]
issuerSigned	bstr (byte string). It MUST contain the Mobile Security Object for Issuer data authentication and the data elements protected by Issuer data authentication.	[ISO 18013-5#8.3.2.1.2]

The issuerSigned object MUST have the following structure:

Attribute name	Description	Reference
nameSpaces	bstr (byte string) with tag 24 and major type 6. Returned data elements for the namespaces. It MAY be possible to have one or more namespaces. The nameSpaces MUST use the same value for the document type. However, it MAY have a domestic namespace to include attributes defined in this implementation profile. The value MUST be set to eu.europa.ec.eudiw.pid.it.1.	[ISO 18013-5#8.3.2.1.2]
issuerAuth	bstr (byte string). Contains Mobile Security Object (MSO), a COSE Sign1 Document, issued by the Credential Issuer.	[ISO 18013-5#9.1.2.4]

During the presentation of the MDOC-CBOR credential, in addition to the objects in the table above, a deviceSigned object MUST also be added. deviceSigned MUST NOT be included in the issued credential provided by the PID/(Q)EAA Issuer.

Attribute name	Description	Reference
deviceSigned	bstr (byte string). Data elements signed by the Wallet Instance during the presentation phase.	[ISO 18013-5#8.3.2.1.2]

Where the deviceSigned MUST have the following structure:

Attribute name	Description	Reference
nameSpaces	tstr (text string). Returned data elements for the namespaces. It MAY be possible to have one or more namespaces. It MAY be used for self-attested claims.	[ISO 18013-5#8.3.2.1.2]
deviceAuth	bstr (byte string). It MUST contain either the DeviceSignature or the DeviceMac element.	[ISO 18013-5#8.3.2.1.2]

Note

A deviceSigned object given during the presentation phase has two purposes:

1. It provides optional self-attested attributes in the nameSpaces object. If no self-attested attributes are provided by the Wallet Instance, the nameSpaces object MUST be included with an empty structure.

2. Provide a cryptographic proof attesting that the Holder is the legitimate owner of the Credential, by means of a deviceAuth object.

Note

The issuerSigned and the deviceSigned objects contain the nameSpaces object and the Mobile Security Object. The latter is the only signed object, while the nameSpaces object is not signed.

nameSpaces

The nameSpaces object contains one or more IssuerSignedItemBytes that are encoded using CBOR bitsring 24 tag (#6.24(bstr .cbor), marked with the CBOR Tag 24(<<... >>) and represented in the example using the diagnostic format). It represents the disclosure information for each digest within the Mobile Security Object and MUST contain the following attributes:

Name	Encoding	Description
digestID	integer	Reference value to one of the ValueDigests provided in the Mobile Security Object (issuerAuth).
random	bstr (byte string)	Random byte value used as salt for the hash function. This value SHALL be different for each IssuerSignedItem and it SHALL have a minimum length of 16 bytes.
elementIdentifier	tstr (text string)	Data element identifier.
elementValue	depends by the value, see the next table.	Data element value.

The elementIdentifier data that MUST be included in a PID/(Q)EAA are:

Namespace	Element identifier	Description
eu.europa.ec.eudiw.pid.1	issue_date	full-date (CBORTag 1004). Date when the PID/(Q)EAA was issued.
eu.europa.ec.eudiw.pid.1	expiry_date	full-date (CBORTag 1004). Date when the PID/(Q)EAA will expire.
eu.europa.ec.eudiw.pid.1	issuing_authority	tstr (text string). Name of administrative authority that has issued the PID/(Q)EAA.
eu.europa.ec.eudiw.pid.1	issuing_country	tstr (text string). Alpha-2 country code as defined in [ISO 3166].

Depending on the Digital Credential type, additional elementIdentifier data MAY be added. The PID MUST support the following data:

Namespace	Element identifier	Description
eu.europa.ec.eudiw.pid.1	given_name	tstr (text string). See PID Claims fields Section.
eu.europa.ec.eudiw.pid.1	family_name	tstr (text string). See PID Claims fields Section.
eu.europa.ec.eudiw.pid.1	birth_date	full-date (CBORTag 1004). See PID Claims fields Section.
eu.europa.ec.eudiw.pid.1	birth_place	tstr (text string). See PID Claims fields Section.
eu.europa.ec.eudiw.pid.1	nationality	tstr (text string). See PID Claims fields Section.
eu.europa.ec.eudiw.pid.it.1	personal_administrative_number	tstr (text string). See PID Claims fields Section.

Mobile Security Object

The issuerAuth represents the Mobile Security Object which is a COSE Sign1 Document defined in RFC 9052 - CBOR Object Signing and Encryption (COSE): Structures and Process. It has the following data structure:

• protected header

• unprotected header

• payload

• signature.

The protected header MUST contain the following parameter encoded in CBOR format:

Element	Description	Reference
Signature algorithm	-7 means ES256, SHA-256.	RFC8152

Note

Only the Signature Algorithm MUST be present in the protected headers, other elements SHOULD not be present in the protected header.

The unprotected header MUST contain the following parameter:

Element	Description	Reference
x5chain	Identified with the label 33	RFC 9360 CBOR Object Signing and Encryption (COSE) - Header Parameters for Carrying and Referencing X.509 Certificates.

Note

The x5chain is included in the unprotected header with the aim to make the Holder able to update the X.509 certificate chain, related to the Mobile Security Object issuer, without invalidating the signature.

The payload MUST contain the MobileSecurityObject, without the content-type COSE Sign header parameter and encoded as a byte string (bstr) using the CBOR Tag 24.

The MobileSecurityObjectBytes MUST have the following attributes:

Element	Description	Reference
docType	See Table.	[ISO 18013-5#9.1.2.4]
version	See Table.	[ISO 18013-5#9.1.2.4]
validityInfo	Object containing issuance and expiration datetimes. It MUST contain the following sub-value: signed validFrom validUntil	[ISO 18013-5#9.1.2.4]
digestAlgorithm	According to the algorithm defined in the protected header.	[ISO 18013-5#9.1.2.4]
valueDigests	Mapped digest by unique id, grouped by namespace.	[ISO 18013-5#9.1.2.4]
deviceKeyInfo	It MUST contain the Wallet Instance's public key containing the following sub-values. deviceKey (REQUIRED). keyAuthorizations (OPTIONAL). keyInfo (OPTIONAL).	[ISO 18013-5#9.1.2.4]

Note

The private key related to the public key stored in the deviceKey object is used to sign the DeviceSignedItems object and proof the possession of the PID during the presentation phase (see the presentation phase with MDOC-CBOR).

MDOC-CBOR Examples

A non-normative example of a PID in MDOC-CBOR format is represented below using the AF Binary encoding:

a366737461747573006776657273696f6e63312e3069646f63756d656e747381a267646f6354797065781865752e6575726f70612e65632e65756469772e7069642e316c6973737565725369676e6564a26a697373756572417574688443a10126a1182159021930820215308201bca003020102021404ad06a30c1a6dc6e93be0e2e8f78dcafa7907c2300a06082a8648ce3d040302305b310b3009060355040613025a45312e302c060355040a0c25465053204d6f62696c69747920616e64205472616e73706f7274206f66205a65746f706961311c301a06035504030c1349414341205a65746573436f6e666964656e73301e170d3231303932393033333034355a170d3232313130333033333034345a3050311a301806035504030c114453205a65746573436f6e666964656e7331253023060355040a0c1c5a65746f70696120436974792044657074206f662054726166666963310b3009060355040613025a453059301306072a8648ce3d020106082a8648ce3d030107034200047c5545e9a0b15f4ff3ce5015121e8ad3257c28d541c1cd0d604fc9d1e352ccc38adef5f7902d44b7a6fc1f99f06eedf7b0018fd9da716aec2f1ffac173356c7da3693067301f0603551d23041830168014bba2a53201700d3c97542ef42889556d15b7ac4630150603551d250101ff040b3009060728818c5d050102301d0603551d0e04160414ce5fd758a8e88563e625cf056bfe9f692f4296fd300e0603551d0f0101ff040403020780300a06082a8648ce3d0403020347003044022012b06a3813ffec5679f3b8cddb51eaa4b95b0cbb1786b09405e2000e9c46618c02202c1f778ad252285ed05d9b55469f1cb78d773671f30fe7ab815371942328317c59032ad818590325a667646f6354797065781865752e6575726f70612e65632e65756469772e7069642e316776657273696f6e63312e306c76616c6964697479496e666fa3667369676e6564c074323032332d30322d32325430363a32333a35365a6976616c696446726f6dc074323032332d30322d32325430363a32333a35365a6a76616c6964556e74696cc074323032342d30322d32325430303a30303a30305a6c76616c756544696765737473a2781865752e6575726f70612e65632e65756469772e7069642e31ac015820a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a025820cd372fb85148700fa88095e3492d3f9f5beb43e555e5ff26d95f5a6adc36f8e6035820e67e72111b363d80c8124d28193926000980e1211c7986cacbd26aacc5528d48045820f7d062d662826ed95869851db06bb539b402047baee53a00e0aa35bfbe98265d0658202a132dbfe4784627b86aa3807cd19cfeff487aab3dd7a60d0ab119a72e736936075820bdca9e8dbca354e824e67bfe1533fa4a238b9ea832f23fb4271ebeb3a5a8f7200858202c0eaec2f05b6c7fe7982683e3773b5d8d7a01e33d04dfcb162add8bd99bee9a095820bfe220d85657ccec3c67e7db1df747e9148a152334bb6d4b65b273279bcc36ec0a582018e38144f5044301d6a0b4ec9d5f98d4cd950e6ea2c29b849cbd457da29b6ad30b58203c71d2f0efa09d9e3fbbdffd29204f6b292c9f79570aef72dd86c91f7a3aa5c50c582065743d58d89d45e52044758f546034fd13a4f994bc270cdfa7844f74eb3f4b6e0d5820b4a8eb5d523bffa17b41bda12ddc7da32ae1e5f7ff3dcc394a35401f16919bbf781b65752e6575726f70612e65632e65756469772e7069642e69742e31a10e58209d6c11644651126c94acdaf0803e86d4c71d15d3b2712a14295416734efd514d6d6465766963654b6579496e666fa1696465766963654b6579a401022001215820ba01aea44eee1e338eb2f04e279dbd51b34655783ee185150838c9a7a7c4db7122582025ba0044439a3871a7b975a0994a85e79b705a9ac263b3fe899b0a93412ee8c96f646967657374416c676f726974686d675348412d32353658400813c28fd62f2602cbc14724e5865733c44a0fca589b55c085ec9d5c725d6cce25ba0044439a3871a7b975a0994a85e79b705a9ac263b3fe899b0a93412ee8c96a6e616d65537061636573a2781865752e6575726f70612e65632e65756469772e7069642e3188d818586da4686469676573744944016672616e646f6d5820156df9227ad341eaa61aabd301106fd21bdc18820e01dfc16bcf5fecc447111b71656c656d656e744964656e7469666965726b6578706972795f646174656c656c656d656e7456616c7565d903ec6a323032342d30322d3232d818586fa4686469676573744944026672616e646f6d5820a3a1f13f05544d03a5b50b5fdb78465808393bcf3b7953a345fe28f820c7be0d71656c656d656e744964656e7469666965726d69737375616e63655f646174656c656c656d656e7456616c7565d903ec6a323032332d30322d3232d8185866a4686469676573744944036672616e646f6d5820852591f90f2c9ded57a03632e2c1322ab52a082a431e71a4149a6830c8f1ad0c71656c656d656e744964656e7469666965726f69737375696e675f636f756e7472796c656c656d656e7456616c7565624954d818587ca4686469676573744944046672616e646f6d5820d1d587b3512acce15c4f6b20944ceb002a464e4a158389788563408873c3fce571656c656d656e744964656e7469666965727169737375696e675f617574686f726974796c656c656d656e7456616c7565764d696e69737465726f2064656c6c27496e7465726e6fd8185864a4686469676573744944056672616e646f6d582094fdd7609c0e73dc8589b5cab11e1d9058cf8bff8a336da5f81fcba055396a0f71656c656d656e744964656e7469666965726a676976656e5f6e616d656c656c656d656e7456616c7565654d6172696fd8185865a4686469676573744944066672616e646f6d5820660c0a7bf79e0e0261ca1547a4294fb808aa70738f424b13ab1b9440b566ae1371656c656d656e744964656e7469666965726b66616d696c795f6e616d656c656c656d656e7456616c756565526f737369d818586ba4686469676573744944076672616e646f6d5820315c53491286488fa07f5c2ce67135ef5c9959c3469c99a14e9b6dc924f9eba571656c656d656e744964656e746966696572696269727468646174656c656c656d656e7456616c7565d903ec6a313935362d30312d3132d818587da4686469676573744944086672616e646f6d5820764ef39c9d01f3aa6a87f441603cfe853fba3cee3bc2c168bcc9e96271d6e06371656c656d656e744964656e74696669657269756e697175655f69646c656c656d656e7456616c7565781e78787878787878782d7878782d787878782d787878787878787878787878781b65752e6575726f70612e65632e65756469772e7069642e69742e3181d8185877a46864696765737449440d6672616e646f6d5820717df3f583b1484366c33a1f869f2b5d201d466a8b589c79ab1a2d85e595432571656c656d656e744964656e7469666965726d7461785f69645f6e756d6265726c656c656d656e7456616c75657554494e49542d585858585858585858585858585858

The Diagnostic Notation of the above MDOC-CBOR is given below:

{     
    "status": 0,     
    "version": "1.0",     
    "documents": [        
    {             
      "docType": "eu.europa.ec.eudiw.pid.1",                         
      "issuerSigned": {                
          "issuerAuth": [                
          << {1: -7} >>, % protected header with the value alg:ES256                    
          {                         
              33: h'30820215308201BCA003020102021404AD30C…'% 33->X5chain:COSE X_509  
          },
          <<                       
              24(<<    
                  {                            
                  "docType": "eu.europa.ec.eudiw.pid.1",                                
                  "version": "1.0",  
                  "validityInfo": {                                
                      "signed": 0("2023-02-22T06:23:56Z"),                                     
                      "validFrom": 0("2023-02-22T06:23:56Z"),                                   
                      "validUntil": 0("2024-02-22T00:00:00Z")                               
                  },
                  "valueDigests": { 
                      "eu.europa.ec.eudiw.pid.1": {        
                          1: h'0F1571A97FFB799CC8FCDF2BA4FC2909929…',                                          
                          2: h'0CDFE077400432C055A2B69596C90…',     
                          3: h'E2382149255AE8E955AF9B8984395…',                                        
                          4: h'BBC77E6CCA981A3AD0C3E544EDF86…',                                     
                          6: h'BB6E6C68D1B4B4EC5A2AE9206F5t4…',
                          7: h'F8A5966E6DAC9970E0334D8F75E25…',
                          8: h'1F1A0F7CCDD79b29EB4B22F96F54F…',
                          9: h'1A0F7EEDB46B37AS4N22R96D83F3F…'
                      },
                      "eu.europa.ec.eudiw.pid.it.1": {  
                          10: h'F9EE4D36F67DBD75E23311AC1C29…'
                      }
                  },                             
                  "deviceKeyInfo": {                              
                      "deviceKey": {                                  
                          1: 2, % kty:EC2 (Eliptic curves with x and y coordinate pairs)           
                          -1: 1, % crv:p256                     
                          -2: h'B820963964E53AF064686DD9218303494A…', % x-coordiantes                                        
                          -3: h'0A6DA0AF437E2943F1836F31C678D89298E9…'% y-ccordiantes                                     
                      }                            
                  },                             
                  "digestAlgorithm": "SHA-256"    
                  }                       
              >>)                     
          >>,                        
          h'1AD0D6A7313EFDC38FCD765852FA2BD43DEBF48BF5A580D'                 
          ],                 
          "nameSpaces": {
              "eu.europa.ec.eudiw.pid.1": [                         
              24(<<    
                  {      
                  "digestID": 1,                                  
                  "random": h'E0B70BCEFBD43686F345C9ED429343AA',                                 
                  "elementIdentifier": "expiry_date",                                
                  "elementValue": 1004("2024-02-22")                             
                  }                         
              >>), 
              24(<<             
                  {       
                  "digestID": 2,                                  
                  "random": h'AE84834F389EE69888665B90A3E4FCCE', 
                  "elementIdentifier": "issue_date",   
                  "elementValue": 1004("2023-02-22")                                
                  }
              >>),                         
              24(<<   
                  {                              
                  "digestID": 3,                                 
                  "random": h'960CB15A2EA9B68E5233CE902807AA95',                               
                  "elementIdentifier": "issuing_country",                               
                  "elementValue": "IT"                                                    
                  }                       
              >>), 
              24(<<       
                  {                        
                  "digestID": 4,    
                  "random": h'9D3774BD5994CCFED248674B32A4F76A', 
                  "elementIdentifier": "issuing_authority",   
                  "elementValue": "Ministero dell'Interno"  
                  }   
              >>),                 
              24(<<        
                  {                              
                  "digestID": 5,                         
                  "random": h'EB12193DC66C6174530CDC29B274381F', 
                  "elementIdentifier": "given_name",
                  "elementValue": "Mario"                             
                  }                         
              >>),            
              24(<<                            
                  {                               
                  "digestID": 6,                             
                  "random": h'DB143143538F3C8D41DC024F9CB25C9D',
                  "elementIdentifier": "family_name",  
                  "elementValue": "Rossi"    
                  } 
              >>),                         
              24(<<               
                  {                          
                  "digestID": 7, 
                  "random": h'6059FF1CE27B4997B4ADE1DE7B01DC60',
                  "elementIdentifier": "birth_date",
                  "elementValue": 1004("1956-01-12")% the tag 1004 defines the value    
                    is a full date 
                  }  
              >>),
              24(<<               
                  {                          
                  "digestID": 8, 
                  "random": h'FX8VVN1YN6NBH3CKYPJTNPJIVJ5KDMFA',
                  "elementIdentifier": "birth_place",
                  "elementValue": "Roma"
                  }  
              >>),
              24(<<               
                  {                          
                  "digestID": 9, 
                  "random": h'RGLXZ5CHND8Y2UUMHXXMJWPCHNH9HVIX',
                  "elementIdentifier": "nationality",
                  "elementValue": "IT"
                  }  
              >>)			  
              ],
              "eu.europa.ec.eudiw.pid.it.1": [
                  24(<<
                      {
                      "digestID": 10, 
                      "random": h'11aa7273a2d2daa973f5951f0c34c2fbae',
                      "elementIdentifier": "personal_administrative_number", 
                      "elementValue": "XX00000XX"
                      }                         
                  >>)                    
              ]            
          }  
      }           
    }
    ]
  }