mDL (mobile driver licence)
A driver licence issued as a digitally signed credential in a phone wallet — not a photo of a card. Defined by ISO/IEC 18013-5.
What is an mDL?Glossary
Digital identity, term by term
The vocabulary of credentials, biometrics and verification — defined in plain English, with links to where each idea shows up in practice.
mDLISO/IEC 18013-5ISO/IEC 18013-7IssuerHolderVerifierWalletTrust triangleSelective disclosureAge attestationDevice bindingDevice retrievalIACATrusted listMSOEngagementKMSOCRTemplate-free OCRKYCAML1:1 face matchLiveness detectionPresentation attackInjection attackPADDeepfakeVerifiable credentialeIDAS 2.0HID API
ISO/IEC 18013-5
The international standard for presenting and verifying an mDL in person — QR or NFC engagement, encrypted transfer, offline signature checks.
mDL verificationISO/IEC 18013-7
The companion standard for presenting an mDL online — the same signed credential, delivered to websites and apps instead of a reader.
Issuer
The authority that creates and signs a credential — a licensing body, government agency or an organisation issuing its own credentials.
Holder
The person a credential belongs to. They keep it in a wallet on their own device and approve every request to share it.
Verifier (relying party)
Whoever checks a credential — a venue, bank, agency or kiosk — by validating the issuer's signature and the device binding.
Wallet
The app that stores credentials on a holder's phone and handles consent — Apple Wallet, Google Wallet or a custom wallet.
Trust triangle
The issuer–holder–verifier model behind digital credentials: the issuer signs, the holder presents, the verifier checks — no live link between them needed.
Selective disclosure
Sharing only the fields a check needs — proving 'over 18' without revealing a birthdate or address.
Selective disclosure explainedAge attestation
A signed yes/no answer to an age question (like age_over_18) carried inside an mDL, so age checks never need the actual date of birth.
Device binding
Cryptographically tying a credential to keys inside the phone it was issued to, so a copied credential file is designed not to verify elsewhere.
Device retrieval (offline verification)
The ISO/IEC 18013-5 mode where credential data moves phone-to-reader over BLE or NFC and is verified locally — no internet, no call to the issuer.
Offline verification explainedIACA
Issuing Authority Certificate Authority — the root certificate an issuing authority uses to anchor trust in the credentials it signs.
Trusted list (VICAL)
A signed list of issuer certificates a reader loads in advance, letting it verify credentials from every listed authority while offline.
MSO (Mobile Security Object)
The signed structure inside an mDL that carries hashes of each data field — the mechanism that lets single fields be disclosed and still verified.
Engagement
The first step of an mDL presentation: a QR scan or NFC tap that exchanges connection details only — never licence data.
KMS (Key Management System)
The system that generates, stores and rotates the cryptographic keys an issuer signs credentials with — with a full audit trail.
OCR (optical character recognition)
Reading text from images. Identity OCR extracts the fields on licences, passports and ID cards into structured data.
ID Document OCRTemplate-free OCR
OCR that reads a document without per-layout configuration — new document designs work without anyone building a template first.
KYC (Know Your Customer)
The identity checks regulated businesses run before serving a customer — document verification, biometrics and screening.
KYC onboarding use caseAML (Anti-Money Laundering)
The regulatory regime KYC sits inside — obligations to verify identity, monitor activity and report suspicious behaviour.
1:1 face match (verification)
Comparing one live face against one reference photo — 'is this the person on the credential?' — as opposed to searching a database.
Face RecognitionLiveness detection
A check that a real, present person is in front of the camera — designed to stop photos, screen replays, masks and injected video.
Liveness DetectionPresentation attack
Showing something fake to a real camera — a printed photo, a replayed video on a screen, or a mask.
Injection attack
Bypassing the camera entirely by feeding pre-recorded or synthetic video into the verification session, often through a virtual camera.
PAD (ISO/IEC 30107-3)
Presentation attack detection, and the international standard for testing it — the benchmark independent labs test liveness systems against.
Deepfakes vs livenessDeepfake
Synthetic audio or video generated to impersonate a real person — the sharpest driver of injection attacks on remote identity checks.
Verifiable credential
The general model behind mDLs: a claim signed by an issuer that anyone can verify cryptographically. W3C publishes a widely used data model.
eIDAS 2.0
The EU framework requiring member states to offer citizens digital identity wallets — a major driver of credential adoption in Europe.
HID API
An integration path where a reader appears as a standard input device — no drivers to install, ideal for locked-down or legacy hosts.
DevelopersMissing a term you were looking for?
Tell us what tripped you up and we'll add it — and if you're weighing up a project, we're happy to translate the jargon live.
Ask us directly