Mobile Driver's License Criteria: Difference between revisions
Jump to navigation
Jump to search
| Line 38: | Line 38: | ||
* Full enforcement of the REAL ID regulation begins October 1, 2021 (note that his date has already been extended innumerable times.) | * Full enforcement of the REAL ID regulation begins October 1, 2021 (note that his date has already been extended innumerable times.) | ||
* Examples of security requirements applicable to physical cards include ‘‘common machine-readable technology’’ and ‘‘security features designed to prevent tampering, counterfeiting, or duplication . for fraudulent purposes. (i.e. ISO 18013-1 plus a few embellishments.) | * Examples of security requirements applicable to physical cards include ‘‘common machine-readable technology’’ and ‘‘security features designed to prevent tampering, counterfeiting, or duplication . for fraudulent purposes. (i.e. ISO 18013-1 plus a few embellishments.) | ||
* Good security practices in creating an implementing the distribution. | |||
==Responses to RFC== | ==Responses to RFC== | ||
Revision as of 20:55, 19 April 2021
Full Title or Meme
The Mobile Driver's License Criteria for a high level of Identity and Authentication Assurance.
Context
- The issuance of ISO 18013-5 for a Mobile Driver's License an increasing level of trials towards getting driver's licenses installed on Smartphones.
- The US Office of Strategy, Policy and Planns, of the Department of Homeland Security (DHS) has issued a RFC for security standards and requirements to enable Federal agencies to accept them if compliant with the REAL ID. Comments are due by 2021-06-18.
- This includes comments relating to the economic, privacy, security, environmental, energy, or federalism impacts that might result from a future rulemaking based on input received as a result of this RFI.
- Also see the companion document on Mobile Driver's License for a view that includes issues like privacy and consent, which are not addressed here.
- There are 49 states that accept driver's license on smartphones for some purposes.
- Report from the Privacy & Identity Protection in mobile Driving License ecosystems Discussion Group working draft.
- Google announced (2020-11-04) privacy-preserving features in Android's Mobile Driving License framework including the credential API in Android 11.
- The Kantara's discussion group on Privacy and Identity in the mobile driver' license aka PImDL focus is now on North America where individual provinces and states are responsible for issuing Identity Cards based for a wide variety of purposes beyond just the attributes present on a driver's license.
Actors
- Holder - the subject of the Mobile Driver's License
- Reader - a device that can read and verify the mDL, which is presumably hosted in a native smart phone app
- Issuing Authority - typically a state motor vehicle agency.
- Trust Authority - some sort of wide ranging list of valid participators - not well defined at this point.
- Caution on terms. mDL and mDL app get conflated in the specs. The full mDL is seldom/never released by the app to the reader/verifier.
- Compare there terms Verifiable Credential and Presentation Exchange from the DIF folk. The VC (like the mDL or mdoc) may be in the smartphone, but only a part is "presented" to the reader.
- Digital identity is generally recognized as the digital representation of an individual in an electronic transaction. (from RFC).
- An mDL is a digital representation of the identity information contained on a state-issued physical DL/ID. (from RFC).
Use Cases
- TSA acceptance at transportation check-in lines.
- Building access for many Federal buildings.
- Mobile_Driver's License in Healthcare
- State Issued ID for Healthcare on this wiki lists other uses states might have for the mDL standard format.
- Currently kiosks have been deployed that accept ISO 18013 compatible Driver's License cards. The same capability is likely to be required for ISO 18013-5 Mobile Driver's Licenses.
Problems
- REAL ID has yet to approve a single state's Mobile Driver's License (mDL) for Federal access.
- Supply Chain for components of the mDL has not been a part of existing criteria, but needs to be included based on the Solar Winds attack of government and commercial access.
The REAL ID Act
- The Act set minimum requirements for state-issued DL/ID accepted by Federal agencies for official purposes, including accessing Federal facilities, boarding federally regulated commercial aircraft, entering nuclear power plants, etc.
- Full enforcement of the REAL ID regulation begins October 1, 2021 (note that his date has already been extended innumerable times.)
- Examples of security requirements applicable to physical cards include ‘‘common machine-readable technology’’ and ‘‘security features designed to prevent tampering, counterfeiting, or duplication . for fraudulent purposes. (i.e. ISO 18013-1 plus a few embellishments.)
- Good security practices in creating an implementing the distribution.