mdoc-structure-function

mDoc structure facilitates offline verification by embedding the issuer's signature and revocation data directly into the document. This allows verifiers to cryptographically validate the issuer's authenticity and the data integrity without requiring a live network connection to the issuing authority.

Device authentication in mDocs uses either a device signature or ECDH MAC to prove the holder's possession of the credential. The signature method provides non-repudiation, while the ECDH MAC method establishes a secure channel that specifically prevents replay and anti-cloning attacks during presentation.

An MSO structure within an ISO 18013-5 mDoc payload contains the issuer's digital signature, namespace mappings, and element digests. It organizes the credential's claims and cryptographic proofs, forming the foundational structure required for constructing valid mDoc presentations.

You can decode and verify a signed mDoc payload using ISO 18013-5 specifications by parsing the MSO structure and validating the issuer's signature. This process confirms the integrity of namespaces and element digests, ensuring the digital identity data has not been tampered with.

To construct an mDoc presentation for digital identity verification, you assemble the required namespaces and element digests from the MSO, apply selective disclosure via salted hashes, and generate the device authentication signature or MAC to protect against replay.