Glossary

Terms as the paper defines them, in Appendix A.

Access attestation envelope: A presentation-time artifact, generated at the verifier, that records that a credential presentation occurred, what was disclosed, against what credential, and what the verifier determined. Distinct from a stored credential.
Attestation: A statement, made at the access boundary, about a credential presentation and its access-relevant meaning.
CBOR: Concise Binary Object Representation, the binary data format standardized in RFC 8949. The Foundation publishes a profile constraining CBOR for access devices.
COSE: CBOR Object Signing and Encryption, standardized in RFC 9052. The Foundation’s envelope uses the COSE_Sign1 signature structure.
Credential, ecosystem-issued: A credential issued by a recognized authority, a government, an ecosystem authority, under that authority’s own trust infrastructure. Mobile driver’s licenses, digital passports, and eIDAS credentials are ecosystem-issued.
Credential, NFID-aligned: A credential issued under a Foundation-published schema, for cases where an ecosystem-issued credential is not appropriate or available. Uses the W3C Verifiable Credentials Data Model 2.0.
Decentralized Identifier (DID): An identifier syntax defined by the W3C, used in Foundation-published schemas where appropriate.
Document Signer Certificate (DSC): In the mobile driver’s license trust path, the certificate that signs the credential, itself issued by an Issuing Authority Certificate Authority.
Dual-path trust model: The Foundation’s model for handling ecosystem-issued credentials and NFID-aligned credentials, each through its own trust path.
Issuing Authority Certificate Authority (IACA): In the mobile driver’s license trust path, the per-jurisdiction certificate authority that issues Document Signer Certificates.
mdoc: The mobile document data model defined in ISO/IEC 18013-5, the structural foundation of the mobile driver’s license and the data model the Foundation anchors on.
Selective disclosure: The capability of a credential holder to present a subset of a credential’s attributes rather than the whole document.
Trust extension: A governed event, recorded in the registry and signed by Foundation governance keys, by which trust is extended to a category of issuer under published rules.
Verifiable registry: The Foundation’s registry: a public reference holding trust anchors, ratified schemas, and trust events, specified as a verifiability contract over a storage-agnostic backend.
Verifier: The party at the access boundary that consumes a presented credential, generates an attestation envelope, resolves trust through the registry, and participates in the access decision.