NIST has published an explainer on how holders present verifiable digital credentials and how verifiers check them, clarifying attended versus remote verification for federal identity teams.

The June 30 post, by NIST’s Bill Fisher, Ryan Galluzzo, and Heather Flanagan, is the fourth entry in the agency’s Verifiable Digital Credentials blog series. It contrasts two ISO/IEC specifications for mobile driver’s license presentment. Under ISO/IEC 18013-5, a credential is shown during an attended, in-person check: a device-to-device link is initiated by NFC or a scanned QR code, with data transmitted over BLE, NFC, or Wi-Fi Aware. ISO/IEC 18013-7 builds on that to handle remote presentation over the internet, usually launched from a QR code.

The authors use everyday examples, a TSA checkpoint confirming a traveler’s identity, or a point-of-sale terminal receiving only a yes/no answer on whether a buyer is over 21. Each relies on a cryptographic response that discloses the minimum attribute rather than the full credential.

For federal architects working under OMB M-22-09 and NIST SP 800-63, this distinction is important. As agencies weigh wallet-based, verifiable credentials alongside PIV and FICAM modernization, knowing which specification fits physical access versus citizen-facing online services helps scope reader hardware and wallet interoperability in procurement.

One caveat: this is a blog explainer, not a Special Publication, draft, or mandate. NIST notes not all issued mDLs sit in wallets supporting both models. Treat the post as an educational resource, not a compliance requirement.

Source: NIST Cybersecurity Insights