IssuerAuth requires tagged MobileSecurityObjectBytes and a valid MSO

ISO/IEC 18013-5 §9.1.2.4MUSTRoles: wallet, verifier

Requirement as recorded in the ProtocolSoup registry

IssuerAuth verification requires tagged MobileSecurityObjectBytes and a valid MSO version, digest algorithm, document type, device key, namespaces, digests, and ordered validity interval.

Read §9.1.2.4 in ISO/IEC 18013-5

Self-test verdict

PassCommit 97df6a8Evaluated 2026-10-11

This is ProtocolSoup's result against its own implementation at the commit shown. It is not a certification of ProtocolSoup or of any other product.

Tests

TestVerifyIssuerSignedRejectsBareMSOPayload
./internal/mdoc
Pass
TestVerifyIssuerSignedRejectsInvalidMSOFields
./internal/mdoc
Pass

Implementation

backend/internal/mdoc/mso.go
backend/internal/mdoc/verify.go

Related requirements

MDOC-003Duplicate element identifiers rejected and value digests verified MDOC-005Document-signer certificates chain to an IACA root per Annex B

All ISO/IEC 18013-5 requirements · OID4VCI protocol page