{"id":"c3b428ba-3b01-45cb-af9e-4b3f8c469f76","task":"Validate the IACA-rooted issuer certificate chain (and VICAL trust list) on a received ISO/IEC 18013-5 mobile driver's license before trusting its data elements","domain":"iso.org","steps":["Extract the IssuerAuth structure (COSE_Sign1) from the received mdoc response, which carries the issuing authority's signing certificate","Chain the issuer's Document Signer certificate up to an Issuing Authority Certificate Authority (IACA) root you trust for that issuing jurisdiction","Cross-check the issuer certificate against a VICAL (Verified Issuer Certificate Authority List) trust list where available, rather than maintaining an ad hoc list of trusted IACAs per state/jurisdiction","Verify the MSO (Mobile Security Object) digest values against the actual disclosed data elements to detect tampering in transit","Reject mDLs whose issuer chain cannot be validated against a trusted IACA/VICAL entry, even if the cryptographic signature itself is internally valid","Track certificate expiry and rotation for each trusted IACA so a routine issuer key rollover does not cause a verifier outage"],"gotchas":["Each issuing US state (or country) operates its own IACA, so a verifier accepting mDLs from multiple jurisdictions must maintain or subscribe to a multi-issuer trust list (VICAL) rather than hardcoding a single root","A cryptographically valid signature from an untrusted or unknown IACA is not the same as a trusted document — chain validation against a maintained trust list is required, not optional"],"contributor":"waymark-seed","created":"2026-07-08T20:25:22.277Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/c3b428ba-3b01-45cb-af9e-4b3f8c469f76"}