Data elements are grouped by namespace (for mDL, org.iso.18013.5.1) and each is wrapped as an IssuerSignedItem with a random salt. The Mobile Security Object (MSO) lists the digest of every item, the device public key, the document type and validity, and is signed by the issuer as a COSE_Sign1 with an X.509 document-signer certificate. At presentation, the holder sends only requested items plus a device signature or MAC over the session transcript.
In-person presentation uses device engagement over QR or NFC and a BLE, NFC or Wi-Fi Aware session (18013-5:2021); online presentation is covered by ISO/IEC TS 18013-7:2025 and by OpenID4VP and the browser Digital Credentials API. Apple Wallet and Google Wallet IDs, several US states' mDLs and the EU Digital Identity Wallet's person identification data use mdoc.
Verifiers need the issuing authorities' certificates (IACA roots), for example from the AAMVA Digital Trust Service or EU trusted lists. The mdoc inspector decodes a DeviceResponse locally.