Mobile driver’s licenses (mDLs) have been on the horizon for years—but mostly as a small, hazy speck at the far edge of a distant hill, rather than a near-term priority. That’s changing fast, however, as several preconditions for mDLs click into place in short order.

In June 2021, Apple announced it would support mDLs on the company’s iPhones. A couple months later, the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) jointly published its mDL standard. Then in March, the federal Transportation Security Administration (TSA) announced it would start to honor compliant mDLs at certain airports.

The surge in activity represents “a massive acceleration,” says Eric Jorgensen, director of the Motor Vehicle Division within the Arizona Department of Transportation. In March, Arizona became one of the first AAMVA jurisdictions to offer ISO-compliant mDLs.

“I would expect that we’ll begin to see mainstreaming of this in the next one to three years, to where this is a fairly normal thing,” Jorgensen says.

For that to happen, jurisdictions must not only embrace mDLs, but also agree on a framework for interoperability. The centerpiece of those efforts is a digital trust service (DTS): a secure, centralized online clearinghouse where issuing authorities can submit the public keys associated with the mDLs they have issued, which verifiers such as the TSA can then access. Without a trusted, nationwide DTS in place, there’s a ceiling on the potential of mDLs.

“If the Arizona mDL is different from California’s, and we have to create different apps and different physical devices to consume them—hey, that’s not gonna work for us,” says Jason Lim, identity management capability manager at the TSA. “That’s why interoperability that caters to the trust and security and privacy of the mDL is paramount.”

AAMVA is taking the lead in building the DTS, convening key state, federal and industry stakeholders to determine the project’s scope and key deliverables, and now preparing to build out the product itself. The first working version, which is scheduled for development this summer and will be followed by a months-long pilot project, will focus on fleshing out the requirements for DTS participation, as well as instituting and testing operational procedures and soliciting feedback from select verifiers.

That promise of cross-jurisdictional interoperability is convincing some states that have thus far stayed on the mDL sidelines to move ahead.

“It’s a ‘build it and they will come’  kind of thing, and the digital trust service is the key,” says Boyd Dickerson-Walden, chief information officer and director of the Division of Information Systems Administration at the Florida Department of Highway Safety and Motor Vehicles. “We don’t want our relying parties in the state to have to deal with every jurisdiction in order to get what they need to unlock the mobile driver’s license. [With the DTS] they can do it in one location.”

Dickerson-Walden’s team has experimented with mDLs for years, including building an app so verifiers could experiment with the tech. But he’s been waiting for the publication of the ISO standard and the release of the DTS before pushing forward.

“When the digital trust service comes along, that’s when we’ll probably go full scale. That’s when we say, ‘Hey, relying parties—help us get this thing adopted,” Dickerson-Walden says.

Under the Hood of the DTS

Here’s how the DTS works: Before an issuing authority such as a state motor vehicle agency creates mobile driver’s

licenses, it creates two cryptographically generated keys—one public, one private. When it issues an mDL, it signs the information with the private key. When a citizen presents an mDL at an airport, for example, the TSA would use the appropriate public key, which it would have retrieved from the DTS beforehand, to authenticate the mDL.

“The digital trust service is a broker between the issuing authorities and the relying parties,” says Loffie Jordaan, a business solutions architect at AAMVA and a leader of the DTS project. “A relying party can just come to the digital trust service, download that one list, and then authenticate an mDL using the appropriate public key inside against the [DTS] list.”

The DTS also serves several other critical functions. For one, it verifies the legitimacy of all of the included public keys, ensuring that bad actors aren’t able to impersonate issuing authorities, and haven’t slipped fraudulent public keys into the system. Second, the DTS maintains the integrity of the public key list by allowing in only issuing authorities that meet standard-compliant security protocols.

“It creates trust, because your participation in the DTS asserts that you’ve met certain criteria,” says Arizona’s Jorgensen.

Third, the DTS checks the quality and consistency of the keys themselves. That’s a crucial component, because mDLs have to be alike in order to work—unlike traditional driver’s licenses, which generally are useful to verifiers in different jurisdictions even though their formats may differ.

“In the digital world, unless the mDL and the reader speak exactly the same language, you don’t have interoperability. They have to follow the exact same interface standard,” stresses Jordaan.

The publication of the ISO mDL standard helped pave the way for the DTS, but there remained enough details to iron out—the requirements for IT infrastructure, and how keys are handled during the issuance process, for example—that part of AAMVA’s work involved building consensus on those issues.

“It’s bringing [stakeholders] together and having everybody kind of head-nod [around standards] that we as an ecosystem should implement and integrate,” says the TSA’s Lim.

Now, with those conversations mostly complete, the focus turns to building and testing the DTS—and then adding to the number of jurisdictions willing to use it.

Critical Data, Critical Mass

In addition to the literal construction of the DTS, the next step is bringing a critical mass of issuers and verifiers into the coalition that will begin using the system. That work began when a range of government and industry stakeholders agreed that AAMVA should lead the DTS’s development as an expert independent party.

The DTS presents “a complex issue of governance, and that’s why we’re very pleased that AAMVA is taking on that [leadership] role,” says the TSA’s Lim. “A relying party like the TSA doesn’t want to have to have a key-management relationship with every single issuing authority because that would soon become very difficult to manage. So having a centralized [public key directory] that’s managed under one governance…it just makes the whole ecosystem go.”

The infrastructure should be ready soon. Will the user base follow?

Project leaders are expecting several jurisdictions to sign on quickly once the DTS is ready to roll out. Still, “adoption is absolutely the number one challenge in my mind,” says Ray Kimble, CEO of identity-management firm Kuma, a consultant on the DTS project.

Kimble believes that if the DTS can deliver on its promise, adoption will follow. The first step was the ISO standard, and now he expects the arrival of the DTS will spur a wave of buy-in.

“Whenever you have a standard, oftentimes the market rallies around it,” says Kimble. “That’s what we’re starting to see happen.”

Compared to the alternative—a raft of ad-hoc, jurisdiction-specific solutions—the interoperability promised by DTS “will ultimately win out and prove much more efficient for market building,” Kimble says.

Learn more about how jurisdictions are preparing to use mDLs for air travel at tinyurl.com/mr43bhh7.

For more information on the digital trust service, listen to our podcast at tinyurl.com/bdzzxh4x.