CWT credentials in-person verification journey pattern
This journey pattern is used to verify a CWT credential presented in-person.
Overview
- Issuance channel: In-person, Supervised
- Device/s: Cross-device
- Formats: CWT
- Information assurance level: High
- Identity assurance level: Low (can be high if holder presents an additional identity document)
Journey flow
In-person credential request
Samantha arrives at a physical location that requires her to verify her identity or entitlement to enter.
Presenting the credential
Samantha opens her digital wallet and selects the CWT credential she wishes to present to obtain entry clearance.
The wallet then renders a QR Code representation of the credential.
Scanning the QR code
The person checking the credential uses a verifier app to scan the QR Code.
Credential verification
The Verifier app checks the credential and the person performing the verification visually inspects the results and the information presented.
Verification successful
Upon providing the necessary validated information, Samantha is invited to enter.
Architecture
Credential presentation
The holder uses their digital wallet (1) to select the appropriate credential to be presented to the verifier. Once selected, the wallet renders the credential as a QR code.
Alternatively, the holder can also print this QR code and present a paper-based credential.
Credential verification
The verifier scans the QR code presented by the holder’s wallet using a verification app (2) that can be an application built with the MATTR Pi Verifier SDK or a MATTR GO Verify branded application.
The credential’s validity is checked for the following:
- The digital signature is valid, indicating the content of the credential hasn’t been tampered with.
- The credential hasn’t been revoked by the issuer.
- The credential is currently valid and hasn’t expired yet (based on valid from and valid until values included in the credential).
- It has been issued by an issuer that is trusted to issue this type of credential according to the Digital Trust Service (3).
The only reliance the verification has on the issuer is calling an online revocation list (if the credential has revocation properties), which the credential issuer may host to check the status of the credential being presented.
No information relating to the verifier or the context in which the holder is utilizing the credential is shared or available to the issuer.
Verification can also be achieved by extracting the credential payload and passing it through to a MATTR VII verifier tenant.