Wire protocol

The SMART request, inside an ItemsRequest VRQ-1 VRQ-2 VRQ-3

The SMART request JSON rides as a text string in requestInfo. The mdoc part asks for the one element, and its boolean is intentToRetain: true only if the Verifier may keep the response after the session. The whole ItemsRequest is CBOR-encoded and wrapped in tag 24, which fixes the exact bytes that reader authentication later signs.

ItemsRequest = {
  docType:    "org.smarthealthit.checkin.1",
  nameSpaces: { "org.smarthealthit.checkin": { smart_health_checkin_response: intentToRetain } },
  requestInfo: { "org.smarthealthit.checkin.request": "<SMART request JSON text>" }
}
ItemsRequestBytes = tag24(CBOR(ItemsRequest))

A fresh HPKE key and encryptionInfo VRQ-4 VRQ-5

A new P-256 key pair and a random nonce (16 bytes or more) for this request. The public key goes to the wallet inside encryptionInfo; the private key never leaves the page. The Verifier keeps the exact base64url string it sends, because the transcript is computed from that string VRQ-9.

EncryptionInfo = ["dcapi", {
  nonce:              bstr,
  recipientPublicKey: { 1: 2, -1: 1, -2: x, -3: y }   // COSE_Key, EC2 P-256
}]

Reader authentication, if used VRQ-6 RA-1

Optional. The Verifier signs ReaderAuthenticationBytes, which covers this session's SessionTranscript and the exact ItemsRequestBytes, with a key whose certificate goes in x5chain. A wallet that checks it puts the result in one of five states (absent, malformed, invalid, valid but untrusted, trusted) and shows a verifier identity only when trusted TRUST-2. It never stops the exchange WRQ-9. Without a deployment trust list, "valid but untrusted" is the normal result.

DeviceRequest, then the browser call VRQ-7 VRQ-8

DeviceRequest = { version: "1.0", docRequests: [{ itemsRequest: ItemsRequestBytes, readerAuth? }] }

navigator.credentials.get({
  mediation: "required",
  digital: { requests: [{ protocol: "org-iso-mdoc",
    data: { deviceRequest: base64url(DeviceRequest), encryptionInfo: base64url(EncryptionInfo) } }] }
})

Set a timeout on the call VRQ-10. On some platforms a failed delivery never settles the call (timeouts).

The issuer-signed item and its digest WRS-1

IssuerSignedItem = { digestID: 0, random: 16+ random bytes,
  elementIdentifier: "smart_health_checkin_response", elementValue: "<SMART response JSON text>" }
IssuerSignedItemBytes = tag24(CBOR(IssuerSignedItem))
digest = SHA-256(IssuerSignedItemBytes)          // tag included

Receivers hash these bytes exactly as received and never re-encode them ENC-2.

The MSO and issuerAuth WRS-2 WRS-3 WRS-4

MSO = { version: "1.0", digestAlgorithm: "SHA-256", docType: "org.smarthealthit.checkin.1",
  valueDigests:  { "org.smarthealthit.checkin": { digestID: digest } },
  deviceKeyInfo: { deviceKey: COSE_Key },
  validityInfo:  { signed, validFrom, validUntil } }     // tag-0 UTC date-times, no fractions
issuerAuth = COSE_Sign1(protected {1: -7}, unprotected {33: x5chain}, payload tag24(CBOR(MSO)))

The certificate in x5chain may be self-signed.

The device signature, detached WRS-5 WRS-6

DeviceAuthentication = ["DeviceAuthentication", SessionTranscript, "org.smarthealthit.checkin.1",
                        DeviceNameSpacesBytes]           // SessionTranscript as the array, not bytes
deviceSignature = COSE_Sign1(protected {1: -7}, payload null)
                  signed over tag24(CBOR(DeviceAuthentication)) with the MSO's deviceKey

The payload is null; the verifier rebuilds the signed bytes from its own transcript. DeviceNameSpacesBytes is tag24(CBOR({})).

The DeviceResponse WRS-7

DeviceResponse = { version: "1.0", status: 0, documents: [{
  docType: "org.smarthealthit.checkin.1",
  issuerSigned: { nameSpaces: { "org.smarthealthit.checkin": [IssuerSignedItemBytes] }, issuerAuth },
  deviceSigned: { nameSpaces: DeviceNameSpacesBytes, deviceAuth: { deviceSignature } } }] }

Every structure is defined in CDDL in §8.7; which bytes each hash and signature covers is in the table in §8.6.