(7/30/26 Draft Version) Read Mobile Document - Command 0x1201

The host uses this command to start a mobile document transaction.

The sequence of events for transactions with device (mDOC Reader) enabled is roughly as follows.

The host composes a command request in the format below, and sends it to the device. It may cancel the transaction in process by calling Command 0x1008 - Cancel Transaction.

The device sends a response in the format below, and waits for the mDOC Holder (Apple, Android or other phones) to present a Data Engagement method, either QR Code or NFC. The data exchanged during the Data Engagement phase will be used to generate multiple keys for the encryption/decryption of mDOC messages. The ephemeral key generation algorith is defined in ISO-IEC-18013-5.

After the mDOC Holder presents data engagement method, the device sends Notification 0x0101 - Transaction Information Update to report the Data Engagement status. If Data Engagement phase has completed successfully, then go to the next step to handle Data Retrieval phase. Else, exit with failure.

The device will connect to the mDOC holder through BLE connection. The device will build the “mdoc request” message based on the settings of the command string below. The mDOC Holder will send back the “mdoc response" to the device. The device will decode the CBOR encoded response message.

The device will authenticate the “mdoc response" message with a pre-loaded certificate. The device will verify the SHA-256 hash of all the response items to validate the Data integrity. If the security validation has completed successfully, the device will send the results to the host through Notification 0x0101. Otherwise, the device will send a failure message through Notification 0x0101.

Host may set up the A4 TLVs to enable/disable/select the proper Audio Cue during operation.

Codes for Command 0x1201 - Read Mobile Document

AA 00                      	// marker
81 04 01 05 12 01          	// command 0x1201
84 40 12 01                	// command payload
81 01 00                   	// select name spaces, 0x00=ISO 18013-5 and AAMVA
82 01 1E                   	// timeout: 30 seconds
83 0C                      	// select bit mapped request items 
00 00 00 00 00 00 00 CD	    // ISO, Bit 0, 2, 3, 6, 7 are enabled
00 00 08 00                	// AAMVA, Bit 11 is enabled
85 01 00			              // Output Data security is disabled
A3 06                      	// reader options
83 01 01                   	// NFC reader is enabled 
85 01 01                   	// BCR reader is enabled
A4 1D				                // audio cue options
81 01 02			              // command mode
82 04 03B80040			        // Start engagement profile
83 08 01B8009603700096	    // Finish engagement profile
84 08 0370009600C80096	    // BLE transfer complete profile

Request Data for Command 0x1201- Read Mobile Document

Tag

Len

Value / Description

Typ

Req

Default

This parameter select the namespace to operate.

· 0x00 = ISO 18013-5 and AAMVA.

· 0x01 = ISO 23220-4.

· 0x02 to 0xFF = Reserved.

This parameter defines how long the device waits for the completion of this command.

· 0x00 = No timeout

· 0x01 to 0xFF = 1 to 255 seconds

This parameter defines the 96 bits (12 bytes) of bit mapped request items. (Note: At least 1 valid bit shall be enabled, else return error status.)

If the namespace of Tag 0x81 is 0x00, then V[0-B] bytes are:

· V[0] – V[3], Bit 63 – 32 for ISO 18013-5, Byte 7 – 4.

· V[4] – V[7], Bit 31 – 00 for ISO 18013-5, Byte 3 – 0.

· V[8] – V[B], Bit 31 – 00 for AAMVA. Byte 3 – 0.

If the namespace of Tag 0x81 is 0x01, then V[0-B] bytes are:

· V[0] – V[3], Bit 31 – 00 for ISO 23220-4, Byte 3 – 0.

· V[4] – V[B], 8 bytes are Reserved.

It defines the security of the 0xFD Data Container. If security is enabled, Data Container will be Encrypted and MACed.

· 0x00, security is disabled.

· 0x01, security is enabled.

Device Engagement Phase Options

The parameters inside this TLV data object allow the host to enable and disable the various interfaces to start engagement.

/83

NFC Mode

· 0x00 = Disabled

· 0x01 = Enabled

/85

QR Code Mode

· 0x00 = Disabled

· 0x01 = Enabled

· 0x02 = Onboard BCR Disabled, BCR data from Tag 86

var

BCR data (optional / required if Tag 85 is 02)

O/R

Audio Cue Options

/81

Device Audio Mode

0x00 = disabled

0x01 = auto

0x02 = command, the following 3 TLVs are required if the

value is 0x02

If set to 0x01 auto mode. The tone profiles are:

03B80040 // Start engagement

01B8009603700096 // Finish engagement

0370009600C80096 // BLE transfer complete

/82

Start engagement profile

4 bytes data parameter for each tone in the sequence

Byte0-Byte1 – Frequency in units of 1 Hz · 0x0000..0x0031 (< 50 Hz, Silent) · 0x0032 - Min (50 Hz)

Value / Description Typ Req · 0x0FA0 - Max (4000 Hz) · 0x0FA1..0xFFFF (> 4000 Hz, Error)

Byte 2-Byte3 – Duration of tone in units of 1 millisecond · 0x0001 – Min (1 ms) · 0xFFFF – Max (65535 ms)

O/R

/83

Finish engagement profile

2 set of data parameter for each tone as above

O/R

/84

BLE transfer complete profile

2 set of data parameter for each tone as above

O/R

Last updated 7 days ago