NIST turns its mDL work from the technology to the harder half: adoption

Speaking at an NCCoE Cybersecurity Connections event, NIST identity program lead Ryan Galluzzo made a quietly telling pivot: the hard part of mobile driver’s licenses is no longer the cryptography. As Biometric Update reports, NIST and the National Cybersecurity Center of Excellence are shifting emphasis from building the mDL stack to getting relying parties to actually use it. “One of the challenges we observed is that not many relying parties know what to do with this technology yet,” Galluzzo said. “They haven’t figured out how to implement that technology within their online workflows.”

The concrete output is a sequence of NCCoE use-case builds. The high-assurance financial-services build — prompted by a fraud spike — is complete; a government-services build, anchored on SP 800-63-3 and run with Login.gov and the states of Maryland and Georgia, is in progress; healthcare comes last. The practice guide SP 1800-42A is already out for public comment, and the mDL CRADA consortium now spans Idemia, 1Password, Microsoft, Google, the OpenID Foundation, and a raft of state DMVs and issuers.

For a trust-and-identity reader, the signal isn’t the technology — it’s the framing. NIST is effectively conceding that verifiable credentials succeed or fail on relying-party readiness and public comprehension, not on the standard being sound. NCCoE security engineer Bill Fisher’s aside that generative AI has already leapfrogged biometric authentication tools “less than five or ten years old” is the same fraud pressure driving every other thread on this beat, and a reminder that the assurance goalposts keep moving under everyone deploying against them.

The honest note comes at the end: asked their opinion on mDL, the average U.S. citizen still answers “what’s that?” Half of adoption is what you build; the other half is explaining it — a discipline the standards world has historically outsourced to nobody in particular.