Part 5: Verifiers

Implementation Decisions

Before the requirements in this part can be assessed, the responsible parties must specify:

• Security baseline standard (SEDI-VER-01): references a recognized security framework for verifier systems

SEDI-VER-01: Identity protection safeguards

Incorporate state-of-the-art safeguards for protecting an individual's identity in the verification process.

Utah Code § 63A-20-501(1)(a)

Requirement: The verification system SHALL implement current best-practice security controls. Attribute data received during verification SHALL be protected in transit and at rest.

Criticality: Critical — Weak verification security would expose holder attribute data during the most sensitive phase of the presentation flow.

Roles: Verifiers

Assessment Objectives

Determine if:

1. attribute data received during verification is encrypted in transit using current best-practice protocols;
2. attribute data is protected at rest when temporarily held during the verification transaction;
3. no persistent storage of attribute data occurs beyond the immediate transaction needs;
4. the verification system implements current best-practice security controls as defined by the organization's security baseline standard.

Verification Methods

Objective coverage: AUTO → 1, 2, 3; EXPT → 2, 4; ADMN → 4

Assessment objects: verification endpoint source code and configuration; TLS/encryption configuration for verification channels; attribute data handling and storage implementation; verification transaction logs (redacted); security baseline policy document; security certifications and third-party attestation reports.

Statutory compliance: Automated testing is mandatory because encryption and data handling protections are deterministic technical properties verifiable through protocol testing.

SEDI-VER-02: Technological compliance

Comply with the requirements of this part through technological means where possible.

Utah Code § 63A-20-501(1)(b)

Requirement: Compliance with Part 5 requirements SHALL be enforced through technical controls where feasible.

Criticality: High — Relying on policy-only compliance where technical controls are feasible creates preventable compliance gaps.

Roles: Verifiers

Assessment Objectives

Determine if:

1. each Part 5 requirement that can be enforced through technological means is implemented as a technical control rather than a policy-only control;
2. any requirement enforced solely through policy has a documented justification explaining why technical enforcement is not feasible;
3. the set of policy-only exceptions is reviewed periodically for feasibility of conversion to technical controls.

Verification Methods

Objective coverage: AUTO → 1; EXPT → 1, 2, 3; ADMN → 2, 3

Assessment objects: verifier application source code and configuration; technical control inventory mapping each VER requirement to its enforcement mechanism; policy-only exception register with feasibility justifications; exception review records and meeting minutes.

Statutory compliance: Expert review is mandatory because determining whether a requirement can be "technically enforced" requires judgment about technical feasibility that cannot itself be automated.

SEDI-VER-03: Secure attribute processing

Process an individual's identity attributes in a secure manner.

Utah Code § 63A-20-501(1)(c)

Requirement: The verifier SHALL process attributes within a secure execution context. Attribute data SHALL NOT be logged in plaintext, cached beyond the transaction, or exposed to unauthorized systems.

Criticality: Critical — Insecure attribute processing by verifiers creates a centralized attack surface for identity data theft.

Roles: Verifiers

Assessment Objectives

Determine if:

1. attribute data is not logged in plaintext at any point in the verification pipeline;
2. attribute data is not cached beyond the scope of the current verification transaction;
3. attribute data is not exposed to systems or components not directly involved in the verification transaction;
4. the verifier processes attributes within a secure execution context that enforces isolation from other application components;
5. access controls restrict attribute data access to authorized verification processes only.

Verification Methods

Objective coverage: AUTO → 1, 2, 5; EXPT → 3, 4; ADMN → 4, 5

Assessment objects: verifier application source code; logging configuration and log output samples; attribute data lifecycle documentation; execution environment isolation configuration; access control lists and role definitions; data retention and purge policies; secure processing procedure documentation.

Statutory compliance: Automated testing is mandatory because plaintext logging, data purging, and access control are deterministic technical properties verifiable through testing.

SEDI-VER-04: Minimum attribute processing

Process only the minimum identity attributes reasonably necessary to achieve a specified purpose defined by the relying party requesting the presentation.

Utah Code § 63A-20-501(1)(d)

Requirement: The verifier SHALL request and process only the attributes specified by the relying party's purpose. The verification request SHALL explicitly enumerate required attributes. Blanket "give me everything" requests are prohibited.

Criticality: Critical — Over-collection of attributes by verifiers violates data minimization requirements and increases the attack surface for identity data.

Roles: Verifiers, Relying Parties

Assessment Objectives

Determine if:

1. verification requests explicitly enumerate the specific attributes to be processed;
2. no wildcard, "all attributes," or unbounded attribute request capability exists in the verification protocol;
3. the attributes requested by the verifier match the set specified by the relying party's stated purpose;
4. the verifier processes only the attributes specified in the relying party's request and does not retain or process additional attributes received incidentally.

Verification Methods

Objective coverage: AUTO → 1, 2, 3; EXPT → 3, 4; ADMN → 3, 4

Assessment objects: verification request protocol specification; attribute request schemas and API definitions; relying party purpose-to-attribute mapping documentation; verification transaction logs showing requested vs. received attributes; verifier source code for attribute filtering and processing.

Statutory compliance: Automated testing is mandatory because the enforcement of explicit attribute enumeration and prohibition of wildcard requests are deterministic protocol properties verifiable through testing.

SEDI-VER-05: Accept guardian presentations

Accept a presentation of a state-endorsed digital identity by a digital guardian.

Utah Code § 63A-20-501(1)(e)

Requirement: The verifier SHALL support guardian presentations and SHALL NOT reject a presentation solely because it is made by a guardian rather than the subject.

Criticality: High — Rejecting guardian presentations would exclude minors and incapacitated individuals from services.

Roles: Verifiers

Assessment Objectives

Determine if:

1. the verifier accepts presentations made by a digital guardian on behalf of the subject;
2. the verifier validates the guardian's authorization before accepting the presentation;
3. a presentation is not rejected solely because it is made by a guardian rather than the subject;
4. guardian presentations receive equivalent processing to direct holder presentations.

Verification Methods

Objective coverage: AUTO → 1, 2, 3; EXPT → 2, 4; ADMN → 3, 4

Assessment objects: verifier application source code for guardian presentation handling; guardian authorization validation logic; verification protocol specification for guardian flows; test results for guardian vs. direct holder presentation outcomes; verifier integration documentation.

Statutory compliance: Automated testing is mandatory because guardian presentation acceptance is a deterministic protocol behavior verifiable through testing.

SEDI-VER-06: Four-condition processing gate

May only process attributes if: (a) authorized by holder; (b) necessary for presentation; (c) holder received conspicuous notice; (d) holder consents.

Utah Code § 63A-20-501(2)

Requirement: The verifier SHALL NOT process attributes unless all four conditions are met. The verification protocol SHALL include a mechanism for the holder to review the request, receive notice, and grant consent before attribute transmission.

Criticality: Critical — Processing attributes without meeting all four conditions violates holder privacy protections and statutory consent requirements.

Roles: Verifiers

Assessment Objectives

Determine if:

1. the verifier does not process attributes until the holder has authorized the specific attribute release;
2. the attributes requested are necessary for the presentation as defined by the relying party's stated purpose;
3. the holder receives conspicuous notice of which attributes are being requested and by whom before attribute transmission;
4. the holder's explicit consent is captured before attributes are processed;
5. the protocol enforces all four conditions sequentially such that failure of any single condition prevents attribute processing;
6. no bypass path, error-handling branch, or fallback flow exists that skips one or more of the four conditions.

Verification Methods

Objective coverage: AUTO → 1, 4, 5; EXPT → 3, 6; ADMN → 2, 3

Assessment objects: verification protocol specification and flow diagrams; verifier source code for consent and authorization handling; holder notice content and delivery mechanism; consent capture and storage implementation; protocol flow test results demonstrating four-condition enforcement; error-handling and fallback path documentation.

Statutory compliance: Automated testing is mandatory because the four-condition gate is a sequential protocol property verifiable through flow analysis and testing.

SEDI-VER-07: No device surrender

A verifier may not require a holder to surrender the holder's secure electronic device in the course of a presentation.

Utah Code § 63A-20-501(3)

Requirement: Verification protocols SHALL support contactless or remote interaction. No verification workflow SHALL require the holder to hand over, dock, or physically connect their device.

Criticality: Critical — Device surrender creates physical security risks and enables potential credential theft or unauthorized data extraction.

Roles: Verifiers

Assessment Objectives

Determine if:

1. verification protocols support contactless or remote interaction that does not require the holder to hand over their device;
2. no verification workflow requires the holder to dock, physically connect, or surrender their device;
3. proximity verification completes successfully without device transfer (e.g., at arm's length via BLE or NFC);
4. remote/online verification completes without device transfer.

Verification Methods

Objective coverage: AUTO → 1, 2, 3, 4; EXPT → 2, 3; ADMN → 1, 2

Assessment objects: verification protocol specification; verifier hardware and reader specifications; deployment and installation guides; verifier training materials and operating procedures; device interaction flow documentation; physical proximity test results across representative device/reader combinations.

Statutory compliance: Automated testing is mandatory because contactless verification is a protocol-level property verifiable through specification and testing.

SEDI-VER-08: Utah data protection law compliance

Nothing in this section relieves a verifier from complying with Utah Code Title 13, Chapter 44 or Utah Code Title 13, Chapter 61.

Utah Code § 63A-20-501(4)

Requirement: Verifiers SHALL comply with all applicable Utah data protection laws in addition to Chapter 63A-20 requirements.

Criticality: High — Non-compliance with existing data protection law exposes holders to privacy harm and the verifier to legal liability.

Roles: Verifiers

Assessment Objectives

Determine if:

1. the verifier maintains compliance with Utah Code Title 13, Chapter 44 (Protection of Personal Information Act) as applicable to identity data processed during verification;
2. the verifier maintains compliance with Utah Code Title 13, Chapter 61 (Utah Consumer Privacy Act) as applicable to identity data processed during verification;
3. compliance obligations under Titles 13-44 and 13-61both statutes are documented and integrated into the verifier's data handling procedures;
4. Utah Code ChapterTitle 63A, Chapter- 20 compliance is not treated as a substitute for pre-existing data protection obligations.

Verification Methods

Objective coverage: EXPT → 1, 2, 3, 4; ADMN → 1, 2, 3, 4

Assessment objects: verifier compliance attestation documents for Title 13 Chapters 44 and 61; data handling procedures and privacy policies; compliance program documentation and audit reports; cross-reference matrix mapping data protection obligations to implemented controls; legal counsel opinions on applicability.

Statutory compliance: Administrative verification is mandatory because compliance with external data protection laws is a cross-cutting legal and organizational obligation; expert legal review is recommended for compliance assessment.