We use the term credential replica to refer to a data structure derived from an original credential that is certified by the same issuer and comprises the same attributes, possibly formatted or encoded differently, but binds the attributes to a different proof-of-possession secret. An example of credential replication without modification of the attributes is key rotation. An example of replication with modification is server retrieval of the mDL as specified in the ISO/IEC 18013-5 standard, which encodes attributes in JSON whereas they are encoded in CBOR for device retrieval.
In On-demand cross-device replication of a driver’s license credential we have demonstrated a credential replication technique that works as follows.
When a credential is issued to a browser, the issuer creates a passkey in that browser using as the user.id parameter in the call to navigator.credentials.create() a retrieval token that references a driver record containing the attributes included in the credential.
When a relying party asks for presentation of the credential on an instance of the same browser in a device where there is no credential and no service worker, the request reaches the issuer, which calls navigator.credentials.get(). The value of the userHandle property in the response to navigator.credentials.get() is the value of the user.id parameter in the navigator.credentials.create() call, i.e. the retrieval token. The issuer uses the token to retrieve the driver record and uses the attributes in the record to issue the credential replica, binding them to the public key of a freshly generated key pair.