by   ¶

Rent a car with your wallet.

Contactless car rental, powered by the EU Digital Identity Wallet. PASS2RENT lets a rental agency verify the driver's identity and driving licence — and sign the rental contract — with cryptographic proof from the wallet. No photocopied ID, no manual KYC.

What is PASS2RENT¶

PASS2RENT lets people rent a car straight from their phone. The driver books online, proves their identity and driving licence from their EU wallet, signs the rental contract, unlocks the car, takes a few photos of its condition, and drives away — no counter, no paperwork, no photocopied ID.

Odifis, a software company based in Lithuania, is the editor of PASS2RENT — and the developer of the EUDI wallet verifier built for it, the engine that cryptographically checks every credential.

One in-house verifier backs everything — wallet- and credential-agnostic, on open EU standards (OpenID4VP, ISO/IEC 18013-5 mDL, SD-JWT VC PID, rQES).

What we verify¶

Protocols & formats¶

Live demos¶

1 · Contactless rental — the full journey (Age → Licence → Unlock)¶

▶ https://api.playground.france-identite.gouv.fr/odifis/contactless-rent/

One wallet, three moments, one rental: Book → Sign → Drive. The headline demo spans age verification, driving licence, and identity (PID) in a single contactless journey, each step disclosing only what that step legally needs.

A — Identity & age at booking. To reserve a car, the France Identité wallet presents the driver's PID by QR — confirming their name, first name and that they're old enough (age_over_18). This is the step running against real trust — anchored to France Identité's own IACA on their playground (live crypto, trustAnchorMatched=true).

B — Driving licence at pickup, fills + signs the contract. When the agency assigns a vehicle, the licence matters. An mDL presentation writes the licence data (number, categories, validity, seniority) into the rental contract and confirms category eligibility — then a deliberate, separate rQES ceremony returns a real, signed PAdES contract.

The rental contract is then signed with the wallet — a real rQES ceremony returning a signed PAdES PDF:

C — Licence at unlock (the binding gate). A booking proof isn't enough — it must be this person, on this device, at this vehicle, now. The driver's app triggers a fresh mDL presentation (new nonce + per-vehicle challenge); the verifier checks freshness + holder / device binding → emits an ephemeral, single-use unlock token → the car opens. No portrait by default — biometrics stay in the wallet.

📲 Companion mobile app. The driver journey (and the unlock step) runs in a PASS2RENT demo app. It is not on the public stores (these are demo builds); the public test builds (Android via Firebase App Distribution, iOS via TestFlight) are linked on the contactless.rent website — in the footer and on the booking-confirmed screen.

2 · The verifier — quick EU-wallet checks¶

▶ https://api.playground.france-identite.gouv.fr/odifis/eudi-demo/

A vitrine to test, fast, the exact EU-wallet checks the product relies on — no booking, no app. Present a PID or mDL, evaluate an age_over_N predicate, or sign a contract (rQES) — in one wallet ceremony, with a precise verdict (cryptographic authenticity, issuer trust, revocation; un-evaluated checks labelled). "Verify with your EU Wallet" → QR → scan → verdict.

Getting started¶

1. Rental demo — open https://api.playground.france-identite.gouv.fr/odifis/contactless-rent/ → pick a vehicle and dates → present your France Identité PID by QR — it confirms your name, first name and that you're old enough (age_over_18). For the licence + unlock steps, install the companion app (Android / iOS test builds linked on contactless.rent).
2. Verifier demo — open https://api.playground.france-identite.gouv.fr/odifis/eudi-demo/ → choose a check (PID · mDL · age · sign) → scan the QR → read the verdict.
3. To run the mDL ceremony from your own wallet build, whitelist our reader certificate (below).

Reader certificate¶

To verify mDL/mdoc attestations, add the following reader certificate to your whitelist (NIST P-256 — Android / conscrypt compatible):

-----BEGIN CERTIFICATE-----
MIICNDCCAdqgAwIBAgIUMan4dHq1pRUkmOuDZZoedOdHVL4wCgYIKoZIzj0EAwIw
TzEvMC0GA1UEAwwmYXBpLnBsYXlncm91bmQuZnJhbmNlLWlkZW50aXRlLmdvdXYu
ZnIxDzANBgNVBAoMBk9kaWZpczELMAkGA1UEBhMCRlIwHhcNMjYwNjIxMTAwNzI3
WhcNMjgwNjIwMTAwNzI3WjBPMS8wLQYDVQQDDCZhcGkucGxheWdyb3VuZC5mcmFu
Y2UtaWRlbnRpdGUuZ291di5mcjEPMA0GA1UECgwGT2RpZmlzMQswCQYDVQQGEwJG
UjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABAdGSHKjOOiZ9XQXCjUFUo4qlPtw
n4wsGOF4WGwBNpS5NanO2lfbYMR2TLNAn4LcyGc80/fKnB8FdWDsL2bhC2ujgZMw
gZAwNAYDVR0RAQH/BCowKIImYXBpLnBsYXlncm91bmQuZnJhbmNlLWlkZW50aXRl
LmdvdXYuZnIwEgYDVR0TAQH/BAgwBgEB/wIBAjAOBgNVHQ8BAf8EBAMCAYYwFQYD
VR0lAQH/BAswCQYHKIGMXQUBBjAdBgNVHQ4EFgQURHsmqIjhYio3rMRauYNZJV78
MfkwCgYIKoZIzj0EAwIDSAAwRQIhALDcxlOiOl5YW0vweG17kCoK+hAbB04/cwJY
SW7SWDPNAiAO0tjw0X5fIe7/Rtu/DLNCXQmsjQmlzxuhKiLSZRVTyQ==
-----END CERTIFICATE-----

Self-signed reader CA · P-256 (prime256v1) · SAN api.playground.france-identite.gouv.fr · extKeyUsage 1.0.18013.5.1.6 (mdoc reader auth) · valid 2026 → 2028.

Status & path to production¶

• On the France Identité playground, the live path is PID / age (Demo 1 · A). The mDL steps (Demo 1 · B/C and the verifier demo) run against the EU Reference Wallet and need a registered Reader Auth Certificate before the mDL ceremony works on the FR / Unfold sandboxes.
• rQES is Advanced (AES) in the demo — not yet legal QES. The moment a qualified QTSP is contracted, the same ceremony produces QES, with no code change.
• mDL issuer trust runs in accept-all mode in the demo; production anchors it to the EU LOTL / RICAL trust lists.
• The mDL and rQES flows are already built and exercised in the demo — production switches them on once Relying-Party trust registration is complete.

Organisation & contact¶

PASS2RENT · by Odifis UAB