rfid.wtf / WTF is RFID?
In the wildHF · 13.56 MHz

E-passports

The chip behind the little camera-shaped logo — signed by your government, and built not to talk to strangers.

Since the mid-2000s, most passports carry a contactless chip. Look for the little logo on the cover, a rectangle with a circle in it. The rules live in ICAO Doc 9303, so a passport from one country can be read at any other country's border. Underneath it's an ISO 14443 smart card.

#What's on the chip

The chip holds data groups:

  • DG1: the same text as the printed machine-readable zone (MRZ) at the bottom of the photo page. Name, nationality, date of birth, document number, expiry.
  • DG2: your photo, as a digital image.
  • DG3: fingerprints, in many countries. Locked behind extra protection, see below.
  • The SOD (Document Security Object): hashes of all the data groups, digitally signed by the issuing country.

#It won't talk to strangers: BAC and PACE

You can't just tap a passport and read it. First the reader has to prove it has seen the photo page:

  • BAC (Basic Access Control), the original scheme, derives the access key from the document number, date of birth and expiry date printed in the MRZ.
  • PACE, its stronger replacement, uses the same printed information (or a card access number) as a password, but in a protocol that resists offline guessing.

Either way, the session is then encrypted. Many passports also use a random UID that changes every time they're powered, so a passport can't be tracked by its serial number.

#Is it real? Three different checks

  • Passive Authentication: check the SOD's signature against the issuing country's certificate. This proves the data is genuine and unaltered, but on its own it doesn't prove the chip is the original.
  • Active Authentication or Chip Authentication: the chip proves it holds a private key that matches a public key in the signed data. A copy of the data can't do that. This is the anti-cloning check (see Public-key cards).
  • Terminal Authentication (part of Extended Access Control): the reader has to prove it's an authorised government terminal before the chip releases fingerprints.
From printed page to verified chip. The highlighted MRZ fields are the key; the signatures do the rest. (ICAO's own specimen data, not a real person.)
From printed page to verified chip. The highlighted MRZ fields are the key; the signatures do the rest. (ICAO's own specimen data, not a real person.)
With Your phone

Apps like ReadID Me scan your passport's MRZ with the camera, read the chip over NFC, and check the country's signature. It's a nice way to see Passive and Chip Authentication on your own passport.

Where next

Public-key cardsCards that hold a private key and prove it — the "authentication" end of RFID.ConceptHF · 13.56 MHzISO 14443The standard behind almost every card you tap — how a reader finds a card, picks it out of a crowd, and starts talking.ConceptHF · 13.56 MHzThe UIDEvery tag's factory serial number. Handy for telling cards apart, useless as a secret — and plenty of systems treat it as one anyway.Concept

Shows up in

HF — 13.56 MHzMobile credentials