paper on ePassports and InfoCard



We’ve been working on ePassports for a while now, using the chips embedded in passports for online authentication. For a couple of years now passports have an embedded chip with information on the passport holder (social security number, name, birth date etc), standardized by the International Civil Aviation Organization. This chip is primarily used to facilitate automated inspection at border control, but can potentially be used for online authentication as well. Without going into technical details here, this means that a ePassport can be considered a state-of-the-art smartcard (contrary to apparantly Canadian driver licences)  that is issued via a trusted process, and which can be used to authenticate for e-government as well as for non-government services.

Our work basically had two dimensions:

  1. Figure out what the consequences of using ePassports for online authentication were – this boils down to the privacy sensitive information on the holder that is stored in the chip. Details vary per country, but since the ePassport was not designed with online usage in mind, you basically have to share all the data, which includes things like social security numbers. This is a major concern, which basically means you have to have a very-trusted-third-party to filter out attributes (minimal disclosure).
  2. How to use this in combination with Information Cards – We did an experiment where a InfoCard-based identity provider would use the ePassport to authenticate the user, as well as pass the government-certified attributes to relying parties. Of course: with user consent!  The good news is it works, the bad is that IMHO it’s a bit complicated to explain to the average user, especially to create the InfoCard.

Last week my colleague Dirk-Jan van Dijk (who did most of the development) presented a paper on the SecureComm conference on our ePassport & Infocard work. Since SecureComm has post-proceedings, I cannot link to the final version of the paper just yet, but just send me an email to get a final-except-maybe-layout-stuff version.

The lead for this work is with my colleague and ePassport guru Martijn Oostdijk. Martijn will give a presentation on our work on at RSA Conference Europe 2009 (next month). Martijn also made a nice overview of articles in the Dutch press on our work, including an English translation of an article in the business newspaper Financieel Dagblad. This work was partly sponsored by the NLnet Foundation, the software is open source.

UPDATE on 26 october 2009:  The paper can now be downloaded from, or from my homepage at the University of Twente.

One Response to paper on ePassports and InfoCard

  1. […] Last but not least: vervals een kopie van het identiteitsbewijs, en gebruik eigen bankrekening. Zal voor witwasser niet erg aantrekkelijk zijn neem ik aan, maar voor gokverslaafde wel. Detecteren aan de hand van een slechte kopie dat bijvoorbeeld het BSN nummer (inclusief consistent de zogenaamde MRZ zone) is gewijzigd lijkt me erg lastig (disclaimer: dit is een beetje aan de randen van mijn expertise). Dit tegengaan kan wel door een controle te doen of het identiteitsbewijs daadwerkelijk is uitgegeven, inclusief het bijbehorende BSN nummer, maar ik betwijfel als exploitanten toegang mogen hebben tot de databases waar dit in staat. Een VIS check of het om een gestolen identiteitsbewijs gaat is niet genoeg, bv een vervalst BSN nummer wordt niet gedetecteerd. Andere manieren om dit betrouwbaarder te maken zijn een face-2-face controle te doen (postkantoor?) i.p.v. een kopie identiteitsbewijs, of met een reader (of NFC telefoon) de chip uitlezen van een identiteitsbewijs. […]

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: