Did you know that most modern passports are actually embedded devices containing an entire filesystem, access controls, and support for several cryptographic protocols? Such passports display a small symbol indicating an electronic machine-readable travel document (eMRTD), which digitally stores the same personal data printed in traditional passport booklets in its embedded filesystem. Beyond allowing travelers in some countries to skip a chat at border control, these documents use cryptography to prevent unauthorized reading, eavesdropping, forgery, and copying.
Figure 1: Chip Inside symbol (ICAO Doc 9303 Part 9)
This blog post describes how electronic passports work, the threats within their threat model, and how they protect against those threats using cryptography. It also discusses the implications of using electronic passports for novel applications, such as zero-knowledge identity proofs. Like many widely used electronic devices with long lifetimes, electronic passports and the systems interacting with them support insecure, legacy protocols that put passport holders at risk for both standard and novel use cases.
Electronic passport basics
A passport serves as official identity documentation, primarily for international travel. The International Civil Aviation Organization (ICAO) defines the standards for electronic passports, which (as suggested by the “Chip Inside” symbol) contain a contactless integrated circuit (IC) storing digital information. Essentially, the chip contains a filesystem with some access control to protect unauthorized reading of data. The full technical details of electronic passports are specified in ICAO Doc 9303; this blog post will mostly focus on part 10, which specifies the logical data structure (LDS), and part 11, which specifies the security mechanisms.
Figure 2: Electronic passport logical data structure (ICAO Doc 9303 Part 10)
The filesystem architecture is straightforward, comprising three file types: master files (MFs) serving as the root directory; dedicated files (DFs) functioning as subdirectories or applications; and elementary files (EFs) containing actual binary data. As shown in the above figure, some files are mandatory, whereas others are optional. This blog post will focus on the eMRTD application. The other applications are part of LDS 2.0, which would allow the digital storage of travel records (digital stamps!), electronic visas, and additional biometrics (so you can just update your picture instead of getting a whole new passport!).
How the eMRTD application works
The following figure shows the types of files the eMRTD contains:
Figure 3: Contents of the eMRTD application (ICAO Doc 9303 Part 10)
... continue reading