Electronic identity documents
If you live in Europe or have a passport, you probably own an electronic identity documenteMRTD (electronic Machine Readable Travel Document) containing a NFC chip readable by most recent smartphonesThe chip can be unlocks using details visible on the card itself.
Reading it provides a bunch of personal information (name, date of birth, photo, ...) stored in Data GroupDG1, ..., DG15s signed by your state using an worlwide identity systemThe ICAO (International Civil Aviation Organization) PKI (Public-Key Infrastructure).
Green: readable without privileges. Orange: only using a privileged terminals.
Identity verification
This is sometimes used for identity and age verification. Since we don't want to share all our personal information to prove citizenship, nor reveal our exact birthdate just to prove our age, some tools also allow selective disclosure using zero-knowledge proofs.
Authentication mechanisms
| Mechanism | How it works | Availability | Verifiability | Requires chip |
|---|---|---|---|---|
| Passive Authentication | Chip data is signed by the state. | Everyone | Universal | No |
| Active Authentication | Chip signs a challenge using a certified private key. | Obsolete | Universal | Yes |
| Chip Authentication | Chip and reader establish a shared secret to authenticate data. Since both hold the same keys, the proof cannot be transferred to others. | Everyone | Local only | Yes |
| Terminal Authentication | The terminal use a certificate to gain access to restricted capabilites. | Government | Universal | Yes |
We introduce this:
| Mechanism | How it works | Availability | Verifiability | Requires chip |
|---|---|---|---|---|
| Remote Chip Authentication | A remote verifier can challenge the chip. | Everyone | Designated verifier | Yes |
Limitations
Chip data and Passive Authentication does NOT prove possession of the chip (it can be copied)
Active Authentication address this, but is not available in most recent documents.
Chip Authentication is designed to be local-only. To the best of our knowledge, it was never used remotely. The following technique propose a way to do so. However it's a repudiable scheme, limiting capabilities.
A non-repudiable scheme cannot be turned into a universally verifiable signature.
But we can still convince someone.
Remote chip authentication
A trick to remotely and asynchronously challenge Chip Authentication
1. Bob knows CA's public key, prepare a payload to be processed by the chip.
2. Alice (asynchronously) challenge the chip and send the response back to Bob.
3. Bob is convinced Alice indeed possess the chip.
ca_pkBob choose
v_sk, compute v_pk, shared = ca_pk^v_skBob ───▸ Alice ───▸ Card :
v_pk, ADPU, MAC(shared, ADPU)Card ───▸ Alice ───▸ Bob :
response, mac(response, shared)Alice cannot cheat, she doesn't know
shared✓ Bob is convinced Alice is indeed interacting with Card
Alice acts as MITMMachine-In-The-Middle to blind CA public key, preventing Bob from linking multiple sessions.
(c, C = g^c)Card ───▸ Alice :
CAlice generates DH keypair
(a, A = g^a)Alice computes blinded card key
CA = C^a = g^(ca)Alice ───▸ Bob :
A, CABob generates DH keypair
(b, B = g^b)Bob computes
ABC = CA^b = g^(abc), AB = A^b = g^(ab)Bob ───▸ Alice :
AB, ADPU, MAC(ABC, ADPU)Alice ───▸ Card :
AB, ADPU, MAC(ABC, ADPU)Card computes
ABC = AB^c = g^(abc)Card verifies MAC, processes ADPU
Card ───▸ Alice ───▸ Bob :
response, MAC(ABC, response)✓ Bob is convinced Alice possesses Card + unlinkable to other sessions
