Results: RFID and Identity Management in everyday life - ITAS

Case ID 23, level 3
Title Passport
Researcher Sil Wijma
Timing 2006
Geography Europe
Environment Border control, identification
Case #23: the European Biometric Passport
Technology Passport with RFID tag, 13,56 MHz, different readers.
Maturity Pilot
Function Identification
Owner Different European countries
Maintainer International Civil Aviation Organization (ICAO)
Users Citizens
Other actors Different governments, different manufacturers (Philips, Oberthur Card Systems, Setec, etc.),
European Union and different consumer organisations such as Bits of Freedom (BOF).
Case story RFID passport in Europe
European countries are introducing RFID-tags in passports to improve security of the passports. This
is partly because of demands from the USA to store biometric data on the passport and because of
the wish to improve the security of the passports. Nations participating in the U.S. Visa Waiver
Program have to implement new passports with biometric features that support facial recognition.
Biometric data such as a digital photo is therefore stored on the passport-chip. The main target of
this is to prevent look alike fraud. The International Civil Aviation Organization (ICAO) has developed
standards for the use of biometric data in passports [31]. The ICAO is busy with the possible use of
biometric data since 1997 [30].
The ICAO decided in May 2003 to use facial recognition in travel documents [30]. The European
Union followed in September 2003 with the decision to use a photograph and two fingerprints [30].
The technical specifications were determined on the 28th of February 2005 [35]. At first only digital
photographs will be saved on the chip inside the passports. Later additional biometric data can be
added, such as fingerprints, DNA-profiles and iris-scans. Adding fingerprints was more difficult then
first thought and therefore all European Countries have to store fingerprints on the chip inside the
passports from the 28th of June 2009 [23]. There are different uses of the biometric passports:
verification (one to one), identification (one to many) and screening [27].
The European Union first wanted biometric passports to be introduced in January 2005, but delays
occurred. The first country to use the biometric passports was Belgium that issues the passports
since November 2004 [different chip?]. Germany followed in November 2005 [20].
One of the ways the data on a passport is secured is ‘basic access control’ (BAC). This is a way to
prevent skimming. Some information of the passport and its holder is summarized in a Machine
Readable Zone (MRZ). The MRZ consists of two lines of optically readable text with (among other
data) the name of the holder and passport number. A reader has to read the MRZ before being able
to retrieve data from the chip inside the passport [26]. This means a passport has to be opened to be
read. Basic access control is important although it is then questionable why a contact less chip is
needed. Researchers also found out that some information on the passport chip is retrievable without
access to the MRZ [26]. Because of this there are ideas to use metal to prevent any reader from
accessing the chip in the passports. The USA for example uses metal fibres in the front cover in
order to prevent unauthorised reading [48].
When access to the chip is granted information will be exchanged. This information
exchange between chip and reader is secured (secure messaging). This means the information is
encrypted and uses a message authentication code (MAC) [26]. Further the integrity of the data on
the chip is checked with Passive Authentication (PA) and Active Authentication (AA) further prevents
cloning. But there are reports that the passports can be cloned, although it was not possible to alter
47