Basic Access Control

Basic Access Control defines the authentication method between an inspection system and a machine-readable travel document to allow encrypted data exchange. The authentication method used is a challenge-response authentication.

The method assumes that the document holder their travel document (eg passport) submitted for inspection. This ensures that sensitive data can not be read without the consent of the traveler.

The procedure

• Key generation

• Authentication and establishment of the session key

• Beginning of the secure communication

Secure Communication

The ensuing communication between the inspection system and the travel document is referred to as Secure Messaging. A message is encrypted with a session key in each case and provided the result of a checksum. Before each checksum of the session counter is increased and preceded by the considered data for checksum calculation. Encryption and checksum calculation are performed on the generated keys and KS_ENC KS_MAC. The data is encrypted with 112 -bit Triple-DES.

Criticism

The reliability of the method depends largely on the effective key length. While this may be theoretically 56 bits at a pure number-based serial code number assignment is practiced for example in the Netherlands, which reduces the key strength to a maximum of 35 bits and suggesting a actually even lower strength. From the Dutch security firm Riscure an attack has been shown in which a recording of a wiretapped legitimate BAC communication could be decrypted because the encryption strength used with the computing power of a commercial PC within a few hours.

Some also argue that Basic Access Control is therefore not in itself a bad method. In general, the strength of encryption used for the confidentiality of the data to be protected should be reasonable. Proponents of the system argue that the data that the chip of a BAC - passport contains (name, date of birth, passport number, nationality, gender, period of validity of the passport photograph), in the above-mentioned " a few hours " very likely in other ways could be determined. In this respect, the uncertain Applied BAC method attackers does not give a further opportunity to attack with a similar effort as similar attacks.

More information

• Website of the ICAO MRTDs
• Heise.de items to ePassport Hack
• MRTD Reports ( version of 15 May 2009 on the Internet Archive ) ICAO ( in English)

• Authentication protocol