So you could implement a chip which reacts like an official passport. When the border guards see that the signature is invalid, you can explain how it's just a prank and you'll all have a jolly good laugh about it.
Both sides even have the info printed. One side in human format, the owner side in machine readable.
For a random traveller you can probably guess roughly how old they are, which is a few bits for the date-of-birth, and maybe you could strike up conversation and discover their name (or maybe it's printed on baggage, called out by fellow travellers etc.) but yeah it'll be very hard
For a very well known person you can likely discover everything except the passport number and you might get a decent guess at that from knowing roughly when it would be issued.
From a very well known person you could probably also steal everything you need directly, if your purpose is to create damage.
You can read from a small distance, probably further than you can read an NFC tag with your phone. And you can automate both on a phone (OCR and NFC)
NFC chips can be locked. That means the data can't be overwritten. No matter the writer, nor its strength, you can't overwrite a passport's chip.
I suppose you could use an EMP - but that would ruin a lot more than just some trips.
There are also optional subprotocols that allow the chip to be authenticated (i.e. proof it knows a private key). These prevent copying valid signed data to a different chip.
But you could achieve much the same effect with a hammer.
I've seen crashes in PKCS#11 drivers when reading cards with malformed data. So, the possibility, in theory, is always there.
I read this article, but seems like any information about it is kind a omited.
Source: I have been working on a blockchain implementation in the past that was compatible with the cryptographic functions in an NFC passport. Basically using a standard NFC passport as a cold wallet.
Fun fact. The cryptographic system even differs per country.
E.g. the Dutch don't trust the NIST elliptic curves so use the brainpool curves instead. Some other countries are still using RSA iirc.
Actual validation methods would be actually cool to read about. Since if we ignore legal diffuculties of storing the data then we can actually use passport cryptography as something like actual proof-of-human without pesky 3rd-parties.
https://www.icao.int/publications/documents/9303_p10_cons_en...
https://www.icao.int/publications/documents/9303_p11_cons_en...
But please keep in mind that this is just the spec for how it's supposed to be implemented. Real world implementations of it have lots of creative interpretations of the spec in addition to straight bugs in their implementations, so if you're going to write software that has to work with various different documents issued by various governments, you'll have many fun debugging sessions :)
https://pastebin.com/k0Tty22a
My Dutch driver's licence has a single MRZ-like line across the bottom. It seems to encode the country and licence number but I can't make any sense of the rest of the line. Anyone have any leads?
stavros•3h ago
edent•3h ago
stavros•2h ago