EAC (Extended Access Control) is a set of advanced security features between a terminal and electronic passports (ePassport) that protects and restricts access to sensitive personal data contained in the RFID chip. It enables mutual authentication and establishment of a secure communication channel between a smartcard (ePassport) and a terminal. In contrast to common personal data (like the bearer’s photograph, names, date of birth, etc.) which can be protected by basic mechanisms, more sensitive data (like fingerprints or iris images) must be protected further for preventing unauthorized access and skimming. A chip protected by EAC will allow that this sensitive data is read (through an encrypted channel) only by an authorized passport inspection system.

EAC was introduced by ICAO as an optional security feature additional to Basic Access Control (BAC) for restricting access to sensitive biometric data in an electronic MRTD. A general idea is given: the chip must contain chip-individual keys, must have processing capabilities and additional key management will be required. However, ICAO leaves the actual solution open to the implementing States.

There are several different proposed implementations of the mechanism, all of which must retain backward-compatibility with the legacy Basic Access Control (BAC), which is mandatory in all EU countries. The European Commission described that the technology will be used to protect fingerprints in member states’ e-passports. The deadline for member states to start issuing fingerprint-enabled e-passports was set to be 28 June 2009. The specification selected for EU e-passports was prepared by the German Federal Office for Information Security (BSI) in their technical report TR-03110.[5] Several other countries implement their own EAC.

EAC as defined by the EU

EAC as defined by the EU has two requirements: chip and terminal authentication.

Chip authentication (for strong session encryption)

The chip authentication specification defines a handheld device (CAP reader) with a smart card slot, a decimal keypad, and a display capable of displaying at least 12 characters. Chip authentication (CA) has two functions:

  • To authenticate the chip and prove that the chip is genuine. Only a genuine chip can implement communication securely.
  • To establish a strongly secured communication channel, using a chip-specific key pair with strong encryption and integrity protection.

Chip authentication has an add-on Basic Access Control (BAC) with protection against skimming and eavesdropping.

Terminal authentication (access restricted to authorized terminals)

Terminal authentication (TA) is used to determine whether the inspection system (IS) is allowed to read sensitive data from the e-passport. The mechanism is based on digital certificates which come in the format of card verifiable certificates.

  • Each inspection system is granted a card verifiable certificate (CVC) from a document verifier (DV). The inspection system’s certificate is valid only for a short time period, typically between 1 day and 1 month.
  • An inspection system may have several CVCs installed at any time, one for each country that allows it to read sensitive data.
  • The CVC allows the inspection system to request one or more items of sensitive data, such as data for iris or fingerprint recognition.

A document verifier certificate is granted from the country verification certificate authority (CVCA). These certificates can be for domestic or foreign document verifiers. The certificates are typically issued for medium amounts of time, between half a month and 3 months. The CVCA is generated by each country and is typically valid for 6 months to 3 years.

Related Products

Related Articles

Access-IS enrolls with Acante

June 30th, 2020|

Reading, UK – June, 2020: Interactive kiosk design and manufacturing specialist Acante have announced the integration of the state-of-the-art Access-IS ATOM® document reader into their latest Biometric Enrolment Kiosk. 56 BEK01 kiosks and 75 desktop units have already been installed in the

Access-IS integrates with NOVOMATIC

June 23rd, 2020|

READING, England - Access-IS, the leading provider of identity document readers, is pleased to announce the integration of its ATOM® document reader with the myACP casino management system from NOVOMATIC. The myACP modular system, combined with ATOM, can be

Gemalto Announces Future CEO Succession

April 5th, 2016|

Amsterdam, April 5, 2016 – Gemalto (Euronext NL0000400653 GTO), the world's leading digital security company, today announced that Chief Executive Officer Olivier Piou has decided to retire from the Company at the end of August, 2016. Mr. Philippe Vallée, currently Chief

« Back to Glossary Index