Passive authentication is the cryptographic check that every e-passport chip must support: it confirms that the identity data stored on the chip has not been altered since the issuing government wrote it, by comparing a fresh hash of each data group against a signed security object whose signature traces back to that country’s trusted root certificate. It is the baseline verification implemented in every one of the 140-plus countries issuing electronic passports under standards maintained by the International Civil Aviation Organization.1International Civil Aviation Organization. Doc 9303 Machine Readable Travel Documents Part 1 It runs in seconds at the border, and it works without any live connection to the issuing country.
What the Chip Holds
The chip stores identity information in numbered categories called Data Groups. Two are mandatory on every e-passport: Data Group 1 holds the Machine Readable Zone printed on your data page (name, nationality, date of birth, passport number, expiration date), and Data Group 2 holds a digital facial photograph.2International Civil Aviation Organization. Doc 9303 Machine Readable Travel Documents Part 10 Issuing countries can optionally populate other groups with fingerprints, iris scans, a signature image, or additional personal details.
This structure matters for one reason: passive authentication protects every populated data group individually. Each one gets its own cryptographic fingerprint, and any change to any group breaks the check.
The Security Object
At the center of the chip’s file structure sits a special file called EF.SOD, the Document Security Object.2International Civil Aviation Organization. Doc 9303 Machine Readable Travel Documents Part 10 It acts as a tamper-evident seal over everything else on the chip.
When the passport is manufactured, the issuing authority runs each populated Data Group through a cryptographic hash function. That produces a fixed-length digital fingerprint unique to that exact data, and even a one-bit change to the underlying information would produce a completely different hash. All of those hashes are bundled inside EF.SOD and then digitally signed by a Document Signer, an entity authorized by the issuing government. The result is a single signed package that locks down every piece of data on the chip. Alter the facial photograph, and the stored hash no longer matches a freshly calculated one. Verification fails.
ICAO recommends a minimum security strength of 120 bits for newly issued documents, which effectively sets SHA-256 as the floor.3International Civil Aviation Organization. Doc 9303 Cryptographic Key Length Review The signature itself must use an approved asymmetric algorithm such as RSA or ECDSA.4International Civil Aviation Organization. Doc 9303 Part 11 – Security Mechanisms for MRTDs
The Trust Chain Behind the Signature
A digital signature is only as trustworthy as the key that created it. Each country that issues e-passports establishes a single Country Signing Certificate Authority (CSCA) as its national trust anchor. The CSCA generates a long-lived root certificate and uses it to issue certificates to Document Signers, which are the entities that actually sign the security objects on individual chips.5International Civil Aviation Organization. ICAO PKD – ePassport Basics Because the CSCA certificate stays relatively stable while many Document Signer certificates rotate over time, the system scales to millions of passports while keeping the root of trust manageable.
For a border system in one country to verify a passport issued by another, it needs a copy of the issuing country’s CSCA certificate. The preferred exchange is bilateral and diplomatic. As a secondary channel, countries use the ICAO Public Key Directory, a central platform for sharing certificates and revocation lists.6International Civil Aviation Organization. ICAO PKD – Frequently Asked Questions ICAO also publishes a Master List currently containing 547 certificates from participating countries.7International Civil Aviation Organization. ICAO PKD – ICAO Master List
One nuance is worth knowing. ICAO does not vouch for the trustworthiness of certificates on its Master List; each receiving country sets its own policy on which certificates to trust.8International Civil Aviation Organization. ICAO Master List Policy and Procedure The Master List simplifies distribution. The decision to accept a given country’s documents remains sovereign.
What Happens When You Reach the Border
When the passport hits the reader at an international checkpoint, the inspection system runs passive authentication as an automated sequence. It follows a strict order.
The reader pulls the security object and the Document Signer certificate off the chip. It then reads the raw data from each populated Data Group and independently recalculates each hash. It compares every freshly computed hash against the corresponding hash stored inside EF.SOD. If even one pair doesn’t match, the data has been tampered with, and the check fails.
If all hashes match, the system moves up the trust chain. It verifies the digital signature on EF.SOD using the public key in the Document Signer certificate, confirming that the security object was created by an authorized entity. It then checks that the Document Signer certificate was legitimately issued by the country’s CSCA, using the pre-loaded CSCA certificate. The entire chain has to hold. A forgery that alters data fails at the hash comparison. A forgery that tries to re-sign data with a fake key fails at the certificate check. Any mismatch triggers an alert, which may lead to secondary inspection or denial of entry.9International Civil Aviation Organization. ePassport Validation Roadmap Tool – System Requirements
No internet connection to the issuing country is needed. The necessary certificates are already loaded into the inspection system.
What Passive Authentication Does Not Prove
Here is the limitation that catches people off guard. Passive authentication proves the data on the chip is genuine. It does not prove the chip itself is the original.
Because the chip’s data can be read during normal operation, an attacker could copy every byte from a legitimate passport onto a blank chip. The copied data retains valid hashes and a valid digital signature, so passive authentication would pass on the clone exactly as it would on the original. This is the single biggest gap in passive authentication, and ICAO defines two optional protocols to close it.
Active Authentication
Active Authentication is a challenge-response protocol in which the chip proves it holds a private key that never leaves its secure memory. The inspection system sends a random challenge, the chip signs it with its private key, and the system verifies the response using the corresponding public key stored in Data Group 15. Because the private key cannot be extracted, a copied chip cannot respond correctly. ICAO describes this mechanism as protection against “substitution (i.e. cloning).”9International Civil Aviation Organization. ePassport Validation Roadmap Tool – System Requirements
Chip Authentication
Chip Authentication serves the same anti-cloning purpose through a different cryptographic approach. It also relies on a private key in the chip’s protected memory, and it has the added benefit of establishing an encrypted communication channel between the chip and the reader.4International Civil Aviation Organization. Doc 9303 Part 11 – Security Mechanisms for MRTDs Both Active Authentication and Chip Authentication are optional for issuing countries. Without at least one of them, passive authentication alone cannot detect a cloned chip.
Where Access Control Fits In
Passive authentication assumes the chip data has already been read, so it’s worth separating it from the mechanism that controls whether a reader can access the chip at all. That mechanism is Chip Access Control, which prevents skimming and eavesdropping. The current standard protocol is PACE (Password Authenticated Connection Establishment), which requires the reader to demonstrate knowledge of information printed on the physical document, either the Machine Readable Zone data or the Card Access Number, before establishing an encrypted session.4International Civil Aviation Organization. Doc 9303 Part 11 – Security Mechanisms for MRTDs Fingerprints and iris scans in Data Groups 3 and 4 receive an additional layer called Extended Access Control, under which the issuing country individually authorizes each foreign inspection terminal permitted to read those biometrics.10International Civil Aviation Organization. ePassport Validation Roadmap Tool – Document Readers Access control decides who gets to read the chip. Passive authentication decides whether to believe what’s on it.
If Your Chip Stops Working
Chips are durable but not indestructible. If the chip in your passport fails from physical damage, a manufacturing defect, or wear, the passport itself remains a valid travel document until its printed expiration date. According to the U.S. Department of State, a traveler with a non-functional chip “will continue to be processed by the port-of-entry officer as if you had a passport without a chip.”11U.S. Department of State. Frequently Asked Questions about Passport Services There is no requirement to replace the passport solely because the chip has failed.
Expect the process to take longer, though. Without a functioning chip, officers rely entirely on the physical security features of the document and manual verification. If you travel frequently, replacing the passport may be worth the convenience even when the rules don’t require it.