Hacker News Reader

Wait! Is ePassport verification as advanced as to have a challenge-response protocol or similar?

Yes. Modern passports use the data in the MRZ to support a protocol called PACE, which is essentially a password based key exchange. You can look up the spec in ICAO 9303. It’s really quite well designed.

EU passports support a further level of mutual authentication in order to get the fingerprints, where the terminal is verified by the passport as well.

PACE authenticates that the reader knows the MRZ data and derives a key for communication, but (AFAIK) does not prove the passport is real or original. A cloned passport would also know the MRZ data to complete BAC/PACE.

There is a further step called Active Authentication where the reader sends the passport random data and it signs this data with a public key that can be verified as authentic.

Reply on news.ycombinator.com