1. Technical Report PKI for Machine Readable Travel Documents offering ICC read-only access TAG_15 Montreal, 2004-05-18 Tom Kinneging

2. Authenticity and Integrity Document Security Object Standardized data structure (RFC3369) Containing hash-representations of LDS data groups Digitally signed by issuing State

3. Document Security Object Data Group 1 (MRZ) Data Group 2 (Encoded Face) Data Group 3 (Encoded Finger) Data Group 4 (Encoded Iris) Data Group 5 (Displayed Face) Data Group 6 (Future use) Data Group 16 (Persons to notify) LDS Data Group 7 - 15 Hash DG_1 Hash DG_2 Hash DG_3 Hash DG_5 SO D Digital Signature

4. Key Management Document Signer Certificates Country Signing CA Certificates Certificate Revocation ICAO Public Key Directory

5. Key Management Country Signing CADocument Signer Issue & signIssue & SignSign Country Signing CA Certificate Hash DG_1 Hash DG_2 Hash DG_3 Hash DG_5 SO D Digital Signature Document Security Object Document Signer Certificate Inspection systemMRTD chip 2 2 11 1

6. Additional options Basic Access Control Active Authentication Securing additional biometrics

7. Basic Access Control MRZ based key derivation Skimming Access to chip data Eavesdropping Secure communications chip / reader

8. Basic Access Control

9. Inspection system 10011101111001

10. Active Authentication Chip Substitution Data Copying Documents Key pair

11. Active Authentication Data Group 1 (MRZ) Data Group 2 (Encoded Face) Data Group 3 (Encoded Finger) Data Group 4 (Encoded Iris) Data Group 5 (Displayed Face) Data Group 6 (Future use) LDS Data Group 7 - 14 Hash DG_1 Hash DG_2 Hash DG_3 Hash DG_5 SO D Digital Signature Data Group 16 (Persons to notify) Data Group 15 (AA Public Key) Hash DG_15 AA Private Key

12. Next steps Implementation experiences Further development

13. Frequently Asked Questions TAG-MRTD-WP/10 Keep up-to-date

14. Action by the TAG/MRTD The TAG/MRTD is invited to endorse the Technical Report, PKI for Machine Readable Travel documents Offering ICC Read-only Access, Version 1.0.