EU-Passport-Specification

Biometrics Deployment of EU-Passports

EU – Passport Specification
Working document (EN) – 28/06/2006(As the United Kingdom and Ireland have not taken part in the adoption of this measure, an authentic English version of the whole specifications has not been established)

Page 1 of 11
Working document

EU-Passport-Specification
Table Of Contents
1

Scope and Limitations..................................................................................................................3

2

Biometrics ....................................................................................................................................3
2.1

Primary biometric – Face .....................................................................................................3

2.1.1

Standard compliance ....................................................................................................3

2.1.2

Type..............................................................................................................................4

2.1.3

Format ..........................................................................................................................4

2.1.4

Storage requirements....................................................................................................42.1.5

Other issues ..................................................................................................................42.234567

Secondary biometric – Fingerprints .....................................................................................42.2.1

Standard compliance ....................................................................................................42.2.2

Type..............................................................................................................................52.2.3

Format and Quality.......................................................................................................52.2.4

Storage requirements....................................................................................................5

Storage medium (RF-Chip architecture) ......................................................................................53.1

Standard compliance ............................................................................................................53.2

RF-Interface .........................................................................................................................53.3

Storage capacity ...................................................................................................................5

Electronic Passport chip layout (data structure)...........................................................................64.1

Standard compliance ............................................................................................................64.2

Correlation with printed data................................................................................................64.3

Chip Logical Data Structure.................................................................................................6

Data security and integrity issues.................................................................................................65.1

Standard Compliance ...........................................................................................................65.2

Digital data security .............................................................................................................65.3

Inspection Procedure ............................................................................................................85.4

Public Key Infrastructure for Passports ...............................................................................85.5

Public Key Infrastructure for Inspection Systems................................................................85.5.1

Certificate Validity Periods..........................................................................................85.5.2

Certificate Scheduling ..................................................................................................85.5.3

Certificate Policies .......................................................................................................9Conformity Assessment ...............................................................................................................96.1

Standard compliance ............................................................................................................96.2

Functional Evaluation ..........................................................................................................96.3

Common Criteria Evaluation .............................................................................................10

Normative References ................................................................................................................10Page 2 of 11
Working document

EU-Passport-Specification

1 Scope and Limitations
This document describes solutions for chip enabled EU passports, based on the EU document [1]titled„Council Regulation on standards for security features and biometrics in passports andtravel documents issued by Member States”
The document is based on international standards, especially ISO standards and ICAO recommendations on Machine Readable Travel Documents, and accommodates:•Specifications for biometric identifiers: face and fingerprints•

Storage medium (chip)•Logical data structure on the chip•Specifications for the security of the digitally stored data on the chip•

Conformity assessment of chip and applications•RF compatibility with other electronic travel documents

The following considerations are out of scope of this document:•Specifications of the mechanical mounting of the chip in a passport book, durability and mechanical testing procedures.

•

Specifications on standard operation procedures (SOP) for the enrolment or the inspection process.

2 Biometrics
2.1

Primary biometric – Face

2.1.1 Standard compliance•

ICAO NTWG, Biometrics Deployment of Machine Readable Travel Documents, Technical Report, Version 2.0, 05 May 2004 [3]•ISO/IEC 19794-5:2005, Biometric Data Interchange Formats – Part 5: Face Image Data [4]Page 3 of 11
Working document

EU-Passport-Specification

2.1.2 TypeThe facial image must be stored as FRONTAL IMAGE1, according to [3, 4].
2.1.3 Format
The face is to be stored as a compressed IMAGE FILE, not as vendor specific template.
Although both JPEG and JPEG2000 compression is standard compliant [3], JPEG2000 is recommended for EU-Passports because it results in smaller file sizes compared to JPEG compressed images.
2.1.4 Storage requirements
No. Option

Remark1

JPEG compressionApprox. 12-20 KByte perphoto2JPEG2000 compression

Approx. 6-10 KByte per
photo

Recommendation

recommended (see 2.1.3)

2.1.5 Other issues•2.2

Photograph Taking Guidelines taking into account the requirements of facial recognition technology have to be adopted according to ICAO standards [3]Secondary biometric – Fingerprints

2.2.1 Standard compliance•

ICAO NTWG, Biometrics Deployment of Machine Readable Travel Documents, Technical Report, Version 2.0, 05 May 2004 [3]•ISO/IEC 19794-4:2005, Biometric Data Interchange Formats – Part 4: Finger Image Data [5]•ANSI/NIST-ITL 1-2000 Standard “Data Format for the Interchange of Fingerprint, Facial,
Scarmark & Tattoo (SMT) Information”; FBI: Wavelet Scalar Quantization (WSQ) [15]1According to ICAO standards, the “Face biometric data interchange image recorded in Datagroup 2 of the LDS shallbe derived from the passport photo used to create the displayed portrait printed on the data page of the Machine Readable Passport; and shall be encoded either according to full frontal image or token image formats set out in the latest
version of ISO 19794-5.”

Page 4 of 11Working document

EU-Passport-Specification
2.2.2 TypeThe primary fingerprints to be incorporated into the European Passport shall be
PLAIN IMPRESSIONS OF THE LEFT AND RIGHT INDEX FINGER.
In the case of insufficient quality of the fingerprints and/or injuries of the index fingers, good quality, plain impressions of middle fingers, ring fingers or thumbs shall be recorded2.
2.2.3 Format and Quality
The fingerprints must be stored as IMAGES, according to [5].
The quality of the fingerprint images shall be according to [5] and [15].
A compression of the images using the WSQ-algorithm according to [15] MUST be used in order todecrease file size.
2.2.4 Storage requirements
The use of fingerprint IMAGES requires approximately 12 – 15 KByte per finger.

3 Storage medium (RF-Chip architecture)
3.1 Standard compliance• ICAO NTWG, Biometrics Deployment of Machine Readable Travel Document, Technical Report, Version 2.0, 05 May 2004 [3]•ISO/IEC 14443, Identification cards - Contactless integrated circuit(s) cards - Proximity cards[7]•ICAO NTWG, Use of Contactless Integrated Circuits In Machine Readable Travel Documents,
Technical Report, Version 3.1, 16 April 2003 [8]3.2 RF-Interface
According to [3,7,8], both type A and type B RF-interfaces are considered to be ICAO standardcompliant.
ICAO compliant passports will be equipped with either A or B type RF interfaces, requiring borderinspection systems to accommodate both standards for passports.
3.3 Storage capacity
According to the ICAO Logical Data Structure [10], alphanumeric data of the machine readable
zone (MRZ) of the document and digital document security data (PKI) must be stored on the chip
together with the biometric identifiers.
Member States are required to use appropriately sized RF chips to hold the personal data and biometric features according to the EU regulation [1]. See also chapter 2.1.4 and 2.2.4.
2The storage format (CBEFF – Common Biometric Exchange File Format) will record the type of fingers used (leftindex, right middle etc.) in order to ensure verification with the correct finger.

Page 5 of 11
Working document

EU-Passport-SpecificationIf, in accordance to the EU Regulation [1], a Member State wishes to include other data, extra storage capacity might be required.

4 Electronic Passport chip layout (data structure)
4.1 Standard compliance• International Civil Aviation Organization (ICAO), Machine Readable Travel Documents, Doc
9303, Part 1 Machine Readable Passports, Draft Sixth Edition, of 2006 [9]•Common Consular Instructions (CCI), Chapter VI No. 4 and Annex 10•

ICAO NTWG, Development of a Logical Data Structure – LDS for optional capacity expansion
technologies, Technical Report, Revision 1.7, 18 May 2004 [10]4.2 Correlation with printed data
The alphanumeric data, printed in the MRZ of the passport, according to [9], have to correlate to thedata digitally stored in the chip according to [10].
4.3 Chip Logical Data Structure
According to [10].

5 Data security and integrity issues
The traditional passport document incorporates a number of anti-counterfeiting measures, including
security printing and optically variable devices according to [1]. The integrity, the authenticity andconfidentiality of the data, digitally stored in the passport’s chip, have to be equally secured.
5.1 Standard Compliance• ICAO NTWG, PKI for Machine Readable Travel Documents Offering ICC Read-Only Access,Technical Report, Version 1.1, October 01, 2004 [11]•Advanced Security Mechanisms for Machine Readable Travel Documents, Version 1.0, 2006
[13]

5.2 Digital data security
No. Security
1

Passive Authentication[11, 12]RemarkUse

Proves that the contents of the REQUIRED for all data
SOD and the LDS are authen- (ICAO mandatory security
tic and not changed.
feature)Does not prevent an exact
copy or chip substitution.
Does not prevent unauthorized access.
Does not prevent skimming.

2a) Active Authentication[11, 12]

Proves that the SOD is not a
copy but has been read fromPage 6 of 11
Working document

OPTIONAL

EU-Passport-Specification
No. Security

RemarkUse

the authentic chip.
Proves that the chip has notbeen substituted.
Does not prove that the content of the LDS is authentic
and not changed.
Does not prevent eavesdropping on the communications
between chip and inspectionsystemb)

Chip Authentication[13]

Proves that the SOD is not a
copy and has been read fromthe authentic chip.
Proves that the chip has notbeen substituted.
Prevents eavesdropping on
the communications between
chip and inspection system.

3Basic Access Control

Prevents skimming.

[11, 12]

Mitigates the risk of eavesdropping on the communications between chip and inspection system (see 2 b).

Additional protection
REQUIRED for all data at thetime when fingerprint data are
introduced or at the latest 36
months after the adoption of
the technical specifications.
Such a protection MUSTNOT be enforced by the chip
but EU-Inspection systems
MUST use this mechanism, if
supported by the chip.
REQUIRED for all data

Does not prevent an exact
copy or chip substitution (requires also copying of theconventional document).
4Terminal Authentication[13]

Prevents unauthorized access Additional protection
to fingerprint data.
REQUIRED for fingerprint
Prevents skimming of finger- data
print data.

Requires additional key management.
Does not prevent an exact
copy or chip substitution (requires also copying of theconventional document).

Page 7 of 11
Working document

EU-Passport-Specification
SOD

Document Security Object (SOD). This object is digitally signed by the issuing State andcontains hash representations of the LDS contents.

LDS

Logical Data Structure

MRTD

Machine Readable Travel Document

MRZ

Machine Readable Zone

EAC

Extended Access Control being according to ICAO the combination of chip authentication and terminal authentication

5.3 Inspection Procedure
Deleted
5.4 Public Key Infrastructure for Passports
In order to ensure integrity and authenticity of the digital data stored on the chip, a PKI is introduced: Each Member State MUST set up only a single Country Signing CA acting as the nationaltrust point for all receiving states and at least one Document Signer issuing passports. Details on
this PKI infrastructure (including signature algorithms, key lengths, and validity periods) can befound in [11].
Every Member State MUST notify the name and contact details of the organization responsible forthe operation of the Country Signing CA and the Document Signer(s) to the Commission.
5.5 Public Key Infrastructure for Inspection Systems
To prevent unauthorized inspection systems to access fingerprint data another PKI is introduced:
Each Member State MUST set up only a single Country Verifying CA acting a the national trust
point for the passports issued by this Member State and at least one Document Verifier managing agroup of authorized inspection systems. Details on this PKI infrastructure can be found in [13].
Every Member State MUST notify the name and contact details of the organization responsible forthe operation of the Country Verifying CA and the Document Verifier(s) to the Commission.
5.5.1 Certificate Validity Periods
The validity of issued certificates MUST be within the following time frames.
EntityMinimum Validity Period

Maximum Validity Period

Country Verifying CA Certificate

6 months

3 years

Document Verifier Certificate

2 weeks

3 months

Inspection System Certificate

1 day

1 monthThese indications may be changed by the Article 6 committee according to the test results presentedby BIG.

Page 8 of 11Working document

EU-Passport-Specification
5.5.2 Certificate SchedulingTo plan the scheduling of certificates the following processing and distribution times MUST be respected. Link certificates for the Country Verifying CA MUST be distributed at least 14 days before the certificate to be replaced expires.
Certification Authority

Maximum Processing Time
(Certificate Request)

Maximum Distribution Time(Certificate)Country Verifying CA

72 hours

24 hours

Document Verifier

24 hours

48 hours

These indications may be changed by the Article 6 committee according to the test results presentedby BIG.
5.5.3 Certificate Policies
The “BIG” will develop a common Certificate Policy within one year after the Commission Decision on the technical specifications.
The Country Verifying CA of each Member State SHALL publish a Certificate Policy and may setup a Certification Practice Statement in accordance with the requirements set out by the “BIG”, inparticular indicating the conditions under which a certificate for a (foreign) Document Verifier will
be issued. The Commission shall be informed about the adoption of the Certificate Policy.

6 Conformity Assessment
A technical working group (“Brussels Interoperability Group”, BIG) will be established [18] toconvey interoperability of passports conforming to the present specification.
6.1 Standard compliance• ICAO NTWG, RF Protocol and Application Test Standard for E-Passport; Parts 2&3 [19]•ISO/IEC 7816-4, Identifications cards – Integrated circuit cards – Part 4: Organization, security
and commands for interchange [12]•ISO/IEC 7816-8, Identifications cards – Integrated circuit cards – Part 8: Commands for security operations [20]•Common Criteria Protection Profile for Machine Readable Travel Document with “ICAO Application”, Basic Access Control, Version 1.0 [14]•Common Criteria Protection Profile for Machine Readable Travel Document with “ICAO Application”, Extended Access Control, Version 1.0 [17]6.2 Functional Evaluation
For the functional evaluation of MRTD chips the appropriate standard [19], which is currently under development, SHALL be used. Additional test cases required for the implementation of [13]MAY be defined by BIG.

Page 9 of 11
Working document

EU-Passport-Specification
Every Member State MUST contract an accredited (national) test laboratory to certify functional
compliance to the relevant standards on all ISO/OSI layers. Issued certificates MUST be notified tothe Commission.
ISO/OSI LayerStandard

Scope

1-4

ISO 14443 [7]Hardware

6ISO 7816 [12,20]

Software (OS)7

ICAO Application [10,11]

Software (Application)

6.3 Common Criteria Evaluation
Passport chips MUST be evaluated in accordance with the relevant Common Criteria Protection
Profile [14,17].

7 Normative References[1]“Council Regulation (EC) No 2252/2004 on standards for security featuresand biometrics in passports and travel documents issued by Member States”[2]

Deleted[3]

ICAO NTWG, Biometrics Deployment of Machine Readable Travel Documents, Technical Report, Version 2.0, 05 May 2004 [ICAO Bio][4]ISO/IEC 19794-5:2005, Biometric Data Interchange Formats – Part 5: FaceImage Data

[5]

ISO/IEC19794-4:2005, Biometric Data Interchange Formats – Part 4: FingerImage Data

[6]

Deleted[7]

ISO/IEC 14443, Identification cards – Contactless integrated circuit(s) cards– Proximity cards[8]

ICAO NTWG, Use of Contactless Integrated Circuits In Machine Readable
Travel Documents, Technical Report, Version 3.1, 16 April 2003

[9]

International Civil Aviation Organization (ICAO), Machine Readable Travel
Documents, Doc 9303, Part 1 Machine Readable Passports, Draft Sixth Edition, of 2006[10]ICAO NTWG, Development of a Logical Data Structure – LDS for optional
capacity expansion technologies, Technical Report, Revision 1.7, 18 May
2004

[11]

ICAO NTWG, PKI for Machine Readable Travel Documents Offering ICC
Read-Only Access, Technical Report, Version 1.1, October 01, 2004

[12]

ISO/IEC 7816-4:2005, Identifications cards – Integrated circuit cards – Part
4: Organization, security and commands for interchange[13]

Advanced Security Mechanisms for Machine Readable Travel Documents,
Version 1.0, 2005

[14]

Common Criteria Protection Profile for Machine Readable Travel Documentwith “ICAO Application”, Basic Access Control, Version 1.0
Page 10 of 11
Working document

EU-Passport-Specification
http://www.bsi.bund.de/zertifiz/zert/reporte/PP0017b.pdf[15]

ANSI/NIST-ITL 1-2000 Standard “Data Format for the Interchange of Fingerprint, Facial, Scarmark & Tattoo (SMT) Information”
FBI: Wavelet Scalar Quantization (WSQ)
www.itl.nist.gov/iad[16]

Deleted[17]

Common Criteria Protection Profile for Machine Readable Travel Documentwith “ICAO Application”, Extended Access Control, Version 1.0[18]Brussels Interoperability Group, Terms of Reference[19]

ICAO NTWG, RF Protocol and Application Test Standard for E-Passport;Parts 2&3[20]

ISO/IEC 7816-8:2004, Identifications cards – Integrated circuit cards – Part
8: Commands for security operations

Page 11 of 11
Working document