Download (PDF, 589 KB, Datei ist nicht barrierefrei

sECurIty
4.3 Passive Authentication (PA)
the purpose of Passive Authentication (PA) is to validate the
authenticity and integrity of the data on the rF chip of the
identity document.
In the course of manufacturing the electronic identity
document, the data stored on the rF chip are digitally
signed. this process uses something called a document
signing certificate, which in turn is signed with the Country
signing Certificate Authority certificate (CsCA certificate)
of the issuing nation and is available only to the officially
authorized ID manufacturer. this certificate forms the
bedrock of the Country signing Certificate Authority
Public Key Infrastructure (CsCA-PKI), a hierarchy of
certificates that verify the integrity of data on identity
documents.
When an identity document is read, Passive Authentication
verifies the signature of the data stored on the rF chip
and traces it back to the CsCA certificate. this enables it to
determine whether the data in the identity document were
written on the rF chip by the officially authorized ID manufacturer
and that their integrity is not compromised.
4.4 Public Key Infrastructures (PKI)
for electronic identity documents
the new identity card requires two Public Key Infrastructures
(PKI): one PKI for verifying the authenticity of
electronic identity documents (Passive Authentication), the
Country signing Certificate Authority (CsCA); and one PKI
to protect the fingerprints on electronic identity documents
(terminal Authentication), the Country Verifying Certificate
Authority (CVCA). technical Guideline tr-03128 describes
the basic functionalities and requirements of these infrastructures.
4.4.1 Country Signing Certificate Authority (CSCA)
InFrAstruCturEs
the Country signing Certificate Authority (CsCA) is operated
by the BsI. this authority generates the German root certificates
(CsCA certificates) on a regular basis, which in turn serve
as the source for the private keys of the document signing certificates
of the passport or ID card manufacturer. the passport
or ID card manufacturer uses the private keys of the document
signing certificates to sign files on the electronic identity
document that represent the document’s data. the document
signing certificate is also electronically stored on the identity
document.
using the root certificate, it is possible to verify whether an
electronic identity document was really created on behalf of
the issuing nation, and whether the data have been changed
in any way since production. this is realized using Passive
Authentication.
to enable the authenticity and integrity of German electronic
identity documents to be verified at border control points in
other countries, and passports of other countries to be tested
14 15