IDMETRIX
← Secure Identity
Stage 2 · Data Preparation

IDmetrix® Document Signer (DS)

PKI signature

Signs the Security Object Document, so a border reader can prove the document is genuine.

The Document Signer uses its private key to create the digital signature on the SOD — the Security Object Document — for each electronic document. That signature is what makes Passive Authentication possible at the border: the reader verifies it against the Document Signer certificate, and the certificate against the country’s CSCA.

The key never leaves the HSM
Capabilities

Key functions

SOD generation
Formation of the Security Object Document per RFC 3369 CMS: hashing all data groups and packaging them into a SignedData structure.
Digital signature
SOD signing with the DS private key (RSA or ECC) inside the HSM — the key is never exported in plaintext.
CDS embedding
Inclusion of the Document Signer certificate in the SOD signerInfo field, so a border service can verify without pre-loading the certificate.
Data group hashing
SHA-256 or SHA-384 hash computation for each data group: DG1 MRZ, DG2 photo, DG3 fingerprints, DG5 signature, DG7 face, DG14 PKI data.
HSM integration
Integration through PKCS#11, JCE or CNG for secure key storage and cryptographic operations.
Batch signing
Signing thousands of SODs for mass document issuance at production speed.
Key management
DS key lifecycle — generation, import, rotation, archival, destruction — with several DS keys supported at once.
Audit and logging
Every signature operation logged: which document, which key, when, and the result.
API integration
REST, SOAP and file-based interfaces for Data Preparation, IDMS and personalization systems.
Sequence

Role in the ICAO PKI chain

  1. 1CSCAThe country root of trust generates the root key pair, signs Document Signer certificates, issues CRLs and uploads certificates to the ICAO PKD.
  2. 2Document SignerReceives its certificate from the CSCA, uses its private key to sign the SOD on each document, and the public certificate is written to the chip for verification.
  3. 3Master ListA CSCA-signed file containing all the country’s trusted Document Signer certificates, distributed through the ICAO PKD.
Stage 2

Also in Data Preparation

The other IDMS components at this stage of the lifecycle.