PKI Trust Chain Architecture
ICAO Doc 9303: Passive Authentication and Extended Access Control.
An e-Passport carries two separate chains of trust, and they answer two different questions. Passive Authentication asks whether the data on the chip is genuine and unaltered. Extended Access Control asks whether this particular reader is entitled to see the fingerprints and iris at all. They share a document but not a root, and a border check needs both. Scroll to follow each chain from its root down to the chip.
Glossary of termsPassive Authentication (PA)
Verifies data integrity and document authenticity.
- 1Read the SOD from the chip.
- 2Extract the Document Signer Certificate from the SOD.
- 3Validate the DSC against the Master List obtained from the PKD.
- 4Verify the SOD signature with the DSC public key.
- 5Check the CRL — the certificate must not be revoked.
- 6Compare the hash of every data group against the hashes in the SOD.
All six pass, and the document's data integrity is confirmed.
Extended Access Control (EAC)
Controls access to sensitive biometric data.
- 1DG3 — fingerprints.
- 2DG4 — iris.
- 3Only as far as the rights written into the terminal certificate allow.
The ICAO PKD does not grant access to biometric data. EAC is a separate, bilateral trust framework: one country decides, country by country, whose readers may see its citizens' fingerprints.
Both chains, every time
Passive Authentication proves the data is genuine but opens nothing beyond the face and the MRZ. Extended Access Control opens the biometrics but says nothing about whether the data is authentic. A full e-Passport check runs both, in that order — and a reader that fails either one gets no fingerprints.
See where verification sits in the whole architecture