Passive authentication
Ayrıca şöyle anılır PA, eMRTD passive authentication, SOD verification, CSCA trust chain
Passive authentication is how a reader decides that the data on a document's chip was put there by the issuing state and has not been altered since.
What it actually checks
The chip holds a Document Security Object containing a hash of every data group and a signature over those hashes. The reader recomputes the hashes from the data it read, confirms they match, and verifies the signature chains to a country signing certificate it already trusts. All three steps matter; skipping the last one turns a cryptographic check into a formality.
Why the trust store is the hard part
The algorithm is straightforward. Obtaining, validating and keeping current the certificates of every issuing country is not. Countries rotate certificates, distribution is uneven, and a store that is stale in the wrong place produces failures on genuine documents.
The word "passive"
It means the chip does not participate in proving itself; the reader verifies static signed data. Active authentication and chip authentication are separate mechanisms that prove the chip is not a clone, and they are not the same check.
Nereden geliyor
Bunu başkası belirtti. Solidus bir araya getiriyor.
Specified in ICAO Doc 9303. The chip on a travel document carries a signed Document Security Object covering hashes of every data group. Passive authentication verifies that signature against the issuing country's certificate, which chains to a Country Signing Certificate Authority. Solidus implements the check; the scheme and the certificate hierarchy belong to the states.
Bunu nasıl doğrularsınız
Test ağında çalışıyor. Ana ağda değil.
The implementation is verify's emrtd-passive-auth path with its certificate store in csca-store. The standard is public in Doc 9303 Part 11, so the algorithm can be checked independently of our code.