erenbas.com.tr
Technical field notes on secure document personalization, eID infrastructure, biometrics and artificial intelligence.
All rights reserved. developed by erenbas
Focus areas
eMRTD • ICAO 9303
Smart Card • PKI
Computer Vision • AI
The cryptographic trust root of identity systems | Eren Baş
// Topic hub · PKI and HSM
The cryptographic trust root of identity systems The trust layer from CSCA and Document Signer chains to HSM key ceremonies, PKCS#11 integration and production key management.
ICAO Doc 9303 Part 12 PKCS #11 v3.1 X.509 RFC 5280
// Core concepts
CSCA / DS Binding the passport-chip signature to a national trust root.
HSM Secure hardware that performs cryptographic operations without exporting private keys.
PKCS#11 A standard application interface to keys held by tokens and HSMs.
// Guided reading path
From foundations to production Follow the articles in this order to build the concepts progressively.
01 Token and Key Generation with SoftHSM: Integration with XCA and PKCS11 Tools Token-side P-256 keys, an isolated ES256 signing service, server administration and the limits of Mac XCA connectivity, illustrated by the working identity demo. 02 eMRTD Passive Authentication: How Is a DS Certificate Paired with a CSCA? We provide a step-by-step guide to pairing the Document Signer certificate within EF.SOD with a trusted CSCA, verifying the PKIX chain, validating the SOD signature, and calculating the Data Group hash results, using examples in Java and jMRTD. 03 From SafeNet to the Thales Luna PCIe HSM: Key Management, PKCS#11, and Production Architecture We examine the Luna PCIe HSM architecture, covering the key lifecycle, partition and role model, PKCS#11 integration, high availability (HA), backup, FIPS/PCI DSS separation, and a secure document signing example. // All publications
PKI, HSM AND SMART CARDS 14 September 2026
We examine the Luna PCIe HSM architecture, covering the key lifecycle, partition and role model, PKCS#11 integration, high availability (HA), backup, FIPS/PCI DSS separation, and a secure document signing example.
PKI, HSM AND SMART CARDS 12 July 2026
Frequently asked questions How is a DS certificate validated against a CSCA? The signature chain, validity time, basic constraints, key usage and trusted CSCA store are evaluated together.
Why is HSM backup not simply copying a key? Backup is a governed lifecycle protected by device policy, wrapping keys, separation of duties and auditable ceremonies.
Primary technical sources We provide a step-by-step guide to pairing the Document Signer certificate within EF.SOD with a trusted CSCA, verifying the PKIX chain, validating the SOD signature, and calculating the Data Group hash results, using examples in Java and jMRTD.
PKI, HSM AND SMART CARDS 12 July 2026
Token-side P-256 keys, an isolated ES256 signing service, server administration and the limits of Mac XCA connectivity, illustrated by the working identity demo.