Secure Identity Engineering Glossary

A legacy access protocol that derives keys from MRZ data to establish an encrypted session with an ePassport chip.

A password-authenticated protocol that strengthens chip access with a robust key agreement.

The security object containing data-group hashes and the Document Signer signature.

The ICAO-defined logical organization for data groups and security objects on an eMRTD chip.

The LDS data group containing the encoded MRZ information on the passport chip.

The data group carrying the holder’s facial image and biometric headers.

The national trust root that signs a country’s passport Document Signer certificates.

The CSCA-authorized certificate and key role used to sign an ePassport SOD.

Verification of chip-content authenticity and integrity using the SOD signature and data-group hashes.

A device that protects cryptographic keys and performs operations inside a secure hardware boundary.

A standard API for applications to access keys on cryptographic tokens and HSMs.

The fixed-format, optically readable identity and document data zone on a travel document.

The area containing portrait, name and security features intended for human visual inspection.

A data encoding that carries a field’s type, byte length and value.

A protected digital representation of identity data derived from a travel document.

A set of digital claims whose issuer and integrity can be cryptographically verified.

A method for revealing only the attributes needed for a transaction.

A one-time value used to prevent replay of a message or presentation.

An attack that blends multiple identities into one portrait to deceive identity-verification systems.

The process of detecting photos, displays, masks and other spoofed biometric presentations.