4 ms·

the web site is very brief on the passport verification mechanism. Anybody can explain how it works? I understand they are compatible with passports with a chip

the web site is very brief on the passport verification mechanism. Anybody can explain how it works? I understand they are compatible with passports with a chip. How do they read them? NFC? OCR a string of letters inside the passport? I would love to hear a report from somebody who tried it.

striking 6y ago
> This is done by reading the unique digital signature the government apposed in the NFC chip included in your passport. Your personal data such as your name or facial image are not read out during this process and your identity remains hidden from the other UBIC participants.
haal 6y ago
Technical details can be found here: https://github.com/UBIC-repo/Whitepaper/blob/master/README.md#non-transferable-proof-of-signature-knowledge https://github.com/UBIC-repo/Whitepaper/blob/master/README.m...
Animats 6y ago
Forget the cryptocurrency stuff. Being able to verify online identity with a passport and phone is valuable and has many other uses.
Aaargh20318 6y ago
> How do they read them? NFC? OCR a string of letters inside the passport? I actually work on software that does this. To read a passport you first need to OCR the two lines of text at the bottom of the data page, the machine readable zone or MRZ (actually: you only need the document number, date of birth and date of expiry, but OCRing the MRZ is the easiest way to input these without error). These 3 pieces of data form a kind of password to access the chip, this is so someone can't skim your passport, they have to already be looking at the data page with all your info before they can access the same info in the chip. (Note that there is an additional way on some passports, which uses a PIN code printed on the passport but this isn't very common yet). Once you got the key, you can authenticate yourself towards the chip and read its data. The data is digitally signed by the government of the issuing country and if you have the root certificates you an verify the data is genuine and not tampered with. Then there is also a mechanism to detect if the chip is not a copy, which is what the cryptocurrency seems to use, called 'active authentication'. You basically send an 8-byte challenge to the passport, which signs it and returns the signature. The passport's public key is readable, the private key is not and stored in a secure way in the chip. By verifying the response against the public key you verify the chip is not a copy. This public key is part of the signed data so you can form a chain-of-trust back to the signing authority. Notice that what this cryptocurrency is doing (signing data using a passport) is considered a problem by some governments (specifically Germany) and thus a new standard was created called EAC-CA (Extended Access Control - Chip Authentication) that specifically prevents this from happening. Both AA and EAC-CA are optional features.
- NotSammyHagar 6y ago
  Is there any danger is using the app and exposing the information in your passport to this app? I'd think so, otherwise why all that effort to keep the information from being skimmed.
  - Aaargh20318 6y ago
    Obviously the potential for abuse is high; if you don’t trust the author of the app then I certainly wouldn’t use it. Passports contain personal information, a color photo of the holder, and optionally can contain a copy of your signature or fingerprints. Note that some information can be behind an additional level of access control called EAC-TA (Extended access control - terminal authentication). For example the fingerprints in Dutch passports are protected like this. Accessing them requires a certificate which is so closely guarded that hardly anyone has access to it.
    - NotSammyHagar 6y ago
      That is why I was concerned. But if you read through the technical descriptions in this hacker news discussion, some people say you are only verifying that the information in it is a valid and unique passport, effectively. I want someone with more information than me to state a definitive answer of the dangers here. Let my try asking the questions: 1. The user info that leads to that 'key' or hash, they get that name and number on the inside, and that's a hash to verify that its a passport issued by a real authority? 2. Isn't there a danger in leaking that internal information in #1? If there was no danger, then they wouldn't put it on the inside, right? 3, Do they have access to further information when they get that hash and verify what else is contained? Is this access to everything that is encoded? It seems not. I think that you are leaking that information on the inside cover, that is of little use to outside people who don't have your passport. They'd know of your existence, and they'd maybe be able to use it if they ever got your passport? I don't want to speculate on important information like your passport credentials.
      - Aaargh20318 6y ago

striking 6y ago

> This is done by reading the unique digital signature the government apposed in the NFC chip included in your passport. Your personal data such as your name or facial image are not read out during this process and your identity remains hidden from the other UBIC participants.

haal 6y ago

Technical details can be found here: https://github.com/UBIC-repo/Whitepaper/blob/master/README.md#non-transferable-proof-of-signature-knowledge https://github.com/UBIC-repo/Whitepaper/blob/master/README.m...

Animats 6y ago

Forget the cryptocurrency stuff. Being able to verify online identity with a passport and phone is valuable and has many other uses.

Aaargh20318 6y ago

> How do they read them? NFC? OCR a string of letters inside the passport? I actually work on software that does this. To read a passport you first need to OCR the two lines of text at the bottom of the data page, the machine readable zone or MRZ (actually: you only need the document number, date of birth and date of expiry, but OCRing the MRZ is the easiest way to input these without error). These 3 pieces of data form a kind of password to access the chip, this is so someone can't skim your passport, they have to already be looking at the data page with all your info before they can access the same info in the chip. (Note that there is an additional way on some passports, which uses a PIN code printed on the passport but this isn't very common yet). Once you got the key, you can authenticate yourself towards the chip and read its data. The data is digitally signed by the government of the issuing country and if you have the root certificates you an verify the data is genuine and not tampered with. Then there is also a mechanism to detect if the chip is not a copy, which is what the cryptocurrency seems to use, called 'active authentication'. You basically send an 8-byte challenge to the passport, which signs it and returns the signature. The passport's public key is readable, the private key is not and stored in a secure way in the chip. By verifying the response against the public key you verify the chip is not a copy. This public key is part of the signed data so you can form a chain-of-trust back to the signing authority. Notice that what this cryptocurrency is doing (signing data using a passport) is considered a problem by some governments (specifically Germany) and thus a new standard was created called EAC-CA (Extended Access Control - Chip Authentication) that specifically prevents this from happening. Both AA and EAC-CA are optional features.

NotSammyHagar 6y ago
Is there any danger is using the app and exposing the information in your passport to this app? I'd think so, otherwise why all that effort to keep the information from being skimmed.
- Aaargh20318 6y ago
  Obviously the potential for abuse is high; if you don’t trust the author of the app then I certainly wouldn’t use it. Passports contain personal information, a color photo of the holder, and optionally can contain a copy of your signature or fingerprints. Note that some information can be behind an additional level of access control called EAC-TA (Extended access control - terminal authentication). For example the fingerprints in Dutch passports are protected like this. Accessing them requires a certificate which is so closely guarded that hardly anyone has access to it.
  - NotSammyHagar 6y ago
    That is why I was concerned. But if you read through the technical descriptions in this hacker news discussion, some people say you are only verifying that the information in it is a valid and unique passport, effectively. I want someone with more information than me to state a definitive answer of the dangers here. Let my try asking the questions: 1. The user info that leads to that 'key' or hash, they get that name and number on the inside, and that's a hash to verify that its a passport issued by a real authority? 2. Isn't there a danger in leaking that internal information in #1? If there was no danger, then they wouldn't put it on the inside, right? 3, Do they have access to further information when they get that hash and verify what else is contained? Is this access to everything that is encoded? It seems not. I think that you are leaking that information on the inside cover, that is of little use to outside people who don't have your passport. They'd know of your existence, and they'd maybe be able to use it if they ever got your passport? I don't want to speculate on important information like your passport credentials.
    - Aaargh20318 6y ago