PACE authenticates that the reader knows the MRZ data and derives a key for communication, but (AFAIK) does not prove the passport is real or original. A cloned

PACE authenticates that the reader knows the MRZ data and derives a key for communication, but (AFAIK) does not prove the passport is real or original. A cloned passport would also know the MRZ data to complete BAC/PACE. There is a further step called Active Authentication where the reader sends the passport random data and it signs this data with a public key that can be verified as authentic.