4 ms·

1. Obtain a donor passport, get the chip, dump the Active Authentication key which is used to ensure you can't clone the chip 2. Make a fake passport with your

1. Obtain a donor passport, get the chip, dump the Active Authentication key which is used to ensure you can't clone the chip 2. Make a fake passport with your photo (and fingerprints etc.) and add the AA key so that it passes the check You'll still have to somehow fake Passive Authentication (in which your data, including photo, is signed by the country's public key) too, though.

lxgr 2y ago
That's assuming that the validation software even has all issuing countries' root keys available. Supposedly it's surprisingly (or maybe not, given how international government relations historically work) difficult for countries to exchange their public keys: Since there isn't any central authority, nor a chain of trust available (a la "this key is signed by France and Switzerland, so it's probably the real thing to us, Germany"), it boils down to n^2/2 key exchanges, and n additional ones every time a single key expires or, worse, has to be rotated on short notice. Then all of that has to be distributed to all border authority systems. Last time I looked into this (10+ years ago), my laptop doing Passive Authentication and Active Authentication using 10 lines of Python and my country's root certificate (it's publicly available) was supposedly more than what most border checks could practically do.
- wbl 2y ago
  Isn't this what the pouch and ambassador is for?
- FateOfNations 2y ago
  ICAO, the international organization which maintains the standards for travel document interoperability does have a public key directory that a reasonably large number of countries now participate in. The beauty of international organizations is that the individual members don’t all have to be on the best terms with each other. https://www.icao.int/Security/FAL/PKD/Pages/default.aspx https://www.icao.int/Security/FAL/PKD/Pages/default.aspx
  - lxgr 2y ago
    Oh, that is very neat, thank you! It seems to be publicly accessible too. Maybe I'll add a few lines to my script if I can still find it :)
- notpushkin 2y ago
  Yeah, it’s surprisingly not straightforward. In my home country (Russia), only some biometric passports issued inside the country can be used on the automatic gates – mine was issued in an embassy overseas, so I can’t use them. It works just fine in Malaysia, though!

lxgr 2y ago

That's assuming that the validation software even has all issuing countries' root keys available. Supposedly it's surprisingly (or maybe not, given how international government relations historically work) difficult for countries to exchange their public keys: Since there isn't any central authority, nor a chain of trust available (a la "this key is signed by France and Switzerland, so it's probably the real thing to us, Germany"), it boils down to n^2/2 key exchanges, and n additional ones every time a single key expires or, worse, has to be rotated on short notice. Then all of that has to be distributed to all border authority systems. Last time I looked into this (10+ years ago), my laptop doing Passive Authentication and Active Authentication using 10 lines of Python and my country's root certificate (it's publicly available) was supposedly more than what most border checks could practically do.

wbl 2y ago
Isn't this what the pouch and ambassador is for?
FateOfNations 2y ago
ICAO, the international organization which maintains the standards for travel document interoperability does have a public key directory that a reasonably large number of countries now participate in. The beauty of international organizations is that the individual members don’t all have to be on the best terms with each other. https://www.icao.int/Security/FAL/PKD/Pages/default.aspx https://www.icao.int/Security/FAL/PKD/Pages/default.aspx
- lxgr 2y ago
  Oh, that is very neat, thank you! It seems to be publicly accessible too. Maybe I'll add a few lines to my script if I can still find it :)
notpushkin 2y ago
Yeah, it’s surprisingly not straightforward. In my home country (Russia), only some biometric passports issued inside the country can be used on the automatic gates – mine was issued in an embassy overseas, so I can’t use them. It works just fine in Malaysia, though!