7 ms·
Reading NFC Passport Chips in Linux
- stavros 1y agoHm, he doesn't say whether he managed to decrypt the passport with the missing checksum in the end, or whether the piercing doesn't matter because it's trivial to calculate the checksum from the rest of the info, or how long that would take. Did I miss it, or is that useful information omitted?
- edent 1y agoOP here. It is trivial to create the missing checksum. It is detailed at https://shkspr.mobi/blog/2025/06/reading-nfc-passport-chips-in-linux/#recreating-the-mrz https://shkspr.mobi/blog/2025/06/reading-nfc-passport-chips-...
- stavros 1y agoYep, I saw that section, but thought that the next section was a continuation of it. Maybe you could say a few more things about it, like "since it was trivial to recreate the checksum, I managed to read my passport fine, and then wondered what it would take to guess the entire MRZ" as a segue.
- dzhiurgis 1y agoHol up. So what stops you from uploading custom photo + metadata onto random chip and planting it in a fake passport?
- 23434dsf 1y agoConscience
- ragebol 1y agoExpectation of punishment
- neoromantique 1y agoConsidering how often it is done, not much?
- agnishom 1y agoWhat makes you think it is done often?
- crowbahr 1y ago(It's not)
- victorbjorklund 1y agoIt is not? Pretty much all cases of digitally valid "fake" passports are corruption where they were made by the govt the same way normal passports are made.
- edent 1y agoThe data are signed with the passport issuing authority's private key. So you could implement a chip which reacts like an official passport. When the border guards see that the signature is invalid, you can explain how it's just a prank and you'll all have a jolly good laugh about it.
- 23434dsf 1y agoSo if I strolled through the airport with a high power NFC reader/writer, I could ruin a lot of peoples trips?
- daveoc64 1y agoWhat makes you think you could do this?
- lukan 1y ago"The NFC chip in a passport is protected by a password. The password is printed on the inside of the physical passport. As well as needing to be physically close to the passport for NFC to work0, you also need to be able to see the password."
- wkat4242 1y agoYes but. In Europe this tech is also in our id cards whether said passport is printed on the outside (considering it's just a credit card format). You still have to see it but it doesn't have to be opened to the right page like a passport. Both sides even have the info printed. One side in human format, the owner side in machine readable.
- lukan 1y agoYes, but this still means a attacker needs to have physical access to the passport?
- tialaramex 1y ago
- remcob 1y agoBesides the data being signed as already mentioned, the protocol is interactive and custom to passport documents. So you can’t just put it on any programmable NFC tag. I also doubt you can buy programmable ones implementing the passport protocols. But maybe you can find general purpose programmable ones you can implement the protocol on. There are also optional subprotocols that allow the chip to be authenticated (i.e. proof it knows a private key). These prevent copying valid signed data to a different chip.
- crowbahr 1y agoYeah but since the USA doesn't sign on to anything above basic auth (MRZ unlock) everyone also has to work on the more basic level. Kinda unfortunate.
- lxgr 1y agoYou can definitely run the protocol on a programmable smartcard (see for example https://jmrtd.org/ https://jmrtd.org/), but without the required PKI certificates, nobody would accept your home-made passport.
- SXX 1y agoCountries like UK actually have publicly database for e-visas (share code) that can easily be verified via online API. So probably at least some foreign governments can cross validate some of passport data with each other.
- crowbahr 1y agoCountries all know each other's signing certs. There's a question of how much they _trust_ the other country but the certs are all public.
- frelp 1y agoI wonder if you could create a chip that could break the passport reader system. That could really disrupt things, so hopefully that’s not possible.
- hypeatei 1y agoBurning a zero day like that in front of border / travel officers will probably land you in prison very quickly.
- dopp0 1y agothe world belongs to the braves
- edent 1y agoThe ICAO documents contain the complete specification. It is moderately complex and involves twiddling lots of bits. So I've no doubt that a passport reader somewhere isn't doing bounds checking properly. But you could achieve much the same effect with a hammer.
- giantg2 1y agoBut could a hammer deliver a malicious payload that could spread in the system? I'm not sure if you could do that with data on the chip, but maybe.
- deleted 1y ago[deleted]
- lxgr 1y agoYes, but so could a sticker with a QR code containing some exploit that the optical passport reader scans. I don't think it's a particularly different attack vector just because the chip is "active". Competent systems would treat all data received from it as potentially harmful until proven otherwise.
- wkat4242 1y agoMany passports also contain digitized fingerprint scans. But those are even harder to access. You need a private key that only governments have.
- aneutron 1y agoSounds fairly sensible to me
- heavyset_go 1y agoIf it's truly sensitive data, encrypting with a unique private key and locking that with a PIN a la FIDO via NFC would be a bit more secure. One master key leak and everyone is walking around with IDs that give away sensitive data over RFID.
- Nextgrid 1y ago> sensitive data "Sensitive" data that you already leave on everything you touch.
- heavyset_go 1y agoYou leave your DNA everywhere, too, but there are data security and privacy implications of digitizing that data and voluntarily/involuntarily sharing it with others.
- timewizard 1y ago"Many passports also contain your computer password. But those are even harder to access. You need a private key that only governments have." Still reasonable?
- aneutron 1y agoIf you think of your fingerprint as a "secret", you're wrong. It's more your name. That would be like saying your face is a secret. It's not.
- SXX 1y agoI always wondered isn't this kind of specification also have digital signature of the passport issuer or something? Otherwise how do other countries can verify it's not a fake one? I read this article, but seems like any information about it is kind a omited.
- janmo 1y agoThe passports contain a digital signature and a DSC (Document Signing Certificate). This DSC is signed by a CSCA certificate which you can download from the ICAO Public Key Directory. Link here: https://pkddownloadsg.icao.int/ https://pkddownloadsg.icao.int/
- landgenoot 1y agoYes. There is even an active function that allows you sign arbitrary bits to check if the passport actually contains the private key. Otherwise you could spoof a passport by just replaying the government signed data. Source: I have been working on a blockchain implementation in the past that was compatible with the cryptographic functions in an NFC passport. Basically using a standard NFC passport as a cold wallet. Fun fact. The cryptographic system even differs per country. E.g. the Dutch don't trust the NIST elliptic curves so use the brainpool curves instead. Some other countries are still using RSA iirc.
- SXX 1y agoThanks for details. Actual validation methods would be actually cool to read about. Since if we ignore legal diffuculties of storing the data then we can actually use passport cryptography as something like actual proof-of-human without pesky 3rd-parties.
- tauntz 1y agoThe spec for machine readable travel documents is sadly not the most concise but if you're interested in the nitty-gritty details of how to validate documents, how to read data from them, etc then jump into ICAO 9303: https://www.icao.int/publications/documents/9303_p10_cons_en.pdf https://www.icao.int/publications/documents/9303_p10_cons_en... https://www.icao.int/publications/documents/9303_p11_cons_en.pdf https://www.icao.int/publications/documents/9303_p11_cons_en... But please keep in mind that this is just the spec for how it's supposed to be implemented. Real world implementations of it have lots of creative interpretations of the spec in addition to straight bugs in their implementations, so if you're going to write software that has to work with various different documents issued by various governments, you'll have many fun debugging sessions :)
- chatmasta 1y agoIt seems every country that moves to electronic travel authorization has an app that requires me to verify my passport with this method. I have a fairly new passport, issued in the last few years, and a recent phone… and this process is a huge pain. I need to massage my passport with my phone for a minute, maybe I get a bite, hold it still… oops, start over… try again… okay, use our partner’s face ID recognition service instead… ugh it’s horrible. I don’t know if the issue is the very low power chip in the passport, or some damage or what… but I dread the process any time I need to do it.
- doublerabbit 1y agoIt's just a future fantasy that isn't fit for our dystopian world. I'm still waiting for the fantasy of fixed potholes.
- chatmasta 1y agoHonestly, it’s better than “take a photo of your passport and upload it to our unsecured S3 bucket.”
- FireBeyond 1y ago
- nemoniac 1y agoHere's a tidied up version of the Python code to generate the MRZ from the passport data. It also corrects a padding error. https://pastebin.com/k0Tty22a My Dutch driver's licence has a single MRZ-like line across the bottom. It seems to encode the country and licence number but I can't make any sense of the rest of the line. Anyone have any leads?
- Farbklex 1y agoI haven't found the docs for the Dutch version but this article shows the content of the MRZ of a French drivers license. They seem to match the Dutch ones as well. https://trustdochub.com/en/mrz-strip-french-driving-licence/#MRZ_Tape https://trustdochub.com/en/mrz-strip-french-driving-licence/...
- nemoniac 1y agoOnly partially. At least for my Dutch licence. It contains neither holder's last name nor end date. It does start with D1NLD. Then a single digit which is not the checksum of the foregoing (using the passport checksum algorithm). Then the document number. Then some letters and numbers I can't make any sense of. It ends with a correct global checksum for all of the foregoing.
- XiS 1y agoSee the spec I mentioned. But here's an excerpt. https://upload.disroot.org/r/Y_vdT16A#cW4coNxPvTJN6b8InO5cHWg+H677CP94exKuMbEQBxU= https://upload.disroot.org/r/Y_vdT16A#cW4coNxPvTJN6b8InO5cHW...
- deleted 1y ago[deleted]
- deleted 1y ago[deleted]
- XiS 1y agoDrivers licenses aren't ICAO 9303 compliant. For EU documents a separate spec is being used (NEN-ISO-IEC 18013-3). Small pointer: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02012R0383-20140617 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... Context: Made an implementation for reading these when Dutch drivers license model with NFC first came available (model 2014 if I remember correctly)
- ape4 1y agoIts odd that the dates aren't Y2K safe (hard to believe I am typing this in '25).
- the_svd_doctor 1y agoYes. In fact I just filled a UK ETA for my 1 year old daughter, and after taking a photo of the MRZ the application asked me to confirm if she was born in 1924 or 2024 :-)
- criddell 1y agoIs any of this specific to Linux? It looks like it should work in Windows an macOS as well.
- edent 1y agoI only have Linux (and Android) to test on. Please report back if it works on other OSes.
- ndr_ 1y agoHe confirms he could do an iOS port: https://mastodon.social/@andyq/114738867580032204 https://mastodon.social/@andyq/114738867580032204
- lxgr 1y agoI've had several banking apps (and I believe one airline or hotel booking app as well) scan my ICAO passport as part of KYC, so this is definitely a thing. Much preferred over the usual "send us a photo of your password as a means of authentication".
- extraduder_ire 1y agoThere's an android application on fdroid which allows you to do the same thing in a pretty nice UI: https://f-droid.org/packages/com.tananaev.passportreader/ https://f-droid.org/packages/com.tananaev.passportreader/ I found it useful as I don't have a USB NFC reader. You need to enter the passport number and dates yourself though.
- alexrsagen 1y agoI've written some Rust code to do the same thing. Mainly to get a copy of the photo stored on my passport, and because I was curious about how eMRTDs worked. I enjoyed reading through the ICAO 9303 specs, they were very detailed. Example: https://github.com/alexrsagen/rs-nfc1/blob/main/examples/read_mrtd.rs https://github.com/alexrsagen/rs-nfc1/blob/main/examples/rea... Library with eMRTD specific code: https://github.com/alexrsagen/rs-mrtd1 https://github.com/alexrsagen/rs-mrtd1
- privacyking 1y agoYou can do this easily with a proxmark 3 rdv4 or clone