ePassports and the ICAO Public Key Directory (PKD)

How an ePassport is signed

ICAO says each issuing State has a Country Signing Certification Authority (CSCA) key pair. The CSCA private key signs the Document Signer certificate ¹.

Each issuing State has a Document Signer Certificate (DSC) key pair. The Document Signer private key digitally signs the ePassport ¹. The signature and certificates are stored in the chip as the Document Security Object ¹.

ICAO defines passive authentication as validating the authenticity and integrity of the content of the chip, using the issuing State's public keys ¹. The signature lets a verifier detect whether chip data was altered ¹.

What the ICAO PKD does

ICAO describes the PKD as a central repository for exchanging the information required to authenticate electronic travel documents ². It covers ePassports, electronic ID cards and Visible Digital Seals ².

A receiving State needs information from the issuing State to validate a foreign ePassport. ICAO says bilateral exchange would be complex and error-prone, so the PKD lets each State upload its own information and download that of others ². ICAO says the PKD acts as a central broker for interoperability with technical standards ².

ICAO Doc 9303

Doc 9303, Machine Readable Travel Documents, is published in 13 parts. Each part is available in English, French, Chinese, Arabic, Spanish and Russian ³.

ePassports at the border

In the UK, Border Force says travellers need a biometric symbol on the cover of their passport to use the ePassport eGates ⁴. Those travelling with ID cards cannot use the eGates ⁴.

In the EU, Regulation (EU) 2017/2225 lets travellers use a self-service system only if the authenticity of the chip is confirmed and the facial image can be checked against the live face ⁵.

UN Security Council resolution 2396 (2017) decides that Member States shall develop and implement systems to collect biometric data, in line with domestic and international human rights law ⁶.