Hacker News new | ask | show | jobs
by Muromec 552 days ago
There is no database to query unless you issued the document (except revocation database). There is a chip with CMS signed data in it and MRZ is used for key agreement to read the data.

To know that MRZ and data arent from a different person or document, they have the name in ascii. It all kinda works and mskes sense in the end.

When you read the card with phone camera it uses mrz too

1 comments

Looking it up, the mrz are only there to validate that the information stored on the document is the same as the information provided by the chip, and to make any eavesdrop attacks between the reader and the chip less likely to succeed. Its an optional standard.

The data on the chip is authenticated through a country signing key. This part is mandatory and prevent the person who carries the document from falsifying the information on the chip. There is also an optional active authentication chip to prevent someone from copying a passport even if they copy of the mrz and a copy of the traffic between chip and reader.

The MRZ is also part of the older standard which is intended to be replaced by a newer system that has card access numbers, which mean that the mrz and the ascii it embeds could very well be gone from passports. This new standard was implemented in EU by 2014, so there might passports issues now without the MRZ.