Asml Holding Nv · EURONEXT:ASML
Asml Holding Nv — Collis — Technical Presentation (November 2006)
18 slides from Asml Holding Nv's technical presentation, Nov 17, 2006
Slide 1: E-Passport Testing: Ensuring Global Acceptance
E-Passport Testing Ensuring Global Acceptance By: Jos Chehin Date: 17 November 2006 Location: ASML
Slide 2: Global Acceptance of the e-Passport
Global Acceptance of the e-Passport Global Acceptance Interoperability Functionality Test Standards Security e-Passport Standards www.collis.nl 2
Slide 3: Agenda
Agenda The e-Passport The ICAO/ISO e-Passport Standards Test coverage of the Application Protocol and Logical Data Structure Test Standard Findings and Conclusions www.collis.nl 3
Slide 4: The e-Passport
The e-Passport Contactless chip Processing capability Data storage PKI Biometrics (Face, fingerprint, eyes) Secure electronic identification www.collis.nl 4
Slide 5: The e-Passport Standards
The e-Passport Standards ISO 14443 Public Key Cryptography conform to the ICAO PKI standard The ISO 7816-4 Standard Standard for the e-Passport Logical Data Structure (LDS) ICAO LDS OSI Layer 6-7 Personalisation ICAO PKI OSI Layer 6-7 ISO 7816-4,8 Application OSI Layer 1-4 ISO 14443 Hardware
Slide 6: Testing the e-Passport Hardware
Testing the e-Passport Hardware Collis SmartWave box Reads/simulates Test Suite’s Low level interoperability Low level interoperability test events (ISO 14443): Cross-over testing ‘interoperability’ rates 93% in Singapore 87% in Berlin Readable ≠ ISO/ICAO conformance www.collis.n
Slide 7: e-Passport Security Mechanisms
e-Passport Security Mechanisms Security mechanisms: Passive Authentication (Mandatory) Active Authentication (Optional) Basic Access Control (Optional) Extended Access Control (Optional) “Issuing States MAY choose additional security, using more complex ways of securing the chip and its data
Slide 8: e-Passport Smartcard Commands
e-Passport Smartcard Commands e-Passport to reader communication on APDU level Passive Active Basic Access Extended Authentication Authentication Control Access Control SELECT SELECT SELECT READ BINARY(B0/B1) READ BINARY(B0/B1) GET CHALLENGE INTERNAL AUTHENTICATE MUTUAL AUTHENTICATE OSI Layer 6-7
Slide 9: The e-Passport LDS
The e-Passport LDS ICAO LDS Personalisation www.collis.nl 9
Slide 10: Testing the e-Passport Application and LDS
Testing the e-Passport Application and LDS ICAO/ISO Test Standard Security Security Mechanisms Smartcard commands Positive Negative The LDS Encoding of the LDS data objects www.collis.nl 10
Slide 11: Test Coverage of the ICAO PKI Test Standard
Test Coverage of the ICAO PKI Test Standard Mandatory EU US Passive Auth. Active Auth. Basic Access Control Extended Access Control Mandatory EU US Passive Auth. Active Auth. Basic Access Control Extended Access Control www.collis.nl 11
Slide 12: Test Coverage of the ICAO LDS Test Standard
Test Coverage of the ICAO LDS Test Standard Mandatory EU US EF.COM DG1 Machine Readable Zone (MRZ) DG2 Encoded Face DG3 Encoded Finger (s) DG4 Encoded Eye (s) DG5 Displayed Identification features : DG7 DG8 Encoded Security Features : DG10 DG11 Additional personal details DG12 Additional Document De
Slide 13: Test Coverage of the ICAO LDS Test Standard
Test Coverage of the ICAO LDS Test Standard Mandatory EU US EF.COM DG1 Machine Readable Zone (MRZ) DG2 Encoded Face DG3 Encoded Finger (s) DG4 Encoded Eye (s) DG5 Displayed Identification features : DG7 DG8 Encoded Security Features : DG10 DG11 Additional personal details DG12 Additional Document De
Slide 14: Smartcard Command APDU Tests
Smartcard Command APDU Tests Number of Positive / Negative tests defined per ISO 7816 command 12 11 10 8 7 6 6 4 3 3 2 2 2 1 1 1 1 0 0 0 0 0 0 SL B0 B1 B0sfi B1sfi GC MA AA Positive Tests Defined Negative Tests Defined www.collis.nl 14
Slide 15: ISO 7816 Command Test Coverage Matrix
ISO 7816 Command Test Coverage Matrix CLA P1 P2 Lc Crypt Data CC TLV Offset SM Le Rtrn bytes P N P N P N P N P N P N P N P N P N P N P N P N B1sfi B0sfi B0 B1 SEL GC MA IA www.collis.nl 15
Slide 16: Findings
Findings Some optional, but important security features not covered by the ICAO test standard (AA, EA) e-Passport chip response on incorrect commands not tested thouroughly (negative tests) Gaps in the test specification Global Acceptance Interoperability ty Functionali Security Test Standards
Slide 17: Recommendation
Recommendation Additional tests need to be developed to fill up gaps in the test specification Global Acceptance Interoperability Functionality Security Test Standards E-Passport Standards www.collis.nl 17
Slide 18: End
-End- www.collis.nl 18