Crossing Borders: Security and Privacy Issues of the European e-Passport

  • Jaap-Henk Hoepman
  • Engelbert Hubbers
  • Bart Jacobs
  • Martijn Oostdijk
  • Ronny Wichers Schreur
Part of the Lecture Notes in Computer Science book series (LNCS, volume 4266)


The first generation of European e-passports will be issued in 2006. We discuss how borders are crossed regarding the security and privacy erosion of the proposed schemes, and show which borders need to be crossed to improve the security and the privacy protection of the next generation of e-passports. In particular we discuss attacks on Basic Access Control due to the low entropy of the data from which the access keys are derived, we sketch the European proposals for Extended Access Control and the weaknesses in that scheme, and show how fundamentally different design decisions can make e-passports more secure.


Smart Card Message Authentication Code Crossing Border Security Goal Active Authentication 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Kamerstuk II 2004/2005, 25 764, nr. 26 (Official communication of the Dutch parliament)Google Scholar
  2. 2.
    Kamerstuk II, 2004/2005, 29 754, nr. 5 (Official communication of the Dutch parliament)Google Scholar
  3. 3.
    Yearly report on algorithms and keysizes (2005). Technical report, IST-2002-507932 ECRYPT, D.SPA.10 Rev. 2005-0.2 (January 2006)Google Scholar
  4. 4.
    Bellovin, S.M., Merritt, M.: Encrypted key exchange: Password-based protocols secure against dictionary attacks. In: IEEE Security and Privacy, Oakland, CA, USA, pp. 72–84. IEEE, Los Alamitos (1992)Google Scholar
  5. 5.
    BSI. Advanced security mechanisms for machine readable travel documents – extended access control (eac). Technical Report TR-03110, Bundesamt für Sicherheit in der Informationstechnik (BSI), Bonn, Germany (2006)Google Scholar
  6. 6.
    Proposal for a council regulation amending regulation (ec) no 1683/95 laying down a uniform format for visas. OJ C 51, 219–220 (February 26, 2002)Google Scholar
  7. 7.
    Proposal for a council regulation on standards for security features and biometrics in eu citizens’ passports. OJ C 98(39) (April 23, 2004)Google Scholar
  8. 8.
    Hoepman, J.-H., Jacobs, B.: E-passports without the big picture. eGov Monitor (February 20, 2006),
  9. 9.
    ICAO. Machine Readable Travel Documents. Technical report, ICAO, 5th edn (2003)Google Scholar
  10. 10.
    ICAO. Development of a logical data structure - LDS for optional capacity expansion technologies, revision 1.7. Technical report, ICAO (May 2004)Google Scholar
  11. 11.
    ICAO. PKI for machine readable travel documents offering ICC read-only access, version - 1.1. Technical report (Octrober 2004)Google Scholar
  12. 12.
    ISO 7816. ISO/IEC 7816 Identification cards – Integrated circuit(s) cards with contacts. Technical report, ISO JTC 1/SC 17Google Scholar
  13. 13.
    ISO 7816-12. ISO/IEC 7816 Identification cards – Integrated circuit(s) cards – Part 12: Cards with contacts – USB electrical interface and operating procedures. Technical report, ISO JTC 1/SC 17Google Scholar
  14. 14.
    Juels, A., Molnar, D., Wagner, D.: Security issues in e-passports. In: SecureComm 2005 (2005)Google Scholar
  15. 15.
    Gaurav, S.K., Karger, P.A.: Security and privacy issues in machine readable travel documents (MRTDs). IBM Technical Report (RC 23575), IBM T. J. Watson Research Labs (April 2005)Google Scholar
  16. 16.
    Kügler, D.: Security mechanisms of the biometrically enhanced (eu) passport. In: Security in Pervasive Computing conference, Boppard, Germany (April 2005),
  17. 17.
    Massey, J.L.: Guessing and entropy. In: Proc. 1994 IEEE International Symposium on Information Theory, p. 204 (1994)Google Scholar
  18. 18.
    National Institute of Standards and Technology. Recommendation for key management. Technical Report Special Publication 800-57 Draft, NIST (August 2005)Google Scholar
  19. 19.
    Evaluation report biometrics trial 2B or not 2B (2005),

Copyright information

© Springer-Verlag Berlin Heidelberg 2006

Authors and Affiliations

  • Jaap-Henk Hoepman
    • 1
  • Engelbert Hubbers
    • 1
  • Bart Jacobs
    • 1
  • Martijn Oostdijk
    • 1
  • Ronny Wichers Schreur
    • 1
  1. 1.Institute for Computing and Information SciencesRadboud University NijmegenNijmegenThe Netherlands

Personalised recommendations