Extended access control

Extended Access Control (EAC) is a set of advanced security features for electronic passports that protects and restricts access to sensitive personal data contained in the RFID chip. In contrast to common personal data (like the bearer’s photograph, names, date of birth, etc.) which can be protected by basic mechanisms, more sensitive data (like fingerprints or iris images) must be protected further for preventing unauthorized access and skimming. A chip protected by EAC will allow that this sensitive data is read (through an encrypted channel) only by an authorized passport inspection system.

EAC was introduced by ICAO. as an optional security feature (additional to Basic Access Control) for restricting access to sensitive biometric data in an electronic MRTD. A general idea is given: the chip must contain chip-individual keys, must have processing capabilities and additional key management will be required. However, ICAO leaves the actual solution open to the implementing States.

There are several different proposed implementations of the mechanism, all of which must retain backward-compatibility with the legacy Basic Access Control (BAC), which is mandatory in all EU countries. The European Commission described that the technology will be used to protect fingerprints in member states' e-passports. The deadline for member states to start issuing fingerprint-enabled e-passports was set to be 28 June 2009. The specification selected for EU e-passports was prepared by the German Federal Office for Information Security (BSI) in their technical report TR-03110. Several other countries implement their own EAC.

EAC as defined by the EU has two requirements: chip and terminal authentication.

The chip authentication specification defines a handheld device (CAP reader) with a smart card slot, a decimal keypad, and a display capable of displaying at least 12 characters. Chip authentication (CA) has two functions:

...
Wikipedia