RFID Reading

• Passive Authentication (PA)

Uses a digital signature to confirm the authenticity of the data, and detects whether the signed RFID data has been illegally changed, but does not protect against fully copying it.

• Active Authentication (AA)

Makes the device send randomly selected data fragments (known as a “challenge”) to the RFID chip. The chip generates a digital signature of the data using the private key and returns its value (“response”) to the terminal. The terminal verifies the validity of the digital signature using the public key, determining thereby the authenticity of the private key used by the chip, and hence the one on the chip itself.

• Chip Authentication (CA)

Sets up a secure communication session based on a static pair of cryptographic keys, which are stored in the chip memory. Successful CA ensures that the public and private keys stored in the RFID chip memory comply with each other and thus confirms that the chip has not been cloned.

• Terminal authentication (TA)

Requires certificates that make it possible to access data groups and read sensitive biometric data (fingerprints and other biometrics) from electronic identity documents, but only via an EAC/EAP connection.

_{*Regula does not provide any Country Signing Certification Authority (CSCA) certificates for authentication, as they are originally provided by the issuing country.}

Despite the fact that all RFID authenticity checks can be successfully completed on smartphones/edge devices, they are not enough, as there is a risk of verification results being intercepted and modified by fraudsters directly on the same device.

In the “zero trust to mobile” approach, Regula adds another layer of protection against such fraud with complete server-side RFID chip authentication. Now, a server in a customer’s secure perimeter takes part in chip verification and reverifies the chip and its authentication session to ensure the information in the physical ID is trustworthy and the chip is not cloned or its data manipulated. Also, the results of the verification session are stored on a server so it is possible to check them afterwards if required. All this is done strictly on the client's premises, and Regula gets no access to any data.

Supported RFID chip standards

• ISO/IEC 14443-2 (type А and B)
• ISO/IEC 14443-3 (MIFARE® Classic Protocol)
• ISO/IEC 14443-4

Data access modes

• Direct
• BAC
• EAC
• PACE
• SAC

Supported applications

• ePassport (DG1–DG16)
• eID (DG1–DG21)
• eSign
• eDL (DG1–DG14)

Supported standards

• reading RFID chips in compliance with ICAO 9303, LDS 1.7, and PKI 1.1 data formats
• certified by BSI TR-03105 Part 5.1 and BSI TR-03105 Part 5.2 
• supports ISO/IEC 18013