IC Data Authentication

PassiveAuthenticationHandler is responsible for performing passive authentication on data groups of an eMRTD.

Passive Authentication proves that the contents of the Document Security Object (SOD) and LDS are authentic and not changed.

PKCS7 is a class for handling PKCS#7 messages, extracting X.509 certificates.

SignedData is a class representing data contained in a signed data structure found in eMRTD SOD data group.

The ASN.1 data structure SignedData is defined as follows:

SignedData ::= SEQUENCE {
    INTEGER version CMSVersion,
    SET digestAlgorithms DigestAlgorithmIdentifiers,
    SEQUENCE encapContentInfo EncapsulatedContentInfo,
    certificates [0] IMPLICIT CertificateSet OPTIONAL,
    crls [1] IMPLICIT RevocationInfoChoices OPTIONAL,
    SET signerInfos SignerInfos
}

DigestAlgorithmIdentifiers ::= AlgorithmIdentifier

AlgorithmIdentifier ::= SEQUENCE {
    algorithm OBJECT IDENTIFIER,
    parameters ANY OPTIONAL
}

EncapsulatedContentInfo ::= SEQUENCE {
    eContentType ContentType,
    eContent [0] EXPLICIT OCTET STRING OPTIONAL
}

ContentType ::= OBJECT IDENTIFIER

SignerInfos ::= SET OF SignerInfo

SignerInfo ::= SEQUENCE {
    version CMSVersion,
    sid SignerIdentifier,
    digestAlgorithm DigestAlgorithmIdentifier,
    signedAttrs [0] IMPLICIT SignedAttributes OPTIONAL,
    signatureAlgorithm SignatureAlgorithmIdentifier,
    signature SignatureValue,
    unsignedAttrs [1] IMPLICIT UnsignedAttributes OPTIONAL
}

SignerIdentifier ::= CHOICE {
    issuerAndSerialNumber IssuerAndSerialNumber,
    subjectKeyIdentifier [0] SubjectKeyIdentifier
}

SignedAttributes ::= SET SIZE (1..MAX) OF Attribute
UnsignedAttributes ::= SET SIZE (1..MAX) OF Attribute

Attribute ::= SEQUENCE {
    attrType OBJECT IDENTIFIER,
    attrValues SET OF AttributeValue
}

AttributeValue ::= ANY
SignatureValue ::= OCTET STRING

In addition, the class allows to verify the signed data against the stored certificate.

X509Certificate is a class representing an X.509 certificate.

X509CertificateDetails is a structure representing the details of an X.509 certificate.