BAC (Basic Access Control)
Definition
The ICAO e-Passport access control mechanism that derives a session key from the MRZ data, requiring the passport to be physically opened and the MRZ optically read before chip data can be accessed, preventing contactless skimming.
- Governing standard
- ICAO Doc 9303
- Key derivation source
- Machine-readable zone (MRZ) data
- Purpose
- Prevents contactless skimming of chip data
- Prerequisite
- Passport must be physically opened and MRZ read
Common questions
What data from the MRZ is used to derive the BAC session key?+
The document number, date of birth and date of expiry printed in the machine-readable zone, together with their check digits, are combined to derive the keys that establish a secure channel between the reader and the chip. This is why the physical document must be optically scanned first.
Does BAC prevent all forms of e-passport data extraction?+
No, BAC only stops a reader from accessing chip data without first reading the MRZ; it does not by itself guarantee the authenticity of the stored data. Passive Authentication and Active Authentication are separate ICAO mechanisms used to detect a cloned or altered chip, and newer documents use the stronger Password Authenticated Connection Establishment (PACE) protocol instead of BAC.
Why is BAC relevant in document forensics rather than just IT security?+
An examiner verifying a suspect travel document needs the MRZ to be legible and correctly printed simply to establish a read session with the chip at all, so MRZ damage or tampering can itself block chip verification, which is a useful investigative signal in its own right.
Related terms
- Check-Digit Algorithm
- A weighted-sum calculation (weights 7, 3, 1 cycling, modulo 10) over the character values of MRZ fields; used to detect data transcription...
- FADO (False and Authentic Documents Online)
- FRONTEX-managed EU database providing border officers with reference images of both genuine and known fraudulent travel documents from EU and associated states.
- ICAO 9303
- The International Civil Aviation Organization's Machine Readable Travel Documents standard (8th edition, 2021), specifying MRZ field structure, OCR-B font, check-digit algorithm, biometric...
- KINEGRAM
- A diffractive optically variable image device (DOVID) in holographic foil used on passport biographical pages and visa stickers; produced by OVD Kinegram...
- MRZ (Machine-Readable Zone)
- The lower portion of the passport biographical page printed in OCR-B font, structured according to ICAO 9303 TD3 format (two lines of...
- Passive Authentication (PA)
- The ICAO e-Passport mechanism by which a border reader verifies that chip data groups are signed by the issuing state's Document Signer...
- Photo Substitution
- A fraud type in which the original holder's photograph on a genuine document is replaced with the fraudster's image, typically by lifting...
- Polycarbonate Biographical Page
- A laser-engraved PC data page in which holder data and portrait are embedded within the polycarbonate layers rather than printed on the...
- SLTD Database
- INTERPOL's Stolen and Lost Travel Documents database, containing over 100 million records of passports and identity documents reported stolen or lost by...