Open Proofing Foundation
Menu

Passport or chip ID

The chip data was signed by the issuing country and has not been altered.

NIST SP 800-63A-4 step
Evidence validation
Source
ICAO Doc 9303 passive authentication, CSCA certificates
Where it runs
On device
Component
Passport SDK
Cost per check
$0.00

What the step requires

SP 800-63A-4 requires the proofing service to confirm that each piece of identity evidence is genuine, unaltered and current. The service checks the document's security features or verifies the issuer's digital signature.

How the check works

  1. The SDK reads the machine-readable zone from the data page, or the person enters the card access number, to unlock the chip.
  2. The person holds the document to the phone, and the SDK reads the chip over NFC.
  3. The SDK verifies the signature on the Document Security Object and checks that its Document Signer certificate chains to the issuing country's CSCA certificate, taken from the ICAO master list the Foundation's router publishes.
  4. The SDK compares the hash of each data group read from the chip with the hash in the Document Security Object.

What the person provides

  • A photo of the data page, or the card access number printed on the card
  • Their passport or chip ID, held to the back of the phone

What leaves the device

Nothing leaves the device for this check. Images and face data stay on the phone; only the outcome goes into the evidence record.

Outcomes

Pass
The chip data is signed by the issuing country and every data group hash matches.
Fail
A signature or hash does not verify, or the Document Signer certificate does not chain to the country's CSCA certificate.
Unavailable
The chip cannot be read, or the issuing country's CSCA certificate is not available.

In the evidence record

The entry this proof adds to the record's checks, shown with a pass outcome.

{
  "proof": "passportChip",
  "step": "evidence",
  "outcome": "pass",
  "source": "ICAO Doc 9303 passive authentication, CSCA certificates",
  "checkedAt": "2026-11-02T15:04:11Z"
}

Every field is defined in the evidence record specification.

Other proofs in the Evidence validation step.