BAC and PACE key calculator

How BAC keys are derived

Basic Access Control uses three fields from the MRZ, each followed by its check digit: the document number, the date of birth and the date of expiry. Joined together they form the MRZ information, for example L898902C<369080619406236. A document number shorter than nine characters is padded with <.

The SHA-1 hash of the MRZ information is calculated, and its first 16 bytes become K_seed. Two session keys are derived from it with the key derivation function KDF(K, c): the SHA-1 hash of K followed by a 32-bit counter c. Counter 1 gives the encryption key K_enc, counter 2 gives the MAC key K_mac. Both are two-key 3DES keys, so the first 16 bytes of each hash are taken and the parity bit of every byte is adjusted.

How the PACE password key is derived

PACE replaces BAC on newer documents and accepts two kinds of password. With the MRZ, the password is the full 20-byte SHA-1 hash of the same MRZ information. With the CAN, a six-digit number printed on the document, the password is the CAN itself. In both cases the key K_π is KDF(password, 3).

Which cipher a chip uses is announced in its PACEInfo in EF.CardAccess.

ICAO test vectors

The calculator reproduces the worked examples from ICAO Doc 9303 Part 11.

Code

import hashlib

def kdf(seed: bytes, counter: int, cipher: str = "3DES") -> bytes:
    data = seed + counter.to_bytes(4, "big")
    if cipher in ("3DES", "AES128"):
        key = hashlib.sha1(data).digest()[:16]
    else:
        key = hashlib.sha256(data).digest()[:24 if cipher == "AES192" else 32]
    if cipher == "3DES":  # set odd parity on every byte
        key = bytes((b & 0xFE) | (bin(b & 0xFE).count("1") % 2 == 0) for b in key)
    return key

info = b"L898902C<369080619406236"
k_seed = hashlib.sha1(info).digest()[:16]
k_enc, k_mac = kdf(k_seed, 1), kdf(k_seed, 2)
k_pi = kdf(hashlib.sha1(b"T22000129364081251010318").digest(), 3, "AES128")

Questions

Is it safe to enter real passport data?

The keys are calculated in your browser and nothing leaves your device. Keep in mind that BAC and PACE keys only open the chip of a document that is physically in front of the reader, and anyone holding the document can read the MRZ anyway. For development, the ICAO examples or generated data are the better choice.

Why does my reader still fail to open the chip?

Most often the MRZ was read with an error, so one of the three check digits or a character of the document number is wrong. Check the MRZ first with the MRZ checker. Other common causes are a chip that supports only PACE with a cipher your reader does not offer, or a document number longer than nine characters.

What is the difference between BAC and PACE?

BAC derives its session keys directly from the MRZ, so their strength is limited by the entropy of the MRZ. PACE uses the password only to run a key agreement (Diffie–Hellman), which produces strong session keys even from a short password such as the CAN.

Where is the CAN printed?

On ID cards it is usually a six-digit number on the front. Many passports issued in recent years print it on the data page as well.