01MRZ / CANAccess data where applicable
ELECTRONIC IDENTITY
eID & NFC Document Trust — from access control to evidence
Separates ICAO Doc 9303 ePassport/eMRTD from national CCCD/eID; BAC/PACE and Passive/Active/Chip Authentication are published only where source-backed.
Credential profiles require different trust mechanisms
ePassports, national eIDs and VNeID/RAR-C06 services are not interchangeable trust profiles. Each profile is published only against its own authoritative specification and service scope.
| Profile | Source / standard | Trust mechanisms | CheckID publication rule |
|---|---|---|---|
| ePassport / eMRTD | ICAO Doc 9303 | MRZ · LDS · SOD · PKI · PA · AA/CA where document/profile supports them | Publish against ICAO capability status and actual implementation evidence |
| CCCD / national eID | National profile + authoritative services | NFC / national data / government authentication as sourced | Do not infer ICAO mechanisms when the national specification differs. |
| VNeID | RAR/C06 ecosystem | SSO / ShareInfo / authorized attributes by service scope | Source, consent/authorization and legal/service scope are explicit |
DOCUMENT TRUST PIPELINE
Do not collapse all chip documents into one standard
Follows ReadID-grade technical storytelling as a benchmark while publishing only CheckID capabilities actually evidenced.
02BAC / PACEAccess-control protocol where supported
03Secure MessagingProtected chip communication
04Data GroupsIdentity/photo/other DG data
05Passive AuthenticationValidate signed document data
06Active / Chip AuthenticationClone-resistance mechanisms where supported
07Holder VerificationBiometric binding of person to document
08EvidenceDocument result + holder result + trace
DOCUMENT/eID TRUST
Document trust is more than reading a chip
Separates access control, signed data, issuer trust and holder verification.
source
Document data
MRZ/CAN/chip data are inputs; issuer, profile and document type must be identified.
InputDocument / chip
OutputStructured identity data
verify
Document authenticity
Passive Authentication and additional clone-resistance mechanisms where supported by profile.
InputSOD + DG hashes + certs
OutputIntegrity / issuer result
assure
Issuer trust
PKI trust chain determines which certificate and trust anchor are accepted.
InputDSC / trust anchor
OutputIssuer trust result
biometric
Holder verification
Bind the trusted document identity to the live holder through the applicable biometric process.
InputDocument identity + live biometric
OutputHolder match + evidence
DOCUMENT · eID · eMRTD TRUST
Optical documents, eID chips and ICAO eMRTDs use different trust models
NFC is a capture/transport path. Public content distinguishes optical checks, chip/credential trust and ICAO eMRTD trust while preserving provenance for each result.
| Path | Primary input | Trust question | Holder binding |
|---|---|---|---|
| Optical document | Image/MRZ/text/security features where supported | Which readability/consistency/authenticity checks are sourced? | Portrait ↔ live biometric when required |
| Electronic ID | Chip/contactless credential by national profile | Which profile establishes credential/chip trust? | Depends on profile/journey |
| ICAO eMRTD | MRZ, LDS, SOD, signer chain | Data-group hash + DSC/CSCA trust where supported | DG2 portrait ↔ live biometric is separate |
ICAO boundary
DG1/DG2/SOD/DSC/CSCA and Passive Authentication belong to the eMRTD model; they are not automatically applicable to every national ID.
National eID boundary
CCCD/eID is described by its credential/profile and authority source; NFC does not automatically mean online government verification.
Evidence separation
Chip integrity, signer trust, extracted attributes, portrait matching and authoritative-source results are separate evidence/results.
Failure taxonomy
Unreadable chip, unsupported credential, untrusted signer, hash mismatch, biometric mismatch and unavailable source remain distinct where the contract exposes them.