idFod / Eviden / ANTS / 2024

Cryptography for secure documents

idFod: signing services, CVC certificates and a React administration interface for electronic passports and identity cards.

idFod / Administration & monitoring

Cryptography needs operational oversight.

A React interface for monitoring services, certificates and signing operations.

idFod administration interface: certificates, users, signature volumes and renewals. — idFod interface screenshots · the displayed indicators illustrate monitoring features.

Dark idFod monitoring view: service activity, CVCA, DV and IS certificates, and renewal errors. — idFod interface screenshots · the displayed indicators illustrate monitoring features.

idFod / Applied cryptography

CVC expertise, written in code.

ASN.1, elliptic curves, signing mechanisms and access rights: real idFod excerpts show our engineers’ work with CVC certificates.

Control the formats.

Converting an elliptic-curve CVC public key to DER, with its curve identifier and public point.

CVCSignatureUtils.tsCode

export function cvcPublicKeyEcToDer(
    oid: string,
    publicPoint: Uint8Array,
): Uint8Array {
    const algorithmIdentifier = genASN1Sequence([
        genASN1ObjectIdentifier('1.2.840.10045.2.1'), //ecPublicKey
        genASN1ObjectIdentifier(oid), //curve oid
    ]);

    const publicKey = new asn1.BitString({ valueHex: publicPoint });
    return Buffer.from(
        genASN1Sequence([algorithmIdentifier, publicKey]).toBER(false),
    );
}

Control the signature.

Selecting the PKCS#11 mechanism from the OID, calling the signing service and assembling the CVC request.

CVCertificateRequest.tsCode

const bsiOID = publicKey.getOID();
const tbsData = Buffer.from(requestBody.encode().toBER(false));
const SignatureRequest = {
    mechanismPkcs11Code: getSignatureAlgorithm(bsiOID),
    data: Buffer.from(tbsData).toString('base64'),
    parameters: getSignatureParameters(bsiOID),
};
const signature = await sign(keyID, SignatureRequest);

// Assemble the request body and the signature
return new CVCertificateRequest(
    requestBody,
    Buffer.from(signature, 'base64'),
);

Interpret the rights.

Reading the DG3 right from the certificate. This check forms part of complete chain and authorisation verification.

CVCertificate.ts / canReadDG3()Code

public canReadDG3(): boolean {
    const role =
        this.certificateBody.getCertificateHolderAuthorizationTemplate()
            .discretionaryData;
    if (role[0] === undefined) {
        throw new Error(
            'Invalid CVCertificate, no discretionary data in authorization template',
        );
    }
    const roleBinary = role[0].toString(2).padStart(8, '0');
    // the last bit of the discretionary data is the read right for DG3, xxxxxxx1
    return roleBinary.endsWith('1');
}

Authorising access to biometric data

For Eviden and France’s Agence Nationale des Titres Sécurisés (ANTS), Stelau developed idFod, a signing solution for exchanges with electronic passports, electronic national identity cards and residence permits.

The document sends a challenge. Signing that challenge contributes to terminal authentication: the terminal must prove it is authorised to access sensitive data. This project addresses access to Data Group 3 (DG3), which contains fingerprint images.

CVC expertise across the whole chain

Card Verifiable Certificates (CVC) are central to this project. Our engineers work on encoding and decoding, EC and RSA public keys, creating and authenticating certificate requests, signature verification and interpreting access rights.

This expertise connects the CVCA → DV → IS chain to the project’s practical requirements: precise formats, cryptographic parameters, interoperability and certificate lifecycle management.

Two SOAP functions, an operational context

The SOAP webservices provide the certificate chain and sign the challenge on request. Integration accounts for document delivery equipment in town halls, prefectures and consulates, as well as airport inspection systems.

The solution connects to PKIs issuing CVCs and to HSMs used to generate asymmetric key pairs and perform signatures. Protected communications complete the architecture.

Making operations understandable

The React interface lets operators manage certificates, keys and users, inspect logs and monitor service status. The screenshots show CVCA, DV and IS certificate families, signing activity and renewal monitoring.

Statuses and diagnostics need to be clear. Operators must be able to identify and understand a rejected renewal request so that they can continue their checks.

idFod alert: the inspection system certificate was not issued because the request contains invalid parameters. — A rejected renewal request is displayed along with its cause. idFod interface screenshot.

From specifications to an integrated solution

Challenge management services, PKI and HSM connections and the administration interface form a solution integrated into the ANTS operational environment. The work combines interoperability, certificate management and control over cryptographic operations.

The security mechanisms draw on travel document specifications: ICAO Doc 9303, Part 11, and BSI TR-03110, particularly for terminal authentication and CVC certificates.