NFC / eMRTD
Server-side eMRTD ingest with Passive & Active Authentication.
Engine
src/lib/verification/nfc-emrtd (ICAO 9303 PA/AA, pkijs, Web Crypto)
API
POST /api/public/emrtd/ingest
Roadmap service — not part of the Veridexa launch
NFC / eMRTD is on the Veridexa roadmap. It is not offered commercially today: no certified engine, hardware, or trust anchors are integrated, and nothing on this page should be read as an available production capability. The contracts, storage schema, and API surface documented below exist so a certified provider can be integrated later without call-site changes. Mock adapters are used for tests only and never produce verification evidence.
Live Veridexa services today: Document Fraud Detection, Face Verification, and Biometric Portrait Consistency.
Because browsers can't speak ISO-DEP/APDU to an ICAO 9303 chip, chip reading happens on an external native client and the data groups are POSTed to Veridexa. The server verifies Passive Authentication (DG hashes against SOD, DSC signature via pkijs) and Active Authentication (challenge–response over RSA or ECDSA via Web Crypto), and parses the TD3 MRZ from DG1.
What is implemented
- HMAC-SHA256 request-signature verification
- Passive Authentication (DG1/DG2/DG3/DG7/DG11/DG12 vs SOD)
- DSC signature validation via
pkijs - Active Authentication (RSA + ECDSA) via Web Crypto
- TD3 MRZ parser + TLV metadata extraction
Endpoint & modules
POST /api/public/emrtd/ingest
src/lib/verification/nfc-emrtd/
src/routes/api/public/emrtd/ingest.ts