NFC / eMRTD
Server-side eMRTD ingest with Passive & Active Authentication.
Live Engine
Engine
src/lib/verification/nfc-emrtd (ICAO 9303 PA/AA, pkijs, Web Crypto)
API
POST /api/public/emrtd/ingest
Because browsers can't speak ISO-DEP/APDU to an ICAO 9303 chip, chip reading happens on an external native client and the data groups are POSTed to Veridexa. The server verifies Passive Authentication (DG hashes against SOD, DSC signature via pkijs) and Active Authentication (challenge–response over RSA or ECDSA via Web Crypto), and parses the TD3 MRZ from DG1.
What is implemented
- HMAC-SHA256 request-signature verification
- Passive Authentication (DG1/DG2/DG3/DG7/DG11/DG12 vs SOD)
- DSC signature validation via
pkijs - Active Authentication (RSA + ECDSA) via Web Crypto
- TD3 MRZ parser + TLV metadata extraction
Endpoint & modules
POST /api/public/emrtd/ingest
src/lib/verification/nfc-emrtd/
src/routes/api/public/emrtd/ingest.ts