NFC Chip Authentication

Validate the authenticity of NFC-enabled identity documents in GBG GO using cryptographic chip checks against passive, active, and chip cloning attacks.

The NFC Chip Authentication module validates the authenticity of identity documents that contain an embedded NFC (Near Field Communication) chip.

NFC Chip Authentication

Validates the authenticity of identity documents that contain an embedded NFC (Near Field Communication) chip. The module performs cryptographic checks against the embedded chip, each targeting a different threat vector, and aggregates them into an overall result that fails if any single check fails.

Capabilities

The module returns the NFC Chip Authentication capability.

NFC Chip Authentication

This capability provides the aggregate outcome of all NFC chip authentication checks. It fails if any of the three individual authentication checks (passive, active, or chip) fails. This is the primary capability used in evaluation and routing logic.

Value	Description
PASSED	All individual authentication checks passed. The chip is genuine, the data is authentic and unmodified, and the chip has not been cloned.
FAILED	One or more individual authentication checks failed. The document’s NFC chip could not be fully validated.
ERROR	The overall authentication could not be completed due to a technical issue.

Overall Authentication Result

The aggregate outcome of all NFC chip authentication checks. It fails if any of the three individual authentication checks (passive, active, or chip) fails, and is the primary capability used in evaluation and routing logic.

Value	Description
PASSED	Passed
FAILED	Failed
ERROR	Error

Active Authentication Result

Returns the result of Active Authentication.

Value	Description
PASSED	Passed
FAILED	Failed
ERROR	Error

Passive Authentication Result

Returns the result of Passive Authentication.

Value	Description
PASSED	Passed
FAILED	Failed
ERROR	Error

Chip Authentication Result

Returns the result of Chip Authentication.

Value	Description
PASSED	Passed
FAILED	Failed
ERROR	Error

Input payload

The following is a sample payload used to submit NFC chip data to the NFC Chip Authentication module for processing.

JSON

{
  "resourceId": "<resourceId>",
  "context": {
    "config": {
      "delivery": "api"
    },
    "subject": {
      "documents": [
        {
          "mrz": "<string>",
          "chip": {
            "lds": [
              {
                "name": "<string>",
                "data": "<base64-encoded string>"
              }
            ],
            "auth": [
              {
                "type": "<string>",
                "result": "<string>"
              }
            ]
          }
        }
      ]
    }
  }
}

Field	Required	Description
mrz	Yes	The machine-readable zone string extracted from the document. Used to establish a secure communication channel with the chip.
chip.lds	Yes	An array of Logical Data Structure (LDS) entries read from the chip. Each entry contains a name identifying the data group and a base64-encoded data payload.
chip.auth	Yes	An array of authentication check results performed during the chip reading process. Each entry contains a type identifying the check and a result indicating its outcome.

Sample response

The following is a sample response for a successfully authenticated NFC chip.

JSON

{
  "response": {
    "advice": {
      "authenticationResult": "PASSED",
      "activeAuthenticationResult": "PASSED",
      "passiveAuthenticationResult": "PASSED",
      "chipAuthenticationResult": "PASSED"
    },
    "outcome": "Passed"
  }
}