Terminal Authentication Settings

The Terminal Authentication Settings define how the Inspection System Service performs Terminal Authentication (EAC) for ePassports. This section is available only when the EPASSPORT_EAC feature is enabled. Terminal Authentication is used to securely access sensitive biometric data stored on the ePassport chip by allowing the Inspection System to authenticate itself to the chip using a valid certificate and private key.

In this process, the Inspection System Service uses its configured signing certificate and private key to generate a signature required by the ePassport chip. Depending on the configuration, either the terminal reader or the Inspection System Service computes the data to be signed. These settings ensure secure and flexible handling of authentication requests, while complying with EAC standards and supporting different reader capabilities.

Navigate to Inspection System Service 🡪 Inspection System Profiles 🡪 Terminal Authentication Settings, it displays the following screen:

The configuration items are as follows:

Items

Description

TA Signing Certificate

Select the Inspection System certificate that will be used to sign Terminal Authentication requests. This certificate must be created with the Inspection System purpose.

RSA Signature Padding Scheme

Specifies the padding scheme to be used for RSA-based signatures. Available options include PKCS#1 v1.5 and PSS, depending on security and compatibility.

If the Inspection System certificate uses the ECDSA algorithm, the RSA Signature Padding Scheme field will not be displayed.

Hash Computation Mode

Defines how the data to be signed is prepared.

Terminal Reader computes hash: The reader computes the hash (hashTBS) and sends it to the Inspection System for signing.
Inspection System Service computes hash at signing time: The reader sends the complete data, and the Inspection System computes the hash before signing
Hash Algorithm: It will only be visible when the above option i.e. Inspection System Service computes hash at signing time' is selected. The user can select the required Hash Algorithm from:

SHA1
SHA224
SHA256
SHA384
SHA512

Only SHA-1 and SHA-3 algorithms are supported. However, SHA-3 algorithms are not available for selection in the Hash Algorithm field..

Once the required configurations are completed, click on the (>) to navigate to the PKD Data Downloading Settings page.