Maxim Tsvetkov - Using Core NFC to scan and verify identity documents [CococHeads NL 2020]

Since iOS 13 our iPhones are able to read ID cards and passports.

In this talk, you will discover what the system iOS framework gives you and what you need to add on top of it to scan and verify identity documents, what data you can extract from documents and how you can verify the authenticity of these documents. And, of course, you will see a live demo of scanning a real ID as well.

Join the talk to take away how Core NFC can improve user verification in your project.

Link to the video:

Transcript

1. CocoaHeadsNL 2020 Using Core NFC to scan and verify identity documents Maxim Tsvetkov @777maxxx777
2. User Identity Verification
3. User Identity Verification • Problem
4. User Identity Verification • Problem • Solution
5. User Identity Verification • Problem • Solution ◦ NFC
6. User Identity Verification • Problem • Solution ◦ NFC ▪ NFC in iOS ▪ NFC use cases
7. User verification process
8. User verification process App
9. User verification process App
10. User verification process App
11. User verification process App
12. User verification process App Verification
13. User verification process App Verification /
14. Problem
15. Problem • Human factor
16. Problem • Human factor • Technical reasons
17. Solution
18. Solution • Tech / UX
19. Solution • Tech / UX • Legal
20. NFC iPhone 7 (and up)
21. Near Field Communication Type 1 Type 2 Type 3 Type 4 Type 5 NFC Data Exchange Format (NDEF) Tag Types
22. Examples
23. Examples
24. Demo
26. Core NFC https://developer.apple.com/documentation/corenfc
27. Core NFC (iOS 11) • Reading NDEF formatted tag types (1 to 5) • Foreground mode only
28. Near Field Communication Type 1 Type 2 Type 3 Type 4 Type 5 NFC Data Exchange Format (NDEF) Tag Types
29. Core NFC (iOS 11) • Reading NDEF formatted tag types (1 to 5) • Foreground mode only
30. WWDC 2019 https://developer.apple.com/videos/play/wwdc2019/715/
31. Core NFC (iOS 13) • Reading NDEF formatted tag types (1 to 5) • Foreground mode only • Writing NDEF tags • Background NDEF reading (iPhones XS, XS Max, XR)
32. Core NFC (iOS 13) • Reading NDEF formatted tag types (1 to 5) • Foreground mode only • Writing NDEF tags • Background NDEF reading (iPhones XS, XS Max, XR) • Reading more complex tag types ◦ ISO7816 ◦ ISO15693 ◦ FeliCa ◦ MIFARE
33. Core NFC (iOS 13) • Reading NDEF formatted tag types (1 to 5) • Foreground mode only • Writing NDEF tags • Background NDEF reading (iPhones XS, XS Max, XR) • Reading more complex tag types ◦ ISO7816 ◦ ISO15693 ◦ FeliCa ◦ MIFARE
34. Core NFC (iOS 13) • Reading NDEF formatted tag types (1 to 5) • Foreground mode only • Writing NDEF tags • Background NDEF reading (iPhones XS, XS Max, XR) • Reading more complex tag types ◦ ISO7816 ◦ ISO15693 ◦ FeliCa ◦ MIFARE
35. Core NFC (iOS 13) • Reading NDEF formatted tag types (1 to 5) • Foreground mode only • Writing NDEF tags • Background NDEF reading (iPhones XS, XS Max, XR) • Reading more complex tag types ◦ ISO7816 ◦ ISO15693 ◦ FeliCa ◦ MIFARE
36. Core NFC (iOS 14) • Reading NDEF formatted tag types (1 to 5) • Foreground mode only • Writing NDEF tags • Background NDEF reading (iPhones XS, XS Max, XR) • Reading more complex tag types ◦ ISO7816 ◦ ISO15693 ◦ FeliCa ◦ MIFARE
37. Core NFC (iOS 13) • Reading NDEF formatted tag types (1 to 5) • Foreground mode only • Writing NDEF tags • Background NDEF reading (iPhones XS, XS Max, XR) • Reading more complex tag types ◦ ISO7816 ◦ ISO15693 ◦ FeliCa ◦ MIFARE
38. ISO 7816
39. How to use https://developer.apple.com/videos/play/wwdc2019/715/
40. Enable capabilities
41. Update privacy description in info.plist
42. Add application identifiers in info.plist
43. AID Name Description ... A0000002281010 SPAN (M/Chip) Saudi Arabia domestic credit/ debit card A0000002471001 Machine Readable Travel Documents (MRTD) Electronic (Biometric) Passport. A0000002771010 INTERAC Canadian domestic credit/ debit card ... Application identifiers https://www.eftlab.com/knowledge-base/211-emv-aid-rid-pix/
44. AID Name Description ... A0000002281010 SPAN (M/Chip) Saudi Arabia domestic credit/ debit card A0000002471001 Machine Readable Travel Documents (MRTD) Electronic (Biometric) Passport. A0000002771010 INTERAC Canadian domestic credit/ debit card ... Application identifiers https://www.eftlab.com/knowledge-base/211-emv-aid-rid-pix/
45. Add application identifiers in info.plist
46. Create session to poll for tags
47. Session
48. Core NFC (iOS 13) • Reading NDEF formatted tag types (1 to 5) • Foreground mode only • Writing NDEF tags • Background NDEF reading (iPhones XS, XS Max, XR) • Reading more complex tag types ◦ ISO7816 ◦ ISO15693 ◦ FeliCa ◦ MIFARE
49. Create session to poll for tags
50. Select polling options
51. Select polling options
52. Select polling options
53. Set up delegate methods
54. Start session
55. Detect tag
56. Connect to tag
57. Layers of implementation iOS Connect and communicate with NFC tag NFC Use cases App System Custom
58. Communicate with tag
59. Communicate with tag
60. Doc 9303 https://www.icao.int/publications/pages/publication.aspx?docnum=9303
61. Read data
62. Get access Less sensitive More sensitive Data
63. Get access Less sensitive More sensitive Basic Access Control Extended Access Control Data Privacy
64. Basic Access Control Symmetric cryptography Secure messaging
65. Password Authenticated Connection Establishment Asymmetric cryptography Secure messaging
66. Extended Access Control Chip Authentication Terminal Authentication
67. Chip Authentication Key-agreement protocol
68. Terminal Authentication /
69. Terminal certificate chain Country Verifying Certificate Authority Document Verifier Certificate Terminal Certificate Signed Signed
70. Terminal Authentication
71. Terminal Authentication Challenge–response authentication
72. Get access Less sensitive More sensitive Basic Access Control Extended Access Control Data Privacy
73. Data groups
74. Data groups DG3 DG1 DG4 DG2 DG5 DG6 DG7 DG8 DG11 DG9 DG12 DG10 DG13 DG14 DG15 DG16
75. Data groups DG3 DG1 DG4 DG2 DG5 DG6 DG7 DG8 MRZ Encoded Face DG11 DG9 DG12 DG10 DG13 DG14 DG15 DG16
76. Data groups DG3 DG1 DG4 DG2 DG5 DG6 DG7 DG8 MRZ Encoded Face Encoded Fingers Encoded Eyes Displayed Portrait Reserved for future use Displayed Signature DG11 DG9 DG12 DG10 DG13 DG14 DG15 DG16 Structure Features Substance Features Additional Personal Details Additional Document Details Optional Details Security Options Public Key for AA Persons to Notify Data Features
77. Bonus
78. Bonus • Authenticity verification
79. Bonus • Authenticity verification • Clone detection
80. Authenticity verification
81. Security Object Document (SOD) Hash (DG1) Hash (DG2) Hash (DG3) ...
82. Security Object Document (SOD) Hash (DG1) Hash (DG2) Hash (DG3) ...
83. Signing chain Country Signing Certificate Authority Document Signer Certificate SOD Signed Signed
84. Country Signing Certificate Authority (CSCA) https://www.icao.int/Security/FAL/PKD/BVRT/Pages/Access.aspx
85. Passive Authentication SOD from ID card CSCA from official sources
86. Security Object Document (SOD) Hash (DG1) Hash (DG2) Hash (DG3) ...
87. Security Object Document (SOD) Hash (DG1’) Hash (DG2) Hash (DG3) ...
88. Passive Authentication SOD from ID card CSCA from official sources
89. Clone detection
90. Clone detection
91. Clone detection Cloning
92. Clone detection Cloning !=
93. Clone detection • Active Authentication • Chip Authentication
94. Active Authentication /
95. Data groups DG3 DG1 DG4 DG2 DG5 DG6 DG7 DG8 MRZ Encoded Face Encoded Fingers Encoded Eyes Displayed Portrait Reserved for future use Displayed Signature DG11 DG9 DG12 DG10 DG13 DG14 DG15 DG16 Structure Features Substance Features Additional Personal Details Additional Document Details Optional Details Security Options Public Key for AA Persons to Notify Data Features
96. Active Authentication Challenge–response authentication
97. Chip Authentication /
98. Chip Authentication Key-agreement protocol
99. Data groups DG3 DG1 DG4 DG2 DG5 DG6 DG7 DG8 MRZ Encoded Face Encoded Fingers Encoded Eyes Displayed Portrait Reserved for future use Displayed Signature DG11 DG9 DG12 DG10 DG13 DG14 DG15 DG16 Structure Features Substance Features Additional Personal Details Additional Document Details Optional Details Security Options Public Key for AA Persons to Notify Data Features
100. Chip Authentication Key-agreement protocol
101. Data groups DG3 DG1 DG4 DG2 DG5 DG6 DG7 DG8 MRZ Encoded Face Encoded Fingers Encoded Eyes Displayed Portrait Reserved for future use Displayed Signature DG11 DG9 DG12 DG10 DG13 DG14 DG15 DG16 Structure Features Substance Features Additional Personal Details Additional Document Details Optional Details Security Options Public Key for AA Persons to Notify Data Features
102. User verification process App Verification /
103. User verification process with NFC App Verification v.2 /
104. Layers of implementation iOS Connect and communicate with NFC tag NFC Use cases App
105. Open source https://github.com/AndyQ/NFCPassportReader
106. Conclusion
107. Conclusion • Identity verification is not perfect
108. Conclusion • Identity verification is not perfect • NFC as a solution
109. Conclusion • Identity verification is not perfect • NFC as a solution • Based on Core NFC
110. Conclusion • Identity verification is not perfect • NFC as a solution • Based on Core NFC • Custom implementation of reading documents data
111. Conclusion • Identity verification is not perfect • NFC as a solution • Based on Core NFC • Custom implementation of reading documents data • Authenticity verification and clone detection
112. Conclusion • Identity verification is not perfect • NFC as a solution • Based on Core NFC • Custom implementation of reading documents data • Authenticity verification and clone detection • Doc 9303 is your best friend
113. Conclusion • Identity verification is not perfect • NFC as a solution • Based on Core NFC • Custom implementation of reading documents data • Authenticity verification and clone detection • Doc 9303 is your best friend • Open source project as a first step
114. Conclusion • Identity verification is not perfect • NFC as a solution • Based on Core NFC • Custom implementation of reading documents data • Authenticity verification and clone detection • Doc 9303 is your best friend • Open source project as a first step
115. Conclusion • Identity verification is not perfect • NFC as a solution • Based on Core NFC • Custom implementation of reading documents data • Authenticity verification and clone detection • Doc 9303 is your best friend • Open source project as a first step @777maxxx777