BAC

BAC (Basic Access Control) lets a passport chip check the reader is authorised before releasing data. Used in eMRTDs, now being replaced by PACE.

Basic Access Control (BAC) is a security protocol that protects the contactless chip inside an electronic machine readable travel document (eMRTD) - a passport or similar identity document - from being read by anyone who does not physically hold the document. Before the chip releases any data, the reader must prove it knows secret values that can only come from optically scanning the machine-readable zone (MRZ) on the printed data page: the document number, the date of birth and the date of expiry.

From those three values the reader derives a pair of symmetric keys and runs a mutual authentication and key-establishment exchange with the chip. Only once that exchange succeeds does the chip open an encrypted channel and hand over its contents, which is why BAC is described as an access control rather than a signature or encryption scheme in its own right.

BAC has been in place since the mid-2000s, but its reliance on printed data with comparatively low entropy - especially older document numbers - made it vulnerable to guessing and eavesdropping attacks. ICAO has since standardised Password Authenticated Connection Establishment (PACE) as a stronger replacement; both protocols are specified technically in ICAO Doc 9303, while the phase-out timetable is set separately in ICAO Annex 9 (Facilitation). Under Annex 9, section 3.13.1, contracting states that issue eMRTDs must implement PACE by 1 January 2027; no new BAC-only eMRTDs may be issued after 1 January 2028, and BAC-only chips already in circulation are to be fully retired by 2038.

Note: BAC controls who may read the chip, not whether the data on it can be trusted. That second question is answered separately, by passive authentication, which checks a signature from the issuing country over the stored data.