PACE

PACE is the protocol that opens a secure, encrypted channel with a passport or ID card chip before any data is read.

A password-authenticated key agreement protocol that a chip reader (a terminal) and the contactless chip inside an electronic machine readable travel document (eMRTD) or an electronic identity card run before the reader is allowed to read anything off the chip. Both sides prove they know the same password and, in the process, agree on strong session keys that encrypt everything read afterwards - so nobody merely holding the document has to trust the radio link itself.

Which password is used depends on what the reader is authorised to see:

• CAN (Card Access Number): a short number printed on the card, used for simple access such as tapping the card at a self-service kiosk.
• MRZ-derived key: a key computed from the machine-readable zone, used when the reader has optically scanned the document first, as at a passport gate.
• PIN: a secret chosen by the holder, used for online authentication with an eID card, where a higher level of assurance is required.

PACE was developed for the German electronic identity card and is specified in BSI Technical Guideline TR-03110; ICAO later adopted it into Doc 9303 as the successor to BAC, the older and cryptographically weaker access-control scheme for eMRTD chips. It matters wherever an identity verification flow reads an identity document chip over NFC, including scenarios feeding into wallet or eID onboarding.

Note: passing PACE only proves the reader and the chip share the right password and establishes an encrypted channel - it does not by itself prove the chip's data is genuine. That separate check is done through passive authentication of the chip's signed data and, where supported, chip authentication.