Part 2 of 6 · Biometric Identity Programme Series — next: Biometric Deduplication at Population Scale

Reading eMRTD Chips on a Biometric Terminal

By Xinhong Smart Engineering Team · Published 31 October 2026

Quick answer: A terminal that reads the printed MRZ and photographs the portrait is doing an optical check, not a chip check. ICAO Doc 9303 gives the chip its own chain: Passive Authentication proves the data was signed by the issuing state, BAC or PACE controls who may open the chip, and Chip Authentication proves the chip is not a clone. Specify which of those a programme requires, because each one needs certificates and keys the terminal has to hold. A device that supports only BAC cannot perform PACE, and one without terminal certificates will fail Extended Access Control.

Chip reading is where document verification stops being a scanner problem and becomes a key-management problem. The hardware is the easy half.

What is actually on the chip

ICAO Doc 9303 defines the specifications for machine readable travel documents, including the chip data structure, how biometrics are stored, and the security protocols built on top. The chip carries a logical data structure: the machine-readable zone data, the encoded face image, optionally fingerprints, and a document security object that holds hashes of those groups and is signed by the issuing state or organisation.

Reading the group that holds the face image lets you compare the chip portrait against the person in front of the terminal. That comparison is the point of a biometric terminal at a counter; the printed portrait cannot be compared in the same way.

The protocols, in the order a terminal needs them

Passive Authentication is the baseline: verify the document security object against the country signing certificate and re-hash the data groups. It proves the data has not been altered since issuance. It does not prove the chip is genuine, because a cloned chip replays signed data perfectly.

Basic Access Control and PACE are access-control protocols. Both derive a session key from the machine-readable zone; PACE was introduced as the stronger replacement, and it is what newer documents use. Chip Authentication proves the chip holds the private key it claims, which is what closes the cloning gap. Terminal Authentication proves to the chip that the terminal is authorised to read the sensitive groups, and it needs a certificate chain issued for that purpose.

Extended Access Control builds on PACE, Chip Authentication and Terminal Authentication together. If a programme calls for EAC, the terminal must support all three and must be enrolled with the right certificates before it goes into service.

What the hardware has to do

The reader is a 13.56 MHz NFC interface to an ISO/IEC 14443 contactless chip, placed where a passport book can lie flat. In practice that means the antenna position and the mechanical design decide throughput: a counter where staff hold a passport against a device for eight seconds per travel document is a design failure, not a protocol problem.

Key storage is the other half. Terminal Authentication requires certificates held on the device or on a backend the device can reach, with a renewal process. Plan the renewal while specifying the terminal, because an expired terminal certificate stops the counter on a date nobody remembers choosing.

What breaks in the field

Machine-readable zone capture is the usual source of failure: a worn laminate, a photocopy, a curved page, or a document held at an angle. Terminals that read the MRZ optically need good illumination and a fixed holder; terminals that take it from a backend database need the connectivity to be there. Second is coverage: the certificate set has to be updated as issuing states publish new ones, or valid documents start failing authentication for no visible reason.

What Xinhong ships

We integrate the NFC reader and antenna into the terminal housing and wire the document reading SDK, so the same device captures the chip data, the face and, where the programme requires it, the fingerprint. We do not claim to support a protocol the build has not been tested against. What we can do is state which protocols the build performs, supply the certificate handling your programme uses, and demonstrate the full chain on your own sample documents before the order.

Frequently asked questions

Is reading the MRZ enough?

No. The MRZ is printed data; anyone can reproduce it. It is used to derive the access key for the chip, and the value of the check comes from what happens after the chip opens: Passive Authentication, and ideally Chip Authentication.

What is the difference between BAC and PACE?

Both derive a session key from the machine-readable zone to open the chip. PACE is the stronger, newer protocol and is the basis documents built to recent editions of Doc 9303 use. A terminal that only implements BAC cannot open a document that requires PACE.

Do we need Terminal Authentication?

Only if the programme reads the protected data groups, typically fingerprints. If the check is limited to the face image and the MRZ data, Passive Authentication plus access control is usually the scope. If fingerprints are involved, the terminal needs Terminal Authentication certificates and a renewal process.

Why does a valid document sometimes fail?

Most often the MRZ was read incorrectly, so the derived key is wrong; second most often the country signing certificate set on the device is out of date. Both are operational issues with operational fixes: a fixed document holder with consistent lighting, and a documented schedule for updating certificates.

Can one terminal do chip reading and fingerprint capture?

Yes, and it is the usual configuration for a supervised counter: NFC reader for the document, fingerprint module for the person, camera for the face. The constraint is mechanical, not logical: the antenna, the platen and the camera have to be reachable in one motion by the person sitting at the counter.