A note on the protection level of biometric data in electronic passports

Abstract

Following regulations of the EU Council in 2004, the member states have deployed electronic passports according to ICAO standards. Such documents contain an embedded radio frequency chip for storing personal data. The chip of a first generation German passport only duplicates the information which is already printed on the passport. In the current second version there are now also two fingerprints as additional biometric attributes apart from the digital facial image of the document owner. The note at hand concentrates on attack vectors of biometric characteristics contained in the RF chip and discusses which threats towards fingerprints are thwarted. Our gist is to point to the low protection level of the facial image on the one hand and the high protection level of fingerprints on the other hand although both biometric characteristics are easy to gather.