PACE

Password Authenticated Connection Establishment

PACE (Password Authenticated Connection Establishment) is a cryptographic protocol that establishes an authenticated and encrypted session between a smart card and a terminal using a shared password or PIN. Defined in BSI TR-03110 and adopted by ICAO for machine-readable travel documents, PACE replaces the older BAC mechanism with stronger security guarantees rooted in modern elliptic-curve Diffie-Hellman key agreement.

How PACE Works

The protocol begins when a terminal reads a short secret from the card holder -- typically the CAN (Card Access Number) printed on the card face, or the MRZ data from an ePassport. The card generates an encrypted nonce using AES or 3DES under a key derived from the shared secret. Both parties then execute a Diffie-Hellman key agreement on an ephemeral domain parameter set, producing session keys for secure messaging. Because the protocol uses ephemeral keys, even if an attacker records a session, offline dictionary attacks against the password remain computationally infeasible.

PACE vs BAC

BAC derives session keys directly from the MRZ data through a simple challenge-response exchange, leaving it vulnerable to offline brute-force attacks if the eavesdropper captures the initial handshake. PACE mitigates this by introducing an additional Diffie-Hellman round that provides forward secrecy. The European Union mandated PACE for all new eID cards, and ICAO recommends it as the preferred access control mechanism for ePassports issued after 2015. Most modern dual-interface modules used in government ID programs include PACE support in their firmware.

Implementation Considerations

Smart card implementations of PACE typically leverage the on-chip crypto coprocessor for the elliptic-curve operations, with common curves including Brainpool P-256 and NIST P-256. The protocol supports multiple mapping variants -- Generic Mapping (GM), Integrated Mapping (IM), and Chip Authentication Mapping (CAM) -- allowing card issuers to balance security level against chip performance constraints. Terminals must implement the full protocol stack to interoperate with PACE-enabled cards at border-control gates and eID readers.