ICAO 9303

What Is ICAO 9303?

ICAO Doc 9303 is the international specification published by the International Civil Aviation Organization that defines Machine Readable Travel Documents (MRTDs), including ePassports, machine readable visas, and travel cards. The standard specifies the physical document format, the machine readable zone (MRZ), the contactless chip data structure, biometric storage formats, and the security protocols that protect chip-stored data from unauthorized access and cloning.

ICAO 9303 is the foundation standard that every ePassport-issuing country must implement, ensuring global interoperability at border control points worldwide.

Document Structure

An ICAO 9303-compliant ePassport contains both physical and electronic security features:

Logical Data Structure (LDS)

The chip stores data in numbered Data Groups (DGs):

The SOD contains hashes of all data groups signed by the issuing country's Document Signer certificate, which chains to the Country Signing CA (CSCA). This PKI structure allows any receiving country to verify document authenticity.

Security Protocols

ICAO 9303 defines a layered security model:

• BAC (Basic Access Control) -- derives session keys from MRZ data (document number, date of birth, expiry date) to prevent unauthorized skimming.
• PACE (Password Authenticated Connection Establishment) -- stronger alternative to BAC using Diffie-Hellman key agreement.
• Active Authentication -- the chip proves it is genuine by signing a challenge with its private key (anti-cloning).
• Chip Authentication -- establishes a strong session key using the chip's Diffie-Hellman key pair.
• Terminal Authentication -- the inspection terminal presents a CVC certificate chain proving authorization to read sensitive biometrics (DG3, DG4).