Configurable-challenge-for-Active-Authentication

[Premeide]

• Add option for providing custom aaChallenge

[AndyQ]

Hi, Could you explain why this is useful and needed?

[Premeide]

Hi, Could you explain why this is useful and needed?

As an extra security feature, our backend now provides a unique active authentication challenge for the NFC reader to sign. By using a custom AA challenge, we ensure that the challenge/response was specifically executed in the session and not replayed. The app then sends the NFCPassportModel.activeAuthenticationSignature to the backend, along with the rest of the chip data. This requires the NFCPassportReader to optionally accept a custom aaChallenge.

This challenge/signature verification ensures that the app user has actually scanned the passport to retrieve the data, preventing the use of stored passport data.