Fake Taiwanese Passports? From Paper Security to Chip Verification and Personhood Credentials

Original Facebook post

https://www.facebook.com/maxchou415/posts/pfbid0tJijy4kFm3DsnQFC3cvkCDqzpjf3LyhPEG6D3rYE81dGwg8w27JHef8Uqac3vE2fl

I saw this on Facebook a couple of days ago and thought I would write about it. Passports are the basis for uniqueness in our personhood credentials, so about 18 months ago I spent a fair amount of time wrestling with them. Let me explain how passport verification works first. The most basic way to use a passport is to look at the information in that little booklet. First you check its physical condition: damage, missing pages, or signs of tampering, such as alterations, chemical treatment, or a replaced photo page. The booklet also has extra security features: watermarks, fluorescent threads, special inks, and so on. Border officers use ultraviolet and infrared light to inspect them. When a foreign passport is scanned, the computer pulls up the exact template for that country and passport series, then compares the text placement, ink patterns, and holographic elements. What the post means by a fake passport is that all those visible features have been imitated. The original post includes a video showing the passport's features under UV light. These really can work at border checkpoints without a complete verification system, where the chip cannot be verified. After all, we all have trouble telling faces apart. I cannot tell which country someone from the Middle East is from just by looking at them, much like people who say they cannot tell Japanese, Chinese, and Korean people apart. So as long as the person holding the passport looks roughly like the photo inside, the passport is clean and has all the security features, and the person is not on an entry ban list, the border lets them through.

Taiwan's second-generation biometric passport dates to December 2017. Its chip contains a signature made with Taiwan's private key, which means any border crossing with a reader and the public key can check whether Taiwan actually issued the passport. This is how iamhuman.link verifies passports. From what the passport seller said, it sounds like they have access to a way of printing them. There are two ways to read the claim about replacing the chip. One is that “chip replacement” means they did not print the passport themselves but got it through some other channel. For example, some people wondered whether passports reported lost while being handled by travel agencies could be the source. But that would mean altering an existing passport: keeping it looking untouched, changing its contents, and getting everything done in ten working days. Given how new the passport looks in the video, that seems unlikely to me. So my reading is that they can print the booklet, but the chip is not an official Taiwanese chip. The concern raised in the original post is that the seller said they could make a Taiwanese biometric passport, so we could speculate that a private key from 2020 might have leaked (guessing from the year on the passport in the video). Another possibility is that the seller just wants to make US$25,000 and is saying whatever comes to mind. There are two layers to whether the chip's data is valid: whether the data has been tampered with, and whether it was signed with the official private key. If the data has been tampered with, the passport is definitely invalid, and a border crossing with the equipment will not let it through. But checking whether the signature comes from the official private key is not necessarily done, because not every border crossing has the DER certificate for every passport issuer. And some save money by buying cheap equipment and chips, so you get failures, verification errors, and loading screens that are still there after you have gone to the bathroom and come back. In that situation, as long as this is not the passport's own country, the border still has to operate, so they fall back on manual inspection, following the process I described in the previous paragraph. Thinking about it this way, iamhuman's passport-anchored personhood credentials actually have a higher level of security, because verification against the issuer's DER certificate is mandatory. This was probably why I got stuck at passport control in Casablanca for so long some years ago;

So this seller may very well just be thinking: you take the risk, I get paid; it does look like the paper passport has been imitated. If a future passport version can put additional biometric data into the chip, such as fingerprints, that would make this method of forgery even less effective.