Configurable-challenge-for-Active-Authentication

[Premeide]

• Add option for providing custom aaChallenge

[AndyQ]

Hi, Could you explain why this is useful and needed?

[Premeide]

Hi, Could you explain why this is useful and needed?

As an extra security feature, our backend now provides a unique active authentication challenge for the NFC reader to sign. By using a custom AA challenge, we ensure that the challenge/response was specifically executed in the session and not replayed. The app then sends the NFCPassportModel.activeAuthenticationSignature to the backend, along with the rest of the chip data. This requires the NFCPassportReader to optionally accept a custom aaChallenge.

This challenge/signature verification ensures that the app user has actually scanned the passport to retrieve the data, preventing the use of stored passport data.

[vpetrusevici]

Hi, @AndyQ !
It's really important security feature to make passport based authentication without replay attack vulnerability.
Can we merge this PR please?

[ospfranco]

This has been open for over a year and it's actually quite necessary from a security point of view. Any chance this can be merged soon @AndyQ ?

[AndyQ]

Yes indeed - it will be merged soon and will be in the next release.

I'll try to get it merged this week so it's in main at least. Next release will hopefully be out by next week.

[ospfranco]

Awesome! It would be great if #261 can also be merged, current install takes ages as it clones a huge repo

[AndyQ]

Sure will also look at including that PR too