Standards
EN 18246: Data Authentication and Integrity
FprEN 18246 governs authenticating passport data and proving it has not been tampered with — verifiable credentials, eIDAS, Visible Digital Seal and audit records.
Anyone reading a passport wants to know two things: does this data really come from the operator it claims, and has it changed since publication? FprEN 18246 defines the authentication and integrity layer that answers both. Publication is expected in autumn 2026.
What it proves — and what it does not
A digital signature proves that data was signed by the stated party and has not changed since. It does not prove the content is correct; that comes from the evidence file and verification processes. See DPP data quality management.
Approaches
| Approach | When it fits |
|---|---|
| W3C Verifiable Credentials | Decentralised ecosystems, role attestations. See verifiable credentials |
| eIDAS electronic seal | Most aligned with the EU legal framework. See eIDAS and signing |
| ISO 22376 Visible Digital Seal | Scenarios requiring offline verification |
| ISO/IEC 20248 | Signing the content of the data carrier itself |
Carrier security
EN 18246 covers the data carrier too. A copyable QR code is a weakness in counterfeiting scenarios. Answers include signed carrier content, cryptographic NFC chips and server-side scan analytics. See fighting counterfeits with a DPP and NFC and RFID for DPP.
Audit records
Who changed which field, and when? That record is needed for both audits and trust, and works together with versioning. See audit trails and versioning.
Implementation advice
- Design key management up front: signing keys must remain verifiable for the product's lifetime.
- Sign at publication: each version carries its own signature.
- Offer a verification interface: a reader should be able to verify independently.
- Plan key rotation: old signatures must stay valid.
Frequently asked questions
Is signing mandatory?
It becomes a practical requirement once the standard is published and legislation cites it. Even today it is a strong trust differentiator. See DPP verification and digital signatures.
Is blockchain required?
No. Signed versions and verifiable credentials are sufficient for integrity.
Can I have suppliers sign their data too?
Yes, and it is good practice: receiving a supplier declaration as a signed credential strengthens the evidence chain. See collecting data from suppliers.
