Document Authenticity Verification Requirements

For Physical Document test: Functionality to perform the Physical Image tests for document-only evaluation, according to specifications defined in section § 8 Physical Document Tests.

1. Device application software for each supported platform that supports:

   1. Document image capture (either via on-device or connected camera).

   2. Document image processing for document authentication purposes

   3. Version of a cloud service provided to the laboratory, either cloud or localized version which is meets the following

      1. It SHALL be in complete control of the FIDO Accredited Laboratory,

      2. Vendor SHALL not have access during testing.

      3. Testing images and any other personal data SHALL not be stored for later use by vendor or shared with the vendor in any other way.

   4. Provides results to the FIDO Accredited Laboratory, including:

      1. Document failure to acquire/process (optional).

      2. Success/failure of document authentication.

Note: Any cloud version of software SHALL be in complete control of the vendor and which the vendor has no access during testing. This is required by [ISOIEC-17025-2017] to ensure the integrity of the test, and ensures privacy of test subjects. Note: Both the Digital Document Images test and the Physical Document test are mandatory for all certifications. A test plan should cover plans and execution for both.

6.1. Security Guidelines

For security purposes, all test subject data collected by the FIDO Accredited Laboratory or the vendor during testing should be treated confidentiality and data shall be protected using cryptographic algorithms listed within the FIDO Authenticator Allowed Cryptography List.

The FIDO Accredited Laboratory and vendor SHALL report to FIDO the process used to help assure TOE consistency and security. See the [DA-CertPolicy] for details.

7. Digital Document Images Test

This section provides a testing plan using digital images of identity documents, covering genuine documents and inauthentic documents.

Scanned/photo captured images of genuine documents are considered genuine documents as part of the Digital Document Images Test. A photo capture of a photocopied genuine document shall not be included in the test sample for the digital document image test. A photo capture of a photocopied tampered document can be included in the test sample for the digital document image test as part of the inauthentic document images.

Inauthentic document images can be scanned/captured from inauthentic documents, or digitally manipulated document images.

The evaluation measures DFRR as well as the DFAR.

Digital Document Images Testing shall be completed using the following approach.

Digital Images tests shall not consider Failure-to-Acquire Rate, but shall assume that the FIDO Accredited Laboratory collects images that are suited for the vendor’s specifications. Images rejected due to quality issues when images are compliant with vendor requirements should be considered false rejections if they are genuine or correct rejections if they are frauds.

7.1. Test Environment

No test subjects are required. This procedure will require the document images to be properly classified.

Vendors SHOULD provide a tool to use to input the test samples in the defined format and organization, perform the document authentication process, and deliver a result as specified.

• Test samples are collected or prepared by the FIDO Accredited Laboratory, as described in section § 7.2 Test Sets.

• Vendor tool will use as input the test samples properly structured and formatted as defined section § 6 Common Test Harness.

• Vendor tool will provide a response for each test sample with the defined format.

7.2. Test Sets

The Test Sets are:

• The set of images of inauthentic documents gathered for evaluation.

• The set of images of genuine documents gathered for evaluation.

The FIDO Accredited Laboratory is responsible for independent acquisition of the test set in advance of the tests, and vendors SHALL NOT have access to the test sets being used.

The test set SHALL cover every document type that the vendor has requested to be certified. The list SHALL specify document type and all versions that are in circulation of that ID document.

Inauthentic documents shall include examples of false documents as described in § 7.2.1.1 Test Set Preparation for Document Fraud Attacks.

For genuine documents, the test set shall have a minimum size of 10 images per document type, limited to 1 image per each document that a participant contributes to the test set.

At least one of each listed document type SHALL be included in the geniune test set. The composition of the test set for geniune documents SHOULD be reasonably balanced across document types and SHALL be approved by the FIDO Secretariat prior to testing. The exact composition of the test set SHALL be strictly confidential to the lab and FIDO and SHALL not be shared with the vendor prior to the test.

For inauthentic documents, the test set shall have a minimum size of 10 images per document type.

At least one of each listed document SHALL be included in the inauthentic document test set. The composition of the test set for inauthentic documents SHOULD be reasonably balanced across document types and SHALL be approved by the FIDO Secretariat prior to testing. The exact composition of the test set SHALL be strictly confidential to the lab and FIDO and SHALL not be shared with the vendor prior to the test.

The requirements on the test size have been developed under consideration of “Rule of 3” and “Rule of 30” as described in [ISOIEC-19795-1].

7.2.1. Quality of Images

Images SHALL be good enough quality to be processed. The lab SHALL ensure that the test set has realistic image quality requirements. Parameters shall be provided to vendor and at a minimum SHALL include:

• Resolution, at least 300 dpi.

• Lossless or no compression

• Absence of image noise such as glare, lighting, and blur unless the lab purposely includes this as part of Document Fraud Attack.

• Consistent cropping

• Absence of visual obstruction

• Absence of damage to the document

The quality characteristics of the test set SHALL be documented by the FIDO Accredited Laboratory and reviewed by the FIDO Secretariat prior to testing. FIDO Secretariat SHALL ensure that image quality are relevantly consistent between FIDO accredited laboratories.

7.2.1.1. Test Set Preparation for Document Fraud Attacks

To test frauds, the FIDO Accredited Laboratory will create a dataset of images of Document Attack Instruments. Typically, the FIDO Accredited Laboratory will create inauthentic documents, either digitally or capturing an image (either through a scanner or taking a photograph) of a physical document that has been tampered. Part of the test set SHALL include printing the digitally tampered document and recapturing through a scanner or mobile capture. This type of attack simulates a process that an attacker may follow. The FIDO Accredited Laboratory does NOT need to secure actual counterfeit documents to prepare the digital image database.

Document fraud attacks can be categorized by level of sophistication of the DAI species. The document image test set will represent these types of attacks as described below.

7.2.1.2. Levels of DAI Species {#levels-of-document-fraud-attack}

Level A

Level A attacks involve the creation and use of simple fabricated identity documents either without security features or in which static security features are simply printed on the document and do not change. Other basic checks like checksums and MRZ codes may or may not be correct. Use of expired or specimen (i.e., sample) documents is also a level A attack.

Attacks for physically tampered documents involve very simple manipulation of a genuine identity document, such as gluing a different identity photo over the document identity photo or manipulating data fields using common household materials and tools (e.g. whiteout, paper glued over data field, etc.).

Attacks can include images of inauthentic documents that are deliberately blurred in order to obscure fraud.

Level A attacks are in scope for testing.

Level B

Level B attacks involve the creation and use of a more advanced counterfeit document that contains security features, but those features may not be correct for the type of document used. Checksums and MRZ codes are correct.

Attacks for physically or digitally tampered documents involve more sophisticated manipulation of a genuine identity document, such as modifications using professional photo editing software like Photoshop. Checksums and MRZ codes may not be correct.

Attacks can include images of inauthentic documents that are deliberately blurred in order to obscure fraud.

Level B attacks are in scope for testing.

Level C

Level C attacks require expert creation of an inauthentic document that looks like the real document and has formatting as well as security features that emulate the genuine document. Checksums and Machine-Readable Zone (MRZ) codes have the correct format.

Attacks for physically or digitally tampered documents involve sophisticated modifications of a genuine identity document. Attackers may insert a new photo under security features, use specialized foils to recreate security features, or change data fields using the correct font and other sophisticated methods.

Attacks can include images of inauthentic documents that are deliberately blurred in order to obscure fraud.

Level C attacks are in scope for testing.

Level D

Level D attacks are typically state sponsored in nature, organized malicious actors with access to creation of genuine documents or large criminal organizations and involve very state-level counterfeit documents that can only be detected by specialized equipment or additional means such as black/white lists or origins tests. This includes creating attacks based on tampered or cloned identity chips (which may communicate with NFC).

Level D attacks are currently out of scope for testing.

7.2.2. Digital Reporting Requirements

The following SHALL be included in an Evaluation Report to the vendor:

• Summary of the FIDO Certification and Requirements, including versions of the Requirements (this document) and the [DA-CertPolicy] used at the time of testing

• List of documents supported and tested,

• Number of documents tested for each document supported

• Description of the test environment

• Description of the test platform

• Number of genuine document verification transactions

• Number of inauthentic document verification transactions

• Number and description of document fraud attacks

• Document False Acceptance Rate (DFAR) per level of sophistication

• Document False Rejection Rate (DFRR) per level of sophistication

• A final verdict on whether the TOE complies with the requirements

Please note that the log SHALL also include all information about the Fraud Detection tests.

7.3. Testing

The vendor tool will be configured to use the samples set provided by the FIDO Accredited Laboratory and be executed to launch the document authentication process for each one of the samples.

For each test sample, the TOE will provide an authentication result (accept or reject), which will enable the FIDO Accredited Laboratory to confirm the correct or wrong authentication result.

A test is considered a failure when a) the system does not classify a genuine document as being authentic (DFRR), or b) a false document is classified as being authentic (DFAR).

Vendors may have solutions which can adjust the threshold which changes the risk tolerance. The TOE shall be configured at a fixed threshold for certification and shall be used for the entire test. If a vendor would like certification at multiple settings, the vendor SHALL submit multiple TOEs for certification.

7.3.1. Evaluation with Genuine Document Images

7.3.1.1. Document Verification Transaction

For each document verification attempt, the test operator SHALL conduct a Document Verification Transaction for each genuine document Image. The transaction processing time SHOULD NOT exceed 30 seconds.

7.3.1.1.1. Genuine Document Errors

A document failure to acquire SHALL be declared when the document authentication system is unable to process the document during a transaction. The document verification test harness SHALL indicate to the FIDO Accredited Laboratory when a failure to acquire has occurred. If at least one failure to process or acquire is recorded, the FIDO Accredited Laboratory SHALL confirm that the image format meets the criteria defined in the § 5 TOE Description. If the image format is confirmed to meet the requirements, each failure to acquire SHALL be counted as a genuine document error.

Note: A failure to acquire in a digital image test is mostly likely a failure to process.

A genuine document error SHALL be declared if the document authentication system produces a reject decision.

The manner in which the FIDO Accredited Laboratory records failure to acquire and genuine document errors are left to the FIDO Accredited Laboratory, but SHALL be done automatically to avoid introducing human error.

7.3.1.1.2. Document False Reject Rate (DFRR)

Document False Reject Rate (DFRR) SHALL be calculated according to requirements in section § 4.1.1 Document False Reject Rate (DFRR).

7.3.2. Evaluation with Document Attack Instruments (DAI) Images

A minimum of 10:1 images of Document Attack Instruments (DAI) to document type SHALL be created which reasonably covers varying geographies and identities, based on the Level 3 and Level 4 documents that are supported by the TOE.

The Inauthentic Test Set SHALL contain:

1. At least 30% DAIs at Level A representing at least 10 or more DAI Species (e.g. varying font, physical versus digital tampering).

2. At least 30% DAIs at Level B representing at least 10 or more DAI Species (e.g. physical versus digital tampering).

3. At least 10% DAIs at Level C representing at least 1 or more DAI Species (e.g. physical versus digital tampering).

Procedures and materials to create the DAI SHALL be provided to the FIDO Secretariat. The FIDO Secretariat SHALL ensure that DAI species selected and created (1) reasonably cover geographies and document types and (2) are relatively equivalent between laboratories.

7.3.2.1. Document Verification Transaction

For each document verification attempt, the test operator SHALL conduct a Document Verification Transactions for each Document Attack Instrument. The transaction processing time SHOULD NOT exceed 30 seconds.

7.3.2.1.1. Inauthentic Document Errors

A document failure to acquire SHALL be declared when the document authentication system is processing the document during a transaction. The document verification test harness SHALL indicate to the laboratory when a failure to acquire has occurred. Each failure to acquire SHALL be counted as a correct document fraud rejection.

Note: A failure to acquire in a digital image test is mostly likely a failure to process.

An inauthentic document error SHALL be declared if the document authentication system produces an accept decision when a DAI is used.

The manner in which the FIDO Accredited Laboratory records failure to acquire and impostor presentation attack errors are left to the FIDO Accredited Laboratory, but SHALL be done automatically to avoid introducing human error.

7.3.2.1.2. Document False Accept Rate (DFAR)

Document False Accept Rate (DFAR) SHALL be calculated according to requirements in section § 4.1.2 Document False Accept Rate (DFAR).

8. Physical Document Tests

This section focuses on testing genuine physical documents. The purpose of the physical document test is as follows:

• Reveal a solution inherent end-to-end document rejections, including capture failures (failure-to-acquire)

• Assess the impact of the capture system on the performance of underlying algorithm

For example, if the capture system is artificially too easy, this will result in poor images sent to the underlying algorithm and result and increased errors of the underlying algorithm.

The testing SHALL be performed by the FIDO Accredited Laboratory on the TOE provided by the vendor. The evaluation measures the Document False Reject Rate (DFRR), the Document Failure-To-Acquire rate (DFTA), and the Document Failure-to-Extract Rate (DFTE).

8.1. Test Environment

The test environment for Physical Document Tests SHALL represent typical operating conditions for normal usage of the solution.

8.1.1. Capture Devices

At least two device(s) shall be tested for each device category (laptop, tablet, mobile device) and platform supported by the solution provider. If the vendor supports web-browser and native apps, both SHALL be tested. The software provided by the vendor as part of the Test Harness SHALL be installed on the devices that the FIDO Accredited Laboratory provides.

The FIDO Accredited Laboratory SHALL maintain a collection of commonly used consumer devices of each device type and platform. The FIDO Accredited Laboratory SHALL periodically update the collection to reflect the current state of the device market, both for new and older devices.

8.1.2. Face Verification (Optional)

A related FIDO Certification Program is focused on performing face recognition from the image captured from the document compared with a "selfie" face image of the test subject. For a TOE that is undergoing both the Document Authenticity Verification and Face Verification Certification programs, the image captured from the document SHALL ensure there is at least 90 pixels between the eyes of the photograph of the individual.

8.1.3. Lighting

Lighting shall be representative of a typical office or residential environment with consideration to a range of lighting (luminosity, darkness) conditions considered appropriate by the FIDO Accredited Laboratory.

8.1.4. Pre-Testing Activities

The test organization shall take steps to ensure that the hardware/software is installed and configured appropriately and shall verify that the system is operating correctly.

Note: Installation, configuration, and verification of system operations may involve supplier(s).

8.2. Test Sets

The Test Set is the physical documents gathered for evaluation. The Test Crew shall provide their own identity documents for testing.

Any form of digital image (photocopies, printout of scanned image, scanned/photo captured images) are out of scope as part of the Physical Document Test.

Photocopies and printouts of scanned/photo captured images of genuine documents are not considered as inauthentic documents or document tampering. These are out of scope for the Physical Document Test since it is not a physical document.

A scanned/photo captured image of a physical document is out of scope for the Physical Document Test.

Such non-live images can make it easier to obscure tampering and may be easier to confuse with forgeries or counterfeit documents. This may be considered in future versions of the requirements. Tampered or inauthentic documents are further described in section § 3.3.2.2 Forgery/Tampering.

Scanned/photo captured images of genuine documents are considered genuine documents as part of the Physical Document Images Test. A photo capture of a photocopied _genuine_ document shall not be included in the test sample for the digital document image test. A photo capture of a photocopied _tampered_ document can be included in the test sample for the digital document image test as part of the inauthentic document images.

8.2.1. Size of Test Set

Number of genuine documents for each document type covered by a test SHALL be 10.

8.2.2. Test Crew and Associated Genuine Documents

The minimum number of subjects for a test (Test Crew) SHALL be 100. However, the number of subjects may be decreased if a subject is able to provide multiple documents from the supported list, e.g. a passport and a driver’s license. Each subject SHALL provide at least one genuine document from the list of supported documents provided by the vendor. The FIDO Accredited Laboratory SHALL make it clear to the test subject in the recruitment process that the test subject is required to bring a genuine document. For example, asking subjects to certify that their document is genuine prior to coming to the test. The FIDO Accredited Laboratory SHALL manually check the document to ensure it is a genuine document to the extent possible.

Test subjects SHALL be recruited such that the test set represents the document requirement as follows. The test set SHALL cover all categories and sophistication levels of documents (e.g. passports, national IDs, drivers licenses, documents with NFC, etc.) that are claimed by the vendor as described in Section § 3.3.3 Document Types, as well as be balanced across document categories. Documents included in the test set SHALL be in circulation at the time of the test.

The proposed composition of the test set SHALL be approved by the FIDO Secretariat prior to testing.

The population MAY be given a possibility to try and acquaint themselves with the TOE before starting to perform recorded document verification transactions. The population SHALL be motivated to succeed in their interaction with the TOE and they SHALL perform a large number of interactions with the TOE during a short period of time.

The laboratory test SHALL not damage the physical documents.

8.2.3. Population Demographics

The population SHALL be representative of the target market in relationship to age and gender. Age and gender recommendations MAY be taken from [ISOIEC-19795-5] for access control applications (Section 5.5.1.2 and 5.5.1.3).

8.2.4. Physical Reporting Requirements

The following SHALL be included in the Evaluation Report to FIDO and the Vendor:

• Summary of the FIDO Document Authenticity Verification Certification and Requirements, including versions of the Requirements (this document) and [DA-CertPolicy] used at the time of testing.

• Number of documents tested

• List documents tested (type, country, etc.)

• Test crew description (gender, age, etc.)

• Description of the test environment (devices used in testing, etc.)

• Description of the test platform

• Number of genuine verification transactions

• Distribution of Genuine Verification Transaction Time

• Failure to Acquire Rate

• Failure to Acquire Rate per level of sophistication

• Document False Rejection Rate (DFRR)

• Document False Rejection Rate (DFRR) per level of sophistication

*Note: Evaluation of Tier 5 documents are evaluated with and without NFC. Results SHALL be reported separately as Tier 5 (NFC) in the Tier 5 Capability Test and Tier 5 (optical) in the Physical Document Tests.

8.3. Genuine Testing

Document authentication transactions SHALL be conducted without test operator assistance. Any kind of guidance SHALL be provided by the TOE in a similar way to the final application.

The document authentication process may be different depending on the TOE. For instance, this process MAY require documentation authentication after every attempt, or MAY allow for multiple image acquisition attempts before document authentication. For testing, this process SHALL be similar to the final application.

8.3.1. Genuine Document Authentication Transaction

Genuine document authentication transactions SHALL be performed according to [ISOIEC-19795-1] section 7.4, inasmuch as these requirements map to document authentication. These requirements are a lightly edited version of [ISOIEC-19795-1]:

Genuine transaction data shall be collected in an environment, including noise, that closely approximates the target application. This test environment shall be consistent throughout the collection process. The motivation of test subjects, and their level of training and familiarity with the system, should also mirror that of the target application.

The collection process should ensure that presentation and channel effects are either uniform across all users or randomly varying across users. If the effects are held uniform across users, then the same presentation and channel controls in place during enrolment should be in place for the collection of the test data. Systematic variation of presentation and channel effects between enrolment and test data will lead to results distorted by these factors. If the presentation and channel effects are allowed to vary randomly across test subjects, there shall be no correlation in these effects between enrolment and test sessions across all users.

The sampling plan shall ensure that the data collected are not dominated by a small group of excessively frequent, but unrepresentative users.

Great care shall be taken to prevent data entry errors and to document any unusual circumstances surrounding the collection. Keystroke entry on the part of both test subjects and test administrators should be minimized. Data could be corrupted by impostors or genuine users who intentionally misuse the system. Every effort shall be made by test personnel to discourage these activities; however, data shall not be removed from the corpus unless external validation of the misuse of the system is available.

Users are sometimes unable to give a usable sample to the system as determined by either the test administrator or the quality control module. Test personnel should record information on failure-to-acquire attempts where these would otherwise not be logged. The failure-to-acquire rate measures the proportion of such attempts, and is quality threshold dependent. As with enrolment, quality thresholds should be set in accordance with vendor advice.

Test data shall be added to the corpus regardless of whether or not it matches [a supported document] template. Some vendor software does not record a measure from an enrolled user unless it matches the […] template. Data collection under such conditions would be severely biased in the direction of underestimating false non-match error rates. If this is the case, non-match errors shall be recorded by hand. Data shall be excluded only for predetermined causes independent of comparison scores.

All attempts, including failures-to-acquire, shall be recorded. In addition to recording the raw image data if practical, details shall be kept of the quality measures for each sample if available and, in the case of online testing, the matching score or scores.

Collection from remote subjects for DocAuth testing is possible; however, the selection of allowed capture devices SHALL:

1. Be readily available to the remote subjects, e.g. a camera on a smartphone.

2. Be consistent across the remote subjects, allowing for small variations in specifications, e.g. similar lens and camera quality.

3. Use consistent software/OS, allowing for small variations in specifications, e.g. iOS 18.0.1 v 18.7.2.

4. Use consistent hardware, allowing for small variations in specifications, e.g. Pixel 9 vs Pixel 10.

5. The laboratory SHALL uniquely register Test subjects and this SHALL include details of the device they will use to ensure capability.

6. FIDO accredited laboratory SHALL observe the collection, complete action being taken on capture device, throughout the session which SHALL be recorded for auditing purposes only, e.g. typically with web meeting and video recording being completed on a separate device.

7. The laboratory SHALL provide a mechanism to enable linking the subject with their results.

8.3.1.1. Pre-Verification

Before genuine transactions test subjects MAY perform practice transactions.

8.3.1.2. Genuine Document Authentication Transaction Testing

Test subjects SHALL conduct five (5) genuine document authentication transactions per document type. Transactions SHALL be conducted in good faith and without test operator guidance. Any kind of guidance SHALL be provided by the document authentication system in a similar manner to the final application.

For Tier 5 documents that contain NFC security features, five genuine transactions SHALL be performed using the NFC functionality. For vendors that have specified optical review of Tier 5 documents five genuine transactions using the optical approach SHALL be performed after blocking the NFC functionality. The blocking mechanism SHALL not interfere with the optical capture capabilities of the device. If the TOE does not allow an optical fallback, then the second test is not required.

Note: NFC can be blocked in a method chosen by the laboratory. For example, a thick case or cover can be used to block the NFC output from the capture device.

The document authentication process MAY be different depending on the TOE. This process MAY require multiple presentations. For testing purposes, this process SHALL NOT have more than five attempts for each transaction. A transaction SHOULD NOT exceed 200 seconds.

The authenticator vendor SHALL describe to the FIDO Accredited Laboratory what constitutes the start and end of a document authentication transaction.

8.3.1.3. Genuine Document Document Verification Errors

A failure to acquire SHALL be declared when the document authentication system is not able to capture a document image during a verification attempt (an FTA MAY happen per attempt). The test harness SHALL indicate to the FIDO Accredited Laboratory when a failure to acquire has occurred. A document false rejection error SHALL be declared when the document authentication fails to authenticate the document after document after test subjects execute the complete verification transaction (which includes no more than five attempts). If a failure to acquire occurs for all attempts, a document false rejection error SHALL be declared.

The manner in which the FIDO Accredited Laboratory records failure to acquire, false rejects, and true accepts are left to the FIDO Accredited Laboratory, but SHALL be done automatically to avoid introducing human error.

8.3.1.4. Document False False Reject Rate

Document False False Reject Rate SHALL be calculated according to requirements in section § 8.2.1 Size of Test Set.

8.4. Inauthentic Document Testing

Inauthentic document testing SHALL be performed under the same capture and harness conditions defined for genuine document testing in § 8.3 Genuine Testing, but using physically constructed specimens intentionally altered to represent physical DAI species. The TOE SHALL provide any capture guidance in the same manner as in the final application, and no additional operator assistance SHALL be given beyond what is normally allowed.

The objective of this section is to confirm that the TOE does not incorrectly classify a known inauthentic document as authentic. Testing SHALL follow the same interaction flow as genuine document testing to ensure results reflect real-world behavior.

Note: Section § 8.2 Test Sets excludes digital images (e.g., scanned images, printouts of scans) from Physical Document Tests. However, physical photocopies or printouts intended to impersonate genuine IDs are considered inauthentic physical documents and SHALL be tested under this section.

8.4.1. Inauthentic Document Authentication Transaction

Laboratories SHALL select at least one DAI whose Primary Threat Class corresponds to the physical threat classes defined in § 3.3.2 Classification of Threats, specifically:

• Counterfeit (§ 3.3.2.1 Counterfeit): Complete reproduction of a genuine document using unauthorized materials or printing methods.

• Forgery/Tampering (§ 3.3.2.2 Forgery/Tampering): Alteration of data fields or security elements on an otherwise genuine document.

• Physical Tampering (§ 3.3.2.3.1 Physical Tampering): Mechanical or chemical modification of the document substrate, laminate, or embedded features.

Laboratories MAY use DAIs from any of these threat classes as available; it is not required to have all types for every test set, however, at least one specimen from any selected threat class SHALL be included.

DAIs SHALL be prepared and selected in accordance with the Test Set Preparation requirements in § 7.3.2 Evaluation with Document Attack Instruments (DAI) Images, adapted from DAI images to physical DAIs (see § 8.2 Test Sets).

DAIs SHALL be categorized using the levels of DAI defined in § 7.2.1.2 Levels of DAI Species {#levels-of-document-fraud-attack} (Levels A–D). These levels SHALL be applied consistently to physical document alterations to maintain alignment with digital fraud attack categorization.

Tier 5 digital documents with NFC capabilities and selfie/liveness verification remain out of scope for § 8.4 Inauthentic Document Testing and are addressed elsewhere in the program.

DAIs SHALL be constructed or sourced in compliance with applicable law and program rules.

Each specimen SHALL include the following metadata:

• Specimen ID (unique identifier)

• Document classification, revision and country of origin (per § 3.3.3 Document Types)

• Primary Threat Class (per § 3.3.3 Document Types; secondary classes MAY be recorded)

• Document Fraud Attack Level (Level A-D)

Examples (non-exhaustive) of DAIs:

• Physical photocopies or printouts of genuine documents (e.g., color photocopies, high-quality reprints, digitally altered then printed).

• Presentation replays: printed photos mounted on card stock or similar.

• Portrait substitution: photo affixed on top, inlaid, or inlaid under protective layers.

• Data-field manipulation: overlays or edits to text, numbers, or labels.

• Laminate/overlay tamper: re-lamination or patch overlays altering security zones.

• Security-feature suppression: removal or absence of publicly documented optical features.

8.4.1.1. Inauthentic Document Authentication Transaction Testing

Dataset sizing SHALL follow the applicable size and repetition requirements in § 8.2.1 Size of Test Set; in addition, the laboratory SHALL execute five (5) document authentication transactions per DAI, aligning with the execution count defined for genuine documents in § 8.3.1.2 Genuine Document Authentication Transaction Testing.

For every DAI and for each execution, the implementation SHALL NOT return an Authentic decision. An acceptable outcome for a DAI is any decision other than Authentic, including an Inauthentic/Fraud decision, a Refer/Manual Review decision, or an Extraction Failure/Unreadable decision.

The laboratory SHALL ensure that the harness persistently records the decision and code for each execution so that outcomes can be audited and reported in accordance with § 8.2.4 Physical Reporting Requirements.

8.4.1.2. Inauthentic Document Verification Errors

A Document Failure-To-Extract (DFTE) SHALL be declared when a document acquire (capture) was successful, but required data could not be extracted or processed to complete verification. Each DFTE SHALL be counted as an accepted inauthentic-document rejection.

The test harness SHALL indicate to the FIDO Accredited Laboratory when DFTA or DFTE occurs and persist these codes for auditing.

A document false accept error SHALL be declared if the document authentication system produces an accept (Authentic) decision for an DAI.

The manner in which the laboratory records DFTA, DFTE and impostor presentation attack errors is left to the laboratory, but SHALL be done automatically to avoid introducing human error.

9. Tier 5 Capability Test

This section focuses on testing the cryptographic security features of Tier 5 documents. A Tier 5 digital document holds all relevant personal information that is to be used for identity proofing purposes electronically. Some tier 5 documents may contain anti-cloning capabilities and replay attack prevention. For this test only documents that can be used with consumer devices, such as a mobile phone, to access the electronically stored data SHALL be in scope.

The testing SHALL be performed by the FIDO Accredited Laboratory on the TOE provided by the vendor. The TOE in this case shall consider the type of identity documents and the issuing countries.

The following high-level requirements should be met:

• The authenticity of the personal data read from the integrated circuit shall be verified against an authoritative source

Note: Examples of authoritative sources are the CSCA masterlists published by ICAO, German BSI or a national CSCA list.

9.1. Test environments

• The solution shall be tested on at least two mobile platforms: Android and iOS.

9.2. Test sets

• The type of encoding: ICAO 9303 compliant passports, identity cards, residence permits and ISO/IEC 18013 compliant driving licenses.

• The security modes supported by the TOE, for example access control, cloning protection etc.

• Various happy and unhappy flows.

Where both the document and vendor support security modes desgined to prevent cloning then the correct functioning of this shall be verified by the test laboratory.

Security modes that require the vendor or test laboratory to provide proprietary security credentials, such as a certificate for Terminal Authentication, are out of scope for this test.

For genuine documents:

• The test set SHALL have a minimum size of 30 documents for each security mode supported by each type of encoding.

• Five genuine transactions SHALL be performed for each document.

• The genuine document test SHALL cover at least 3 different issuers for each security mode and encoding type in order to demonstrate the solution’s ability to verify a range of Tier 5 documents. There is no requirement on how many documents from each issuer must be included.

Where a security mode requires the proper functioning of another security mode then one transaction SHALL be counted towards both security modes. For example, if a solution supports both BAC and EAC for ICAO 9303 documents, and EAC requires BAC to function properly, then one transaction using EAC can be counted towards both BAC and EAC test. In these cases the test set size requirement SHALL still be met for both security modes, i.e. the test set size does not need to be doubled.

The vendor shall be able demonstrate which type of Tier 5 documents it is able to verify.

9.2.1. Tier 5 Capability Reporting Requirements

The following SHALL be included in the Evaluation Report to FIDO and the Vendor:

• Summary of the FIDO Document Authenticity Verification Certification and Requirements, including versions of the Requirements (this document) and [DA-CertPolicy] used at the time of testing.

• Number of documents tested

• List the types of encoding that were tested

• The security modes tested

• Description of the test environment (devices used in testing, etc.)

• Description of the test platform

• Number of genuine verification transactions

• Distribution of Genuine Verification Transaction Time

• Failure to Acquire Rate

• Failure to Acquire Rate per level of sophistication

• Document False Rejection Rate (DFRR)

• Document False Rejection Rate (DFRR) per level of sophistication

9.3. Genuine testing

• An genuine document of a certain encoding that passes on all validation checks;

The test laboratory shall also verify the vendor’s claims with regard to the type of Tier 5 documents it is able to verify and the security modes supported by the TOE.

9.4. Evaluation with Inauthentic Document Chips

• A manipulated document of a certain encoding and that fails on verifying the authenticity of the personal data, including any biometric data, read from the integrated circuit;

Where a vendor claims support for multiple security modes, the test laboratory shall verify that each security mode is being correctly implemented by testing that it fails with inauthentic documents.

Appendix A: References

Appendix B: Research Sources

For more information on the various subjects outlined in this requirements document please refer to the table below which includes recommended research sources.

Appendix C: Program Documents

This Appendix includes the other companion documents and webpages for the Document Authenticity Verification Certification Program.

Appendix D: Terms & Abbreviations

For other terms not used in this document, but may be used in relation to FIDO, please refer to the [FIDOGlossary].