can be used for web server authentication and/or web client authentication).

Electronic Passports\[sub:Electronic-Passport\]
-----------------------------------------------

****

   **Data Group**           **Data Elements**
  ---------------- ------------------------------------
                              Document Types
                       Issuing State or Organizaton
                             Name (of Holder)
                             Document Number
                         Check Digit - Doc Number
                               Nationality
                              Date of Birth
                            Check Digit - DOB
                                   Sex
                    Date of Expiry or Valid Until Date
                           Check Digit DOE/VUD
                              Optional Data
                    Check Digit - Optional Data Field
                          Composite Check Digit
   Data Group 11             Personal Number
   Data Group 15            User’s Public Key

Modern electronic passports feature NFC chips[@icaoDoc9303part11] that contain all their printed information in digital form, using a proprietary format set by International Civil Aviation Organization[@icaoDoc9303part10] and not X.509 certificates \[sub:X.509-Public-Key\] like the ones used in national identity cards: the relevant fields are contained within its Data Group 1 \[tab:Data-Group-1\] (i.e., the same information available within the Machine Readable Zone), and the Document Security Object contains a hash of all the Data Groups signed by a Document Signing Certificate issued every three months (also stored on the passports), itself signed by a Country Signing Certificate Authority (all the certificates are available online[@icaoPKD]). Additionally, the data within the NFC chips are cryptographically protected and it’s necessary to derive the cryptographic keys by combining the 