SW=6300 error reading ePassport from Android

Question

I followed the ICAO's 7th edition "Appendix D to Part 11 - Worked Example: Basic Access Control" in order to create an Android app with Xamarin.Android that reads the data from an ePassport. However, I'm getting a 6300 status code from the chip at the EXTERNAL AUTHENTICATE step and there is not much information about that error code. It is too vague...

Here is the log of the steps performed by the app:

Tag tech list from the chip: android.nfc.tech.IsoDep, android.nfc.tech.NfcA

Select AID command:
00A4040C07A0000002471001

Select AID response:
9000

GET_CHALLENGE command:
0084000008

GET_CHALLENGE response:
6211B520F00565DD9000

documentNumber:
HU1234560

dateOfBirth:
920229

dateOfExpiry:
150101

keySeed SHA1(documentNumber + checkDigit + dateOfBirth + checkDigit + dateOfExpiry + checkDigit):
F3B48FDEF6A2374676C6B8892AFA58FB

kEnc SHA1(keySeed + 00000001):
9F399B0855DAD12F04FB3CB84D1F9AB3

kMac SHA1(keySeed + 00000002):
51102BA4C6A69CEF26BD45C94537B103

rndIFD:
CC95C0CD499F6306

kIFD:
39D661B07605B175E8BEF948609556F1

rndICC:
6211B520F00565DD

S:
CC95C0CD499F63066211B520F00565DD39D661B07605B175E8BEF948609556F1

eIFD(DesEdeEngine/CBC/NoPadding):
EC95CF0953AF87CA7FE3059A4B89A018309E8FD60359F38C4BA3216E763DD1D4

mIFD(DesEngine/ISO9797Alg3Mac/ISO7816d4Padding):
CED0EA4979A35978

External Authenticate command:
0082000028EC95CF0953AF87CA7FE3059A4B89A018309E8FD60359F38C4BA3216E763DD1CED0EA4979A359780028

External Authenticate response:
6300

Any recommendations?

Answer 1

Your EXTERNAL AUTHENTICATE command seems to be wrong. It looks as if you copy the M_IFD value to the wrong position (off-by-one). Consequently, you chop off the last byte of E_IFD and have a zero byte at the end:

00 82 0000 28 EC95CF0953AF87CA7FE3059A4B89A018309E8FD60359F38C4BA3216E763DD1 CED0EA4979A35978 00 28
                                                                           ^^                 ^^
                        Last byte of E_IFD missing (only 31 bytes here) <--/                  |
                                                                Additional zero byte here? <--/

Besides that your values (more or less) match the comuptations of my MRTD testbench. You did not correct the parity bits of K_ENC and K_MAC though, but that won't make any difference unless you would (in future) use a crypto library that actually checks the parity bits of DES keys. Your current crypto library seems to ignore them and gives the expected result.

---

UPDATE (summarizing discussion in the comments below)

Moreover, did you verify that the document number, date of birth, and date of expiry match exactly the form used in the machine-readable zone? Both, the document number and the date of expiry in your question don't seem to be plausible values for a real passport.

Finally, as Maarten explained, the status word 6300 indicates that authentication failed. You can't expect the document to reveal further details about why exactly authentication failed. That's certainly not a lack of the ICAO specifications but a necessity from a security perspective. Imagine, for example, that the passport would be able to report that the date of birth that you used as input was wrong. An attacker would then be able to brute-force only that part of the key input.

Answer 2

As @Michael Roland's pointed out all steps and computation are correct but after double checking the MRZ (input) as suggested I noticed that I mistyped the DateOfBirth which caused the status code = 6300. So this status code may be returned when a wrong input is given.

Unfortunately, ICAO's documentation is not clear enough to indicate this scenario.