Deviation List Creation
This section describes managing deviation list content and signing the content in order to create a deviation list.
Managing Deviation List Content
In a deviation list, each deviation is specified by a deviation document and one or more deviation descriptions.
The following example display a deviation list content consising of two deviations:
- Deviation 1: For deviation document specified with the issuer and serial number and two deviation descriptions.
- Deviation 2: For deviation document specified with the subject key identifier and one deviation description.
NPKD offers the following deviation list management functionalities:
- New Deviation List
- Open Deviation List
- Add New Deviation to Deviation List
- Delete Deviation Document
- Add New Deviation Description
- Delete Deviation Description
- Clear Deviation List panel
New Deviation List
To start a new deviation list, add a deviation by right-clicking an empty deviation list panel and select the New Deviation List context menu item. The "New Document" dialog for adding a new deviation document appears.
You can enter the deviation information standardized with the ICAO 9303 7th edition Part 3 document. The dialog is separated into one Document panel containing data for the deviation document, and another Deviation Description panel displaying the deviation description data.
The Document Signer field is used for specifying one of the imported home country DS certificates, and the Document Signer Identifier selects what will be used to identify deviated DS certificate. In the Deviation Type and Parameters fields, specify the Deviation Type fields defined by the ICAO 9303 document.
Open Deviation List
To open an existing deviation list, right-click an empty deviation list panel and select the Open Deviation List context menu item. The dialog for selecting deviation list to open appears.
When a deviation list is selected, it is loaded into the deviation list panel, where it can be modified. Then if signed, it is imported and replaces the existing one.
Add New Deviation to Deviation List
To add a new deviation to a list, right-click the panel over the deviation list and select Add Deviation. The "New Document" dialog for adding a new deviation document appears.
Delete Deviation Document
To delete a deviation document, right-click the deviation and select Delete.
Add New Deviation Description
To add a new deviation description to a deviation document, right-click the deviation document and select Add Description.
Delete Deviation Description
To delete a deviation description from a selected deviation document, right-click the deviation document description and select Delete. A deviation document requires to have at least one deviation description, and it is not possible to delete the description if it is the only one existing for the document.
Clear Deviation List panel
To clear the entire deviation list, right-click the panel over the deviation list and select "Clear".
Signing of Deviation List Content
To manually initiate signing of deviation list content:
- Click Sign Deviation List Content on the main menu
- (Optional) Check and update the deviation list content.
- Click Sign Deviation List to sign deviation list content.
Deviation Type Definition
Deviation Type | Parameters | Description |
|---|---|---|
Certificate/Key Deviation | ||
Id-Deviaion-CertOrKey | None | A generic certificate or key related deviation not covered by the more detailed deviations below. |
Id-Deviation-CertOrKey-DSSignature | None | The signature of the Document Signer Certificate is incorrect. |
Id-Deviation-CertOrKey-DSEncodingCertField | CertField | The Document Signer Certificate contains a coding error. |
Id-Deviation-CertOrKey-CSCAEncoding | CertField | The Country Signing CA Certificate contains a coding error. |
Id-Deviation-CertOrKey-AAKeyCompromised | None | The key for Active Authentication may be compromised and should not be relied upon. |
Logical Data Structure Deviation (LDS Deviation) | ||
| Id-Deviation-LDS | None | A generic LDS related deviation not covered by the more detailed deviations below. |
Id-Deviation-LDS-DGMalformed | Datagroup | The TLV encoding of the given datagroup is corrupted. |
Id-Deviation-LDS-DGHashWrong | Datagroup | The hash value of the given datagroup in the EF.SOD is incorrect |
Id-Deviation-LDS-SODSignatureWrong | None | The signature contained in EF.SOD is incorrect. |
Id-Deviation-LDS-COMinconsistent | None | EF.COM and EF.SOD are inconsistent. |
Machine Readable Zone Deviation (MRZ Deviation) | ||
Id-Deviation-MRZ | None | A generic MRZ related deviation not covered by the more detailed deviation below. |
Id-Deviation-MRZ-WrongData | MRZField | The given field of the MRZ contains incorrect data (for example, inconsistent with VIZ), but the derived BAC key is usable to open the chip. |
Id-Deviation-MRZ-WrongCheckDigit | MRZField | If the derived BAC key is not usable, additional id-Deviation-Chip SHALL be included in the Deviation List. |
Chip Deviation | ||
Id-Deviation-Chip | None | The Chip is not usable. For example, incorrect BAC key, broken antenna, or other physical defect. |