This protocol is supplementary to Basic Access Control. Supplement Access Control (SAC) should replace
Basic Access Control. As the current infra structure of Inspection System is made for Basic Access Control, a
passport supporting Supplement Access Control should also support Basic Access Control for backward
compatibility.
SAC is fully specified in [ICAO_SAC]. It is mainly based on Diffie-Hellman key agreement protocol with domain
mapping. Once the authentication is done, the protocol provides two session keys KSENC and KSMAC that are
subsequently used for establishing a secure channel with the Basic Inspection System.
The particularity of SAC regarding other MRTD protocols is that it comes before the selection of the MRTD
application. The selection of the MRTD is then done using the Secure Messaging protection.
SAC Protocol parameters supported by the MRTD are set in the EF.CardAccess file. This file is stored in the MF
of the card.