AKİS

AKİS Solutions

AKiS GEZGİN e-Passport

(with e-ID and e-Signature Applications)

AKiS GEZGiN e-Passport application is compatible with ICAO Doc 9303 standards. The information stored on contactless chip can only be accessed via secure communication protocols such as Basic Access Control (BAC) and Supplemental Access Control (SAC). Active Authentication (AA) and Chip Authentication (EAC - CA) prevent cloning of the e-Passport. In addition, biometric data on the chip is protected by Extended Access Control (EAC) and CVC certificates. Therefore, only those countries that are allowed by the issuing country can access the biometric data.

AKiS GEZGiN extends ICAO Doc 9303 standards by increasing the number of supported roles to 32 and it also supports e-Signature applications. Therefore, it can also be personalized for e-ID and/or e-Signature applications.

passport image

Technicial Features

  • ICAO LDS 1.71
  • Basic Access Control (BAC)
  • Active Authentication (AA)
    • RSA (up to 2560 bits)2: SHA-1, SHA-256, SHA-384, SHA-512
    • ECC (up to 521 bits): SHA-1, SHA-224, SHA-256, SHA-384, SHA-512
  • Supplemental Access Control (SAC)
    • PACE v2
    • MRZ, CAN, and PIN3support
    • Support for Generic Mapping and Integrated Mapping
    • ECDH (Brainpool curves up to 512 bits)
    • DH (1024 bit, 2048 bit)
  • Extended Access Control (EAC)
    • EAC v14
    • RSA (up to 3072 bits): SHA-1, SHA-256, SHA-512
    • ECC (up to 521 bits): SHA-1, SHA-224, SHA-256, SHA-384, SHA-512
  • Contactless Communication
    • ISO/IEC 14443-3, 4 Type A
    • Baud rate: 424/848 kbps
  • Secure Messaging
    • DES3
    • AES-128, AES-192, AES-256
  • Common Criteria (CC) Security Evaluation
    • CC EAL 4+ for BAC (ALC_DVS.2)
    • CC EAL 5+ for SAC & EAC (ALC_DVS.2, AVA_VAN.5)
  • Support for multiple chip platforms5
    • Infineon6SLE78CLFX3000P, SLE78CLFX308AP, SL78CLFX4000P, SLE78CLFX408AP
    • NXP P71D320P6, P71D352P7
  • Compliance with standards
    • ICAO Doc 9303
    • ISO/IEC 14443-3, 4
    • ISO/IEC 7816-4, 8, 9
    • ICAO Technical Report: Supplemental Access Control for MRTDs
    • BSI TR-03110
    • BSI TR-03111

1 AKiS GEZGiN v2.0 supports more data groups than defined by ICAO.
2 Maximum supported RSA bit length for AKiS GEZGiN v1.x is 2048 bits.
3 Support for PINs is available only for AKiS GEZGiN v2.0.
4 AKiS GEZGiN v2.0 supports a maximum of 32 roles.
5 Hardware platforms are certified for CC EAL 6+.
6 AKiS GEZGiN v1.x only.
7 KiS GEZGiN v2.0 only.

Basic Access Control (BAC)

Basic Access Control (BAC) is a mechanism used in e-Passports to prevent chip skimming and eavesdropping on the communication between e-Passports and the terminals by encrypting the transmitted information. BAC ensures that only authorized terminals can read information from e-Passports: before any data can be read, the terminal needs to prove that it has physical access to e-Passport by using a session key derived from the Machine Readable Zone (MRZ) or Card Access Number (CAN).

Supplemental Access Control (SAC)

SAC, a mechanism based on Diffie-Hellman key exchange protocols (DH/ECDH), provides securer and stronger session keys than BAC. For the e-Passport use case, where the passport holder is automatically assumed to have agreed to their on-chip non-biometric data to be accessed by terminals when they hand in their passport, SAC with MRZ/CAN can be used. However, for other use cases such as e-ID and e-Signature, where the cardholder is expected to be authenticated before cryptographic services or on-chip non-biometric data are accessed, SAC with PIN can be used.

Extended Access Control (EAC)

EAC is a mechanism that enhances the security features of e-Passports by adding functionality to check the authenticity of both the chip (via Chip Authentication – CA) and the terminals (via Terminal Authentication – TA): EAC CA updates secure messaging session keys with stronger session keys and EAC TA uses role-based CVC certificates to ensure that only authorized terminals can read optional biometric data groups (DG3 and DG4) from e-Passports. For the e-ID use case, AKiS GEZGiN increases the number of supported roles to 32; therefore, more files (EFs) than required by EAC can be protected by role authentication.

Active Authentication (AA)

Active Authentication prevents cloning of the chip.
Search

Quick Links

Support
Main Menu
Follow Us
LinkedIn Instagram YouTube X-Twitter Facebook

© 2026 TÜBİTAK BİLGEM | All Rights Reserved.

b9d315a2af7a2f6e23611af9a7d3ea05e
5c3b8a224583f19d949d721947f9060

4da2fdefa951bd7dcebd14dfc8d1fab36
93cc2c6be2a6a3339deea42b96bc4fc

628b983b97837b56f92b2c2fd9f7f25e
ab989a7fc0289b14d3b9e7b16be82208

ec11ca282b33844be9a53df663b3460
655ba9441814477a6bcafc4f429112af9

ed43b8055d348f0e05dd7df1dd517882
40fbb89264ab6ea45b7c1d3f7d05af9a

e71e374bd3e3184dbedb30f7d884a4db9
10bd9604b4ee7bb0c594d813697d4b4

c62eb06af9e5e0b9e5d7c8769302bf13
db53abe6a48a6df999251511d34a3dda

f5c13be5338f4208539f9551fc7865302
000e2153370d512052db4d0557e89d5

8dc864309d0acd1e672a344032f145052
e0c644fb3c3ea02cd217f44e3646d53
572ed2c825e1631e6ab095e635cfb630b
3e3d3f73595c02a7b765882d65e2895
3476C511A7CF7F2BF354394BBB53F36DC
6BD48E64CBF20ACD2D9851D748CFC3F
8A3D6DBDFD500F165987FF892FF114058
4516F8FF2270026D0FD2CD53ACDD2BF
8D939CB7BD3B2381399462A7A5AC7D14
760DC330A65814BD01E20F121E073A0E
E2EFC0FC98E48D6984289E21194ADF2A
5993D0220F65A7AEA9F2791222D0A1A2
ticket

AKİS TICKET / OSPT Cipurse-Based Smart Card for the e-Payment and Ticketing Application

AKiS BiLET, developed by TÜBİTAK BİLGEM—a member of the OSPT Alliance—runs on the domestically developed smart card operating system (AKİS) and is based on CIPURSE1 It is a contactless smart card technology. AKiS BiLET is specifically designed to be used as a payment method in electronic fare collection systems in the transportation sector, thanks to its advanced security infrastructure, low costs, and compliance with open standards. It is also the first domestically developed smart card solution for contactless card applications such as access control and parking systems.

KEY FEATURES

  • Contactless data rate: 848 kbit/s
  • 13.56 MHz operating frequency
  • ISO/IEC 14443-4 protocol layer support
  • ISO/IEC 7816-compliant file system
  • APDU command set compliant with ISO/IEC 7816-4 and ISO/IEC 7816-92
  • 8 applications, configurable2
  • 32 files per application, configurable2
  • Binary Files, Linear Record Type, Circular Record Type, Value Record Type Files
  • Consistent Transaction3 mechanism
  • Support for Multiple Applications
Technicial Features

SECURITY FEATURES

  • Hardware platform with a CC EAL 6+ security level
  • True Random Number Generator (TRNG)
  • AES-1284, 128-bit advanced encryption mechanism
  • 8 AES-128 security keys for each application
  • Easy and flexible and key management system
  • Resistant to Differential Power Analysis (DPA) attacks
  • Resistant to Differential Fault Analysis (DFA) attacks
  • Mutual Authentication (AES-128) Based on ISO/IEC 9798-2
  • ISO/IEC 7816-4-based Secure Messaging modes (Plain, AES MACed, AES ENCed)
  • Data Integrity Protection
  • File-Based Access Authorization and Secure Messaging

APPLICATION AREAS

  • eTicket apps
  • Employee Attendance Control Systems
  • Access control systems
  • Parking systems
  • Libraries
  • Health, social assistance, loyalty, and similar card programs

CIPURSE
OPEN STANDARDS
CIPURSE open standards provide a proven technology infrastructure based on the ISO/IEC 7816 and ISO/IEC 14443 standards and AES-128 to deliver secure, flexible, and standardized electronic toll collection solutions.

INDEPENDENT TECHNOLOGY
Platform-independent: CIPURSE technology can be implemented on any smart card chip that meets all specifications, as well as on NFC SIM cards or JavaCards as an applet.

Vendor-independent: CIPURSE technology was developed not as a proprietary solution for a specific manufacturer, but as a standard and open technology that anyone who wishes to do so can implement. Today, many companies—including TÜBİTAK—are developing CIPURSE products, and the number of these companies is steadily increasing.

Card reader independent: No modifications are required to existing card readers to communicate with CIPURSE cards. CIPURSE technology can be used with all smart card readers that support the ISO/IEC 14443 Type A L4 standards.

1 The CIPURSE open specifications are published by the OSPT Alliance.
2 Applies only to the CIPURSE T Profile.
3 By ensuring that the data to be written to the card is written completely in a single pass, it helps prevent communication problems
A mechanism that prevents potential data corruption.
4 AES (Advanced Encryption Standard), ISO/IEC 18033-3:2010 & FIPS 197.

esrc

AKİS GEZGİN e-Driver's License App

The AKiS GEZGiN e-Driver's License application complies with the ISO/IEC 18013 standards (ISO/IEC 18013-3:2009 and ISO/IEC 18013-3:2017)1 It has been developed to be compliant. Thanks to the Basic Access Protection (BAP) feature, the information on the contactless chip can only be read via secure communication, and the Active Authentication feature prevents the passport from being copied. Thanks to the Extended Access Protection (EAP) feature (compliant with ISO/IEC 18013-3:2009), all files (DG1–DG24); and the Extended Access Control (EAC) feature (compliant with ISO/IEC 18013-3:2017) ensures that personal biometric data (DG3 and DG4) is protected. EAP/EAC ensures that only authorized readers can access these data groups.

The AKiS GEZGiN e-Driver’s License application contains a total of 24 data groups (DG1–DG24); of these, DG1—which contains the license holder’s demographic data along with vehicle categories, restrictions, and conditions—must be defined, while the definition of the other data groups is optional.

Technicial Features

FEATURES OF THE AKiS TRAVELER'S DRIVER'S LICENSE

ISO/IEC 18013 LDS

  • Basic Access Protection (BAP)

Active Authentication (AA)

  • RSA (up to 2048 bits): SHA-1, SHA-256, SHA-384, SHA-512
  • ECC (up to 521 bits): SHA-1, SHA-224, SHA-256, SHA-384, SHA-512

Extended Access Protection (EAP)

  • ISO/IEC 18013-3:2009
  • RSA (up to 3072 bits): SHA-1, SHA-256, SHA-512
  • ECC (up to 521 bits): SHA-1, SHA-224, SHA-256, SHA-384, SHA-512

Extended Access Control (EAC)

  • ISO/IEC 18013-3:2017
  • EAC v1
  • RSA (up to 3072 bits): SHA-1, SHA-256, SHA-512
  • ECC (up to 521 bits): SHA-1, SHA-224, SHA-256, SHA-384, SHA-512

Contactless Communication

  • ISO/IEC 14443-3, 4 Type A
  • Baud rate: 424/848 kbps

Secure Messaging

  • DES3
  • AES-128, AES-192, AES-256

Multi-Chip Support2

  • Infineon SLE78CLFX3000P (88K memory capacity)
  • Infineon SLE78CLFX4000P (192K memory capacity)
  • NXP P71D320P (80K Memory Capacity)

Compliance with Standards

  • ISO/IEC 18013-3
  • ISO/IEC 14443-3, 4
  • ISO/IEC 7816-4, 8, 9
  • BSI TR-03110 (for EAC)
  • BSI TR 03111

BASIC ACCESS PROTECTION (BAP)

It is a mechanism that enables an authorized terminal to access the data stored on the contactless chip and ensures that communication between the terminal and the contactless chip takes place securely. It enables the generation and verification of session keys, as well as the initiation of secure communication, through the optical scanning or manual entry by the operator of the MRZ (Machine Readable Zone) / SAI (Scanning Area Identifier) information printed on the e-Driver’s License.

EXTENDED ACCESS PROTECTION (EAP)

It enables the updating of secure session keys using Chip Authentication (EAP–CA) and controls access to all data sets on the chip using role-based certificates via Terminal Authentication (EAP–TA).

EXTENDED ACCESS CONTROL (EAC)

It enables the updating of secure session keys through Chip Authentication (EAC–CA) and, through Terminal Authentication (EAC–TA), controls access to optional signature and biometric data sets stored on the chip using role-based certificates.

ACTIVE AUTHENTICATION (AA)

It prevents the creation of an exact copy of the eDriver's License chip.

 

[1] Personalized AKiS GEZGiN cards may support only one of the ISO/IEC 18013-3:2009 and ISO/IEC 18013-3:2017 standards, depending on the personalization.
[2] The chips are certified under the CC EAL 6+ security evaluation.

epasaport

AKİS GEZGİN e-Passport App

e-PASSPORT APPLICATION

The AKiS GEZGiN e-Passport application was developed in compliance with ICAO 9303 standards. Thanks to the Basic Access Control (BAC) and Supplemental Access Control (SAC) features, the information on the contactless chip can only be read via secure communication, and the Active Authentication feature prevents the passport from being copied. Additionally, the EAC feature uses CVC certificates to protect individual biometric data; only authorized countries can access this data.

The AKiS Gezgin e-Passport application supports Logical Data Structure (LDS) 1.7 and can contain up to 11 data groups (DG1–DG11); of which DG1, which contains MRZ data, must be defined; the definition of the other data groups is optional.

Technicial Features

FEATURES OF THE AKiS TRAVELER PASSPORT

ICAO LDS 1.7
Basic Access Control (BAC)
Active Authentication (AA)

  • RSA (up to 2048 bits): SHA-1, SHA-256, SHA-384, SHA-512
  • ECC (up to 521 bits): SHA-1, SHA-224, SHA-256, SHA-384, SHA-512

Supplemental Access Control (SAC)

  • PACE v2
  • MRZ and CAN support
  • Support for Generic Mapping and Integrated Mapping
  • ECDH (Brainpool curves up to 512 bits)
  • DH (1024 bit, 2048 bit)

Extended Access Control (EAC)

  • EAC v1
  • RSA (up to 3072 bits): SHA-1, SHA-256, SHA-512
  • ECC (up to 521 bits): SHA-1, SHA-224, SHA-256, SHA-384, SHA-512

Contactless Communication

  • ISO/IEC 14443-3, 4 Type A
  • Baud rate: 424/848 kbps

Secure Messaging

  • DES3
  • AES-128, AES-192, AES-256

Common Criteria (CC) Security Evaluation

  • CC EAL 4+ for BAC (ALC_DVS.2)
  • CC EAL 5+ for SAC & EAC (ALC_DVS.2, AVA_VAN.5)

Multi-Chip Support1

  • Infineon SLE78CLFX3000P (88K memory space)
  • Infineon SLE78CLFX4000P (192K memory capacity)
  • NXP P71D320P (80K memory capacity)

Compliance with Standards

  • ICAO 9303
  • ISO/IEC 14443-3, 4
  • ISO/IEC 7816-4, 8, 9
  • ICAO Technical Report: Supplemental Access Control for MRTDs (for SAC)
  • BSI TR-03110 (for EAC)
  • BSI TR 03111

BASIC ACCESS CONTROL (BAC)

It is a mechanism that enables an authorized terminal to access the data stored on a contactless chip and ensures that communication between the terminal and the contactless chip takes place securely. It enables the generation and verification of session keys, as well as the initiation of secure communication, through the optical reading of the MRZ (Machine Readable Zone) information printed on the e-passport.

EXTENDED ACCESS CONTROL (EAC)

It enables the updating of secure session keys via Chip Authentication (EAC–CA) and, via Terminal Authentication (EAC–TA), the control of access to the DG3 (fingerprint) and DG4 (iris) data groups within the chip.

ACTIVE AUTHENTICATION (AA)

It prevents the creation of an exact copy of the e-passport chip.

SUPPLEMENTAL ACCESS CONTROL (SAC)

It is a mechanism that, thanks to the Diffie–Hellman key-generation protocols (DH/ECDH), enables the creation of session keys that are more secure and stronger than those generated by BAC.

 

[1] The chips are certified under the CC EAL 6+ security evaluation.

akispki

AKİS PKI / Smart Card Operating System

The AKiS operating system was developed in accordance with ISO/IEC 7816 standards and features PKI capabilities. When customized with the PKCS#15 data structure, AKiS versions 2.2 and 2.5 can be used in PKCS#11 applications such as user login and digital signatures.

Technicial Features

AKiS PKI1 Features:

  • Support for ISO/IEC 7816-4, 8, and 9 command sets
  • AES-256 Secure Messaging
  • Summarizing
  • Card Verifiable Certificates
  • Role-based access mechanism
  • True Random Number Generator (TRNG)
  • RSA digital signing, decryption, and CVC certificate validation processes2
  • Generating an RSA key pair3
  • ECDSA digital signature generation (ECC 128–640 bits)
  • Generating an ECC key pair (ECC 128–640-bit range)4
  • Symmetric encryption/decryption (DES3, AES-128, AES-192, AES-256)4
  • Cryptographic integrity checks (DES3 MAC/CMAC/RetailMAC, AES MAC/CMAC)4
  • Common Criteria (CC) EAL 4+ security level
  • Multi-chip support5
    • UKTUM-H v7.01
    • Infineon SLE78CFX2400P
    • NXP P71D320P

[1] Driver support for PKCS#11 applications (PKCS#11 and Minidriver).
[2] AKiS v2.5 supports RSA key lengths ranging from 1024 to 2816 bits, while AKiS v2.2 supports only 1024-bit and 2048-bit RSA keys.
[3] AKiS v2.5 supports RSA key lengths ranging from 1024 to 2816 bits, while AKiS v2.2 supports only 2048-bit RSA keys.
[4] Supported only in AKiS v2.5.
[5] The chips have at least a CC EAL 5+ security evaluation certificate.

national

National Identity Card / T.R.- TRNC Identity Card

IDENTITY CARD OF THE REPUBLIC OF TURKEY AND THE TURKISH REPUBLIC OF NORTH CYPRUS
ELECTRONIC ID CARD APPLICATION (Contact-Based Card Feature)
  • Visual identity verification
    Photograph, wet signature, guilloche, rainbow printing, MLI, microtext, halftone printing, charm, embossed printing, optically variable ink, ultraviolet ink, and OVD/DOVID
  • Electronic identity verification
    Electronic certificate, digital photo, PIN
  • Biometric authentication
    Fingerprint/finger vein pattern/hand and foot prints
  • Ability to upload a Qualified Electronic Certificate (QC) and private key
  • Support for ISO/IEC 7816-4, 8, and 9 command sets
  • AES-256 Secure Messaging
  • Summarizing
  • Card Verifiable Certificates
  • Role-based access control mechanism
  • True Random Number Generator (TRNG)
  • RSA digital signing, decryption, and certificate validation processes1
  • Generating an RSA key pair2
  • ECDSA digital signature generation (ECC 128–640 bits)3
  • Generating an ECC key pair (ECC 128–640-bit range)3
  • Symmetric encryption/decryption (DES3, AES-128, AES-192, AES-256)3
  • Cryptographic integrity checks (DES3 MAC/CMAC/RetailMAC, AES MAC/CMAC)3
  • Common Criteria (CC) EAL 4+ security level
  • Multi-chip support4
    • UKTUM-H v7.01
    • Infineon SLE78CFX2400P
    • NXP P71D320P
Technicial Features

  • ELECTRONIC TRAVEL DOCUMENT APPLICATION (Contactless Card Feature)5

    • Compliance with standards
      • ICAO 9303
      • ISO/IEC 14443-3, 4
      • ISO/IEC 7816-4, 8, 9
      • ICAO Technical Report: Supplemental Access Control for MRTDs (for SAC)
      • BSI TR-03110 (for EAC)
      • BSI TR 03111
    • Compliant with the ICAO LDS 1.7 data structure
    • Basic Access Control (BAC)
    • Active Authentication (AA)
      • RSA (up to 2048 bits): SHA-1, SHA-256, SHA-384, SHA-512
      • ECC (up to 521 bits): SHA-1, SHA-224, SHA-256, SHA-384, SHA-512
    • Supplemental Access Control (SAC)
      • PACE v2
      • MRZ and CAN support
      • Support for generic mapping and integrated mapping
      • ECDH (Brainpool curves up to 512 bits)
      • DH (1024 bit, 2048 bit)
    • Extended Access Control (EAC)
      • EAC v1
      • RSA (up to 3072 bits): SHA-1, SHA-256, SHA-512
      • ECC (up to 521 bits): SHA-1, SHA-224, SHA-256, SHA-384, SHA-512
    • Contactless Communication
      • ISO/IEC 14443-3, 4 Type A
      • Baud rate: 424/848 kbps
    • Secure Messaging
      • DES3
      • AES-128, AES-192, AES-256
    • Common Criteria (CC) Security Evaluation
      • CC EAL 4+ for BAC (ALC_DVS.2)
      • CC EAL 5+ for SAC & EAC (ALC_DVS.2, AVA_VAN.5)
    • Multi-chip support4
      • Infineon SLE78CLFX3000P
      • Infineon SLE78CLFX4000P
      • NXP P71D320P

    [1] AKiS v2.5 supports RSA key lengths ranging from 1024 to 2816 bits, while AKiS v2.2 supports only 1024- and 2048-bit RSA keys.
    [2] AKiS v2.5 supports RSA key lengths ranging from 1024 to 2816 bits, while AKiS v2.2 supports only 2048-bit RSA keys.
    [3] Supported only in AKiS v2.5.
    [4] The chips have a security evaluation certificate of at least CC EAL 5+.
    [5] These are the features of AKiS GEZGiN.