The power of cryptographic verification explained

How cryptographic verification strengthens identity security

In today's digital world, verification systems are essential for maintaining security and trust. Cryptographic checks, which are used to verify identity documents, are one of the most advanced and secure verification methods.

Identity is composed of multiple attributes (characteristics) that belong to a person. A combination of attributes can create a unique identifier, although one attribute alone is rarely enough to distinguish one person from another.

There are various technologies available to suit different verification needs and circumstances.

Official documents like passports and driving licenses help establish identity. However, detecting high-quality forgeries can be challenging, especially when verifying genuine documents used by impostors in remote settings, and can be a challenge for the untrained eye.

Choosing the right technology and supplier is crucial for achieving desired outcomes and protection. The most reliable systems incorporate multiple verification features including validating chipped documents, facial recognition, scanning under various light sources, and cross-referencing external data sources - from PEPs and Sanctions screening to address validation, mortality checks, and lost and stolen document databases.

Identity verification requires three essential steps:

• Get evidence to verify the person's identity

• Check the evidence is real

• Check the identity belongs to the person claiming it

Different levels of verification

Document verification has multiple levels of checks to ensure authenticity, ranging from basic visual inspection of security features to advanced cryptographic validation using NFC technology. Organisations must understand these different levels to implement the most appropriate verification methods for their needs.

Why cryptographic verification is crucial for ACSPs

Authorised Corporate Service Providers (ACSPs) need to consider the options outlined in the Companies House guidance on How to meet Companies House identity verification standard and The Registrar's (Identity Verification by Authorised Corporate Service Providers Rules) 2025.

The expectations are outlined in these official sources:

“The applicant must use Option 1 if they are eligible for any of the evidence listed in Option 1 and the ACSP has the capability to validate cryptographic features.”

Biometric or photographic evidence is required, when available, to enable assessment of likeness against the individual. Evidence is considered available if the applicant is eligible to obtain it from the relevant authority. Therefore, not currently holding such evidence may be deemed unacceptable.

What are cryptographic checks and why do they matter?

The dictionary definition of Cryptography is: “the practice of creating and understanding codes that keep information secret”.

The National Cyber Security Centre defines Cryptography as “Technologies primarily based on maths and computer science for protecting information so that it is only accessible to authorised recipients”.

Many passports, identity cards, and other identity documents contain an RFID chip that can be used to verify authenticity. This chip stores reliable personal information about the holder, including full name, date of birth, and nationality. It also contains a high-resolution face image suitable for face matching.

How cryptographic verification works

A cryptographic check uses sophisticated technology embedded within modern identity documents through NFC (Near-Field Communication). Using a mobile phone it employs four types of cryptographic protocols:

• Passive authentication: Verifies that chip data remains unaltered since issuance by validating each data element's cryptographic signature using the issuing country's public keys.

• Access control: Security protocols that 'open' the document's chip and enable secure transfer of privacy-sensitive information.

• Secure messaging: Establishes an encrypted communication channel using a session key.

• Clone detection/Active authentication: Verifies chip authenticity by generating a dynamic challenge. While chip content can be copied, the private key cannot be duplicated, causing cloned passports to fail active authentication.

The system extracts chip data and cross-references it to identify discrepancies between self-reported and chip-stored information.

Cryptographic checks in action: How Thirdfort verifies individuals

The Thirdfort app uses your smartphone's NFC (Near Field Communication) technology to read your identity document's chip. This chip contains your personal data and passport photo - matching the information visible on your physical document. The chip also stores additional data about the document's digital security and authenticity. The app journey includes facial verification, comparing your captured image with the face image from your identity document to prove you're the rightful document holder.

Benefits of cryptographic verification for security and compliance

Cryptographic verification offers several key advantages:

• Security: Secure and reliable identity document verification, preventing fraud and ensuring document authenticity through direct access to official sources

• Efficiency: Quick and straightforward verification process, enabling instant identity checks through a smartphone with real-time validation

• Accessibility: Secure, remote verification without the need for face-to-face delivery

• Helps protect against deepfakes: NFC identity verification helps protect against deepfakes, using cryptographically signed document chips that cannot be duplicated or replicated with AI technology, protecting against document tampering and identity fraud.

How cryptographic verification builds trust and prevents fraud

NFC identity verification uses sophisticated cryptographic protocols to deliver unparalleled security. The system verifies document authenticity, detects fraud, and provides high-resolution images for biometric checks. Through encrypted communication, it safeguards personal data throughout the verification process. While the underlying protocols are complex, they form the foundation of secure identity verification—a critical tool for preventing fraud and building trust in digital services.