Differential Testing Revealed What Conformance Testing Missed: A Case Study with Open-Source eMRTD Libraries

Short summary

A differential testing experiment compares two open-source eMRTD libraries (gmrtd in Go and JMRTD in Java) by replaying identical synthetic protocol traffic where PACE fails and BAC succeeds. Both libraries silently fall back from PACE to BAC without surfacing the downgrade to application code that only checks session success, earning an observability score of 0. The findings highlight that conformance testing alone cannot detect divergent security decisions across independent implementations.

• •Differential testing of gmrtd and JMRTD reveals silent PACE-to-BAC fallback invisible to naive integrators
• •Both libraries score observability 0: PACE failure is recorded internally but err returns nil
• •Reproducible synthetic protocol simulation replaces physical passport hardware for controlled testing

Generated with AI, which can make mistakes.