Differential Testing Revealed What Conformance Testing Missed: A Case Study with Open-Source eMRTD Libraries

Conformance suites tell us whether a library passes its own tests. They do not tell us whether two independent implementations make the same decision when presented with identical protocol traffic. in Go and

Checkout tag blog-b10-2026-07 (commit ef15b10, 7 July 2026). That pin is what this post describes; main may move on without changing the essay's claims.

git clone https://github.com/kazuru-chidumbwe/emrtd-differential-harness.git

cd emrtd-differential-harness

git checkout blog-b10-2026-07

bash scripts/bootstrap-vendor.sh

export GOTOOLCHAIN=auto

make smoke

You should get JSON traces with observability_score: 0 on both baseline drivers. Look in logs/ — the run_id field inside each file matches its filename. On Ubuntu 24.04 with Go 1.25+ (GOTOOLCHAIN=auto), Java 17, and Maven, make smoke finished in under a minute on a warmed lab VM where vendors were already bootstrapped. A cold first clone pays extra time for bootstrap-vendor.sh and compiling JMRTD from vendor source; budget several minutes, not seconds.

One practical wrinkle: the jmrtd-0.5.2 artifact on Maven Central is empty for our build. The bootstrap script compiles JMRTD from vendor source. Budget a few extra minutes the first time.

MIT license. If you extend the work, cite the run_id from your trace.

Closing

Two mainstream OSS passport readers. One synthetic downgrade. Both complete BAC after PACE fails. Both stay silent to a naive caller.

If that matters in your stack, rerun the pin before you ship. The traces are public. The check takes minutes. We are not asking you to trust our summary — we are asking you to run the same profile and read your own run_id.

Further reading: · · BSI TR-03110

Synthetic test environment only. No physical travel document was used. Results apply to gmrtd and JMRTD at TC-AC-01 smoke depth, tag blog-b10-2026-07.