I want to implement Chip Authentication for ePassport documents, and wish to validate my understanding of it.
I've managed to get it up and running by using the JMRTD library, specifically the function doEACCA(). When inspecting the code of this and associated functions, I observed that it doesn't actually verify the outcome of the protocol. It runs the CA protocol according to the standard, and this leads to a new Secure Messaging key, then switches the internal wrapper to use that protocol going forward. But it seems there's no actual validation done after this and no actual communication after this. So if one stopped here, it would actually lead to a false impression of success on the inspection system, since it doesn't know it derived a different shared key than the chip. In fact it seems somewhat of a misnomer to call the protocol Chip Authentication. It would be more correct to call it a key exchange. Since all the shared key is used for is to setup a new SM tunnel, I suppose (and this is what I want to verify by this question) that the actual validation happens first when issuing some other command. This command must involve SM - critically, the response from chip must have a payload that includes a MAC. It is validation of this MAC, by the inspection system, that actually completes the Chip Authentication.
It seems the choice of command (apart from the stated aspects above) is not important? If true, can you suggest a command to run? Due to other aspects of the setup in which my solution operates, it would be preferable with a simple, "one-shot" command where both command and response can fit in a single APDU etc. This will complete my communication with the chip.