From Can
Access key to authenticate to the chip of the eMRTD using the Card Access Number (CAN).
Authentication using the CAN is only supported for Password Authenticated Connection Establishment (PACE) and is not available with Basic Access Control (BAC).