4.2.2 Cryptographic Specifications
All changes in this version
Title
Cryptographic Specifications
Control changed
Before · FIPS 201-2
The PIV Card shall implement the cryptographic operations and support functions as defined in [SP 800-78] and [SP 800-73].
The PIV Card must store private keys and corresponding public key certificates, and perform cryptographic operations using the asymmetric private keys. At a minimum, the PIV Card must store two asymmetric private keys and the corresponding public key certificates, namely the PIV Authentication key and the asymmetric Card Authentication key . The PIV Card must also store a digital signature key and a key management key , and the corresponding public key certificates, unless the cardholder does not have a government-issued email account at the time of credential issuance.
The PIV Card may include an asymmetric private key and corresponding public key certificate to establish symmetric keys for use with secure messaging, as specified in [SP 800-73] and [SP 800-78]. Secure messaging enables data and commands transmitted between the card and an external entity to be both integrity protected and encrypted. Secure messaging may be used, for example, to enable the use of on-card biometric comparison as an authentication mechanism.
Once secure messaging has been established, a virtual contact interface may be established. Requirements for the virtual contact interface are specified in [SP 800-73]. Any operation that may be performed over the contact interface of the PIV Card may also be performed over the virtual contact interface. With the exception of the Card Authentication key and keys used to establish a secure messaging, the cryptographic private key operations shall be performed only through the contact interface or the virtual contact interface.
Symmetric cryptographic operations are not mandated for the contactless interface, but departments and agencies may choose to supplement the basic functionality with storage for a symmetric Card Authentication key and support for a corresponding set of cryptographic operations. For example, if a department or agency wants to utilize Advanced Encryption Standard (AES) based challenge/response for physical access, the PIV Card must contain storage for the AES key and support AES operations through the contactless interface. Algorithms and key sizes for each PIV key type are specified in [SP 800-78].
The PIV Card has both mandatory keys and optional keys:
22 For legacy PKIs, as defined in Section 5.4, the certificates may be issued under a department or agency-specific policy that has been cross-certified with the Federal Bridge CA (FBCA) at the Medium Hardware or High Assurance Level.
• The PIV Authentication key is a mandatory asymmetric private key that supports card and cardholder authentication for an interoperable environment.
• The asymmetric Card Authentication key is a mandatory private key that supports card authentication for an interoperable environment.
• The symmetric (secret) Card Authentication key supports card authentication for physical access, and it is optional.
• The digital signature key is an asymmetric private key supporting document signing, and it is mandatory, unless the cardholder does not have a government-issued email account at the time of credential issuance.
• The key management key is an asymmetric private key supporting key establishment and transport, and it is mandatory, unless the cardholder does not have a government-issued email account at the time of credential issuance. Optionally, up to twenty retired key management keys may also be stored on the PIV Card.
• The PIV Card Application Administration Key is a symmetric key used for personalization and post- issuance activities, and it is optional.
• The PIV Card may include additional key(s) for use with secure messaging. These keys are defined in [SP 800-73] or [SP 800-78].
All PIV cryptographic keys shall be generated within a [FIPS140] validated cryptographic module with overall validation at Level 2 or above. In addition to an overall validation of Level 2, the PIV Card shall provide Level 3 physical security to protect the PIV private keys in storage. The scope of the validation for the PIV Card shall include all cryptographic operations performed over both the contact and contactless interfaces (1) by the PIV Card Application, (2) as part of secure messaging as specified in this section, and (3) as part of remote post issuance updates as specified in Section 2.9.2. Specific algorithm testing requirements for the cryptographic operations performed by the PIV Card Application are specified in [SP 800-78].
Requirements specific to storage and access for each key are detailed below. Where applicable, key management requirements are also specified.
• PIV Authentication Key. This key shall be generated on the PIV Card. The PIV Card shall not permit exportation of the PIV Authentication key. The cryptographic operations that use the PIV Authentication key shall be available only through the contact and the virtual contact interfaces of the PIV Card. Private key operations may be performed using an activated PIV Card without explicit user action (e.g., the PIN need not be supplied for each operation).
The PIV Card shall store a corresponding X.509 certificate to support validation of the public key. The X.509 certificate shall include the FASC-N in the subject alternative name extension using the pivFASC-N attribute to support physical access procedures. The X.509 certificate shall also include the UUID value from the GUID data element of the CHUID in the subject alternative name extension. The UUID shall be encoded as a uniform resource identifier (URI), as specified in Section 3 of [RFC4122]. The expiration date of the certificate must be no later than the expiration date of the PIV Card. The PIV Authentication certificate shall include a PIV NACI indicator (background investigation indicator) extension (see Appendix B.2); this non-critical extension indicates the status of the subject’s background investigation at the time of card issuance. 23 Section 5 of this document specifies the certificate format and the key management infrastructure for the PIV Authentication key.
+ Asymmetric Card Authentication Key. The asymmetric Card Authentication key may be generated on the PIV Card or imported to the card. The PIV Card shall not permit exportation of the Card Authentication key. Cryptographic operations that use the Card Authentication key shall be available through the contact and the contactless interfaces of the PIV Card. Private key operations may be performed using this key without card activation (e.g., the PIN need not be supplied for operations with this key).
The PIV Card shall store a corresponding X.509 certificate to support validation of the public key. The X.509 certificate shall include the FASC-N in the subject alternative name extension using the pivFASC-N attribute to support physical access procedures. The X.509 certificate shall also include the UUID value from the GUID data element of the CHUID in the subject alternative name extension. The UUID shall be encoded as a URI, as specified in Section 3 of [RFC4122]. The expiration date of the certificate must be no later than the expiration date of the PIV Card. Section 5 of this document specifies the certificate format and the key management infrastructure for asymmetric PIV Card Authentication keys.
+ Symmetric Card Authentication Key. The symmetric Card Authentication key may be imported onto the card by the issuer or be generated on the card. If present, the symmetric Card Authentication key shall be unique for each PIV Card and shall meet the algorithm and key size requirements stated in [SP 800-78]. If present , cryptographic operations using this key may be performed without card activation (e.g., the PIN need not be supplied for operations with this key). The cryptographic operations that use the Card Authentication key shall be available through the contact and the contactless interfaces of the PIV Card. This Standard does not specify key management protocols or infrastructure requirements.
• Digital Signature Key. The PIV digital signature key shall be generated on the PIV Card. The PIV Card shall not permit exportation of the digital signature key. If present, cryptographic operations using the digital signature key may only be performed using the contact and the virtual contact interfaces of the PIV Card. Private key operations may not be performed without explicit user action, as this Standard requires the cardholder to authenticate to the PIV Card each time it performs a private key computation with the digital signature key. 24
The PIV Card shall store a corresponding X.509 certificate to support validation of the public key. The expiration date of the certificate must be no later than the expiration date of the PIV Card. Section 5 of this document specifies the certificate format and the key management infrastructure for PIV digital signature keys.
• Key Management Key. This key may be generated on the PIV Card or imported to the card. If present, the cryptographic operations that use the key management key must only be accessible using the contact and the virtual contact interfaces of the PIV Card. Private key operations may be performed using an activated PIV Card without explicit user action (e.g., the PIN need not be supplied for each operation).
The PIV Card shall store a corresponding X.509 certificate to support validation of the public key. Section 5 of this document specifies the certificate format and the key management infrastructure for key management keys.
23 Other methods to indicate background investigative status will be explored in a future revision of this Standard. 24 [NISTIR7863], Cardholder Authentication for the PIV Digital Signature Key , addresses the appropriate use of PIN caching related to digital signatures.
• PIV Card Application Administration Key. If present, the PIV Card Application Administration Key shall be imported onto the card by the issuer. If present, the cryptographic operations that use the PIV Card Application Administration Key must only be accessible using the contact interface of the PIV Card.
After · FIPS 201-3
The PIV Card shallSHALL implement the cryptographic operations and support functions as defined in [SP 800-78] and [SP 800-73].
The PIV Card must store private keys and corresponding publichas keyboth certificates,mandatory and perform cryptographic operations using the asymmetric privateoptional keys. At a minimum, the :
PIV Cardauthentication mustkey storeA twomandatory asymmetric private keys and the corresponding public key certificates, namely the PIVthat Authenticationsupports keycard and thecardholder asymmetricauthentication Cardfor Authenticationan keyinteroperable environment. The PIV Card must also store a digital signature keySee andSection a4.2.2.1.
Asymmetric keycard managementauthentication key , and theA correspondingmandatory publicprivate key certificates, unless the cardholder does not havethat asupports government-issuedcard emailauthentication accountfor atan theinteroperable timeenvironment. ofSee credentialSection issuance4.2.2.2.The PIV Card may include an asymmetric private key andSymmetric correspondingcard publicauthentication key certificate(deprecated) toAn establishoptional symmetric keys for use with secure messaging, as specified in [SPkey 800-73]that andsupports [SPphysical 800-78]access. Secure messaging enables data and commandsSee transmittedSection between4.2.2.3.
Digital thesignature cardkey andAn anasymmetric externalprivate entitykey tothat besupports bothdocument integritysigning; protectedit andis encrypted.mandatory Secureif messagingthe maycardholder behas used,a forgovernment-issued example,email toaccount enableat the usetime of on-card biometricPIV comparisonCard asissuance. anSee authenticationSection mechanism4.2.2.4.OnceKey securemanagement messagingkey hasAn beenasymmetric established,private akey virtualthat contactsupports interfacekey mayestablishment; beit established.is Requirementsmandatory forif the virtual contact interface are specified in [SP 800-73]. Anycardholder operationhas thata maygovernment-issued beemail performedaccount overat the contact interfacetime of the PIV Card may also be performed over the virtual contact interfaceissuance. With the exceptionOptionally, ofup theto Card20 Authenticationretired key andmanagement keys used to establish a secure messaging, the cryptographic private key29 operationsmay shallalso be performed onlystored throughon the contact interface orPIV theCard. virtualSee contactSection interface4.2.2.5.Symmetric cryptographic operations are not mandated for the contactless interface, but departments and agencies may choose to supplement thePIV basicCard functionalityapplication withadministration storagekey forAn aoptional symmetric Card Authentication key and supportused for a corresponding setpersonalization ofand cryptographicpost-issuance operationsactivities. For example, if a department or agency wants to utilize Advanced Encryption Standard (AES) based challenge/response for physical access,See theSection 4.2.2.6.
PIV Cardsecure mustmessaging containkey storageAn foroptional theasymmetric AESprivate key and support AESthat operationssupports throughkey theestablishment contactlessfor interface.secure Algorithmsmessaging and keycard sizesauthentication for each PIV key type arephysical specifiedaccess. inSee [SPSection 800-78]4.2.2.7.
The PIV Card hasSHALL bothstore mandatoryprivate keys and optionalcorresponding keys:public
22Forkey legacycertificates PKIs,and asSHALL definedperform incryptographic Sectionoperations 5.4,using the certificates mayasymmetric beprivate issuedkeys. underAt a department or agency-specific policy that has been cross-certified withminimum, the Federal BridgePIV CACard (FBCA)SHALL atstore the Medium Hardware or High Assurance Level.PIV
• The Authenticationauthentication key is a, mandatorythe asymmetric private key thatcard supportsauthentication cardkey, and cardholder authenticationthe forcorresponding anpublic interoperablekey environmentcertificates.
•asymmetricPIV Card AuthenticationSHALL keyalso isstore a mandatorydigital privatesignature key that supports card authentication for an interoperable environment.,
• The symmetric (secret) CardAuthenticationa key supports card authentication for physicalmanagement accesskey, and itthe iscorresponding optional.public key•29 TheRetired digitalkey signaturemanagement keykeys isare ankeys asymmetricth privateat keyhave supportingexpired, documenthave signingbeen revoked, andor ithave isotherwise mandatory,been superseded. certificates unless the cardholder does not have a government-issued email account at the time of credentialPIV Card issuance.• The key management keyWith isthe anexception asymmetricof privatethe keycard supportingauthentication key establishment and transport, andkeys itused isto mandatory,establish unlesssecure themessaging, cardholdercryptographic doesprivate notkey haveoperations aSHALL government-issuedbe emailperformed accountonly atthrough the time of credential issuance.contact Optionally,interface upor tothe twentyvirtual retiredcontact keyinterface. managementAny keysoperation maythat alsoMAY be storedperformed onover the PIVcontact Card.interface
•Theof the PIV Card Application Administration Key is a symmetric key used for personalizationMAY andalso post-be issuanceperformed activities,over andthe itvirtual iscontact optionalinterface.
•The PIV Card may include additional key(s)Requirements for use with securethe messaging.virtual Thesecontact keysinterface are definedspecified in [SP 800-73] or [SP 800-78].
All PIV cryptographic keys shallSHALL be generated within a [FIPS140] validated cryptographic module with overall validation at [FIPS 140] Level 2 or above. In addition to an overall validation of Level 2, the PIV Card shallSHALL provide Level 3 physical security to protect the PIV private keys in storage. The scope of the validation for the PIV Card shallSHALL include all cryptographic operations performed over both the contact and contactless interfaces (1)
• by the PIV Card Application, (2)application;
• as part of secure messaging, as specified in this section,; and (3)
• as part of remote post issuance updates, as specified in Section 2.9.2.
Specific algorithm testing requirements for the cryptographic operations performed by the PIV Card Applicationapplication are specified in [SP 800-78].
Requirements specific to storage and access for each key are detailed below. Where applicable, key management requirements are also specified.in the
• PIV Authentication Key. This key shall be generated on the PIV Card. The PIV Card shall not permit exportation of the PIV Authentication key. The cryptographic operations that use the PIV Authentication key shall be available only through the contact and the virtual contact interfaces of the PIV Card. Private key operations may be performed using an activated PIV Card without explicit user action (e.g., the PIN need not be supplied for each operation).
The PIV Card shall store a corresponding X.509 certificate to support validation of the public key. The X.509 certificate shall include the FASC-N subject alternative name extension using the pivFASC-N attribute to support physical access procedures. The X.509 certificate shall also include the UUID value from the GUID data element of the CHUID in the subject alternative namefollowing extensionsections. The UUID shall be encoded as a uniform resource identifierWhere (URI)applicable, as specified in Section 3 of [RFC4122]. The expiration date of the certificate must be no later than the expiration date of the PIV Card. The PIV Authentication certificate shall include a PIV NACI indicator (background investigation indicator) extension (see Appendix B.2); this non-critical extension indicates the status of the subject’s background investigation at the time of card issuance. 23 Section 5 of this document specifies the certificate format and the key management infrastructure for the PIV Authentication key.requirements
+ Asymmetric Card Authentication Key. The asymmetric Card Authentication key may be generated on the PIV Card or imported to the card. The PIV Card shall not permit exportation of the Card Authentication key. Cryptographic operations that use the Card Authentication key shall be available through the contact and the contactless interfaces of the PIV Card. Private key operations may be performed using this key without card activation (e.g., the PIN need not be supplied for operations with this key).
The PIV Card shall store a corresponding X.509 certificate to support validation of the public key. The X.509 certificate shall include the FASC-N in the subject alternative name extension using the pivFASC-N attribute to support physical access procedures. The X.509 certificateshallare also include the UUID value from the GUID data element of the CHUID in the subject alternative name extension. The UUID shall be encoded as a URI, as specified in Section 3 of [RFC4122]. The expiration date of the certificate must be no later than the expiration date of the PIV Card. Section 5 of this document specifies the certificate format and the key management infrastructure for asymmetric PIV Card Authentication keys.
+ Symmetric Card Authentication Key. The symmetric Card Authentication key may be imported onto the card by the issuer or be generated on the card. If present, the symmetric Card Authentication key shall be unique for each PIV Card and shall meet the algorithm and key size requirements stated in [SP 800-78]. If present , cryptographic operations using this key may be performed without card activation (e.g., the PIN need not be supplied for operations with this key). The cryptographic operations that use the Card Authentication key shall be available through the contact and the contactless interfaces of the PIV Card. This Standard does not specify key management protocols or infrastructure requirements.
• Digital Signature Key. The PIV digital signature key shall be generated on the PIV Card. The PIV Card shall not permit exportation of the digital signature key. If present, cryptographic operations using the digital signature key may only be performed using the contact and the virtual contact interfaces of the PIV Card. Private key operations may not be performed without explicit user action, as this Standard requires the cardholder to authenticate to the PIV Card each time it performs a private key computation with the digital signature key. 24
The PIV Card shall store a corresponding X.509 certificate to support validation of the public key. The expiration date of the certificate must be no later than the expiration date of the PIV Card. Section 5 of this document specifies the certificate format and the key management infrastructure for PIV digital signature keys.
• Key Management Key. This key may be generated on the PIV Card or imported to the card. If present, the cryptographic operations that use the key management key must only be accessible using the contact and the virtual contact interfaces of the PIV Card. Private key operations may be performed using an activated PIV Card without explicit user action (e.g., the PIN need not be supplied for each operation).
The PIV Card shall store a corresponding X.509 certificate to support validation of the public key. Section 5 of this document specifies the certificate format and the key management infrastructure for key management keys.
23 Other methods to indicate background investigative status will be explored in a future revision of this Standard. 24 [NISTIR7863], Cardholder Authentication for the PIV Digital Signature Key , addresses the appropriate use of PIN caching related to digital signatures.
• PIV Card Application Administration Key. If present, the PIV Card Application Administration Key shall be imported onto the card by the issuer. If present, the cryptographic operations that use the PIV Card Application Administration Key must only be accessible using the contact interface of the PIV Card.