6.2.4 Authentication Using the Symmetric Card Authentication Key (SYM-CAK) (was: Authentication with the Symmetric Card Authentication Key (SYM-CAK))
All changes in this version
Title changed
Before · FIPS 201-2
Authentication with the Symmetric Card Authentication Key (SYM-CAK)
After · FIPS 201-3
Authentication withUsing the Symmetric Card Authentication Key (SYM-CAK)
Control changed
Before · FIPS 201-2
The PIV Card Application may host the optional symmetric Card Authentication key. In this case, the symmetric Card Authentication key shall be used for PIV cardholder authentication using the following steps:
• The CHUID, PIV Authentication certificate, or Card Authentication certificate data element is read from the PIV Card and is checked to ensure the card has not expired.
• The digital signature on the data element is checked to ensure that it was signed by a trusted source and is unaltered.
• The reader issues a challenge string to the card and requests a response.
34 Path validation should be configured to specify which policy OIDs are trusted. The policy OID for the Card Authentication certificate is id-fpki-common-cardAuth.
• The card responds to the previously issued challenge by encrypting the challenge using the symmetric Card Authentication key.
• The response is validated as the expected response to the issued challenge.
• A unique identifier within the data element is used as input to the authorization check to determine whether the cardholder should be granted access.
Some of the characteristics of the symmetric Card Authentication key authentication mechanism are as follows:
• Resistant to credential forgery.
• Does not provide protection against use of a revoked card.
• Low resistance to use of unaltered card by non-owner of card.
• Applicable with contact and contactless readers.
After · FIPS 201-3
(Deprecated)
The PIVsymmetric Cardcard Applicationauthentication maykey hostand theassociated optionalSYM-CAK symmetricauthentication Cardmechanism Authenticationare keydeprecated in this version of the Standard. InBoth the key and the authentication mechanism may be removed in a future version of this case,Standard.
If the symmetric Cardcard Authenticationauthentication key shallis present, it SHALL be used for PIV cardholder authentication using the following steps:
• The CHUID, PIV Authentication certificate, or Card Authentication certificateanother data element 41 is read from the PIV Cardcard and is checked to ensure that the card has not expired.
• The digital signature on the data element is checked to ensure that it was signed by a trusted source and is unaltered.
• The reader issues a challenge string to the card and requests a response.
34 Path validation should be configured to specify which policy OIDs are trusted. The policy OID for the Card Authentication certificate is id-fpki-common-cardAuth.
• The card responds to the previously issued challenge by encrypting the challenge using the symmetric Cardcard Authenticationauthentication key.
• The relying system decrypts the card’s response iswith validatedits assymmetric key and verifies that it matches the expectedchallenge responsestring sent to the issued challengecard.
• A unique identifier within the data element is used as input to the authorization check to determine whether the cardholder should be granted access.
Some of the characteristics of the symmetric Cardcard Authenticationauthentication key authentication mechanism are as follows:
• Resistantresistant to credential forgery.,
• Doesdoes not provide protection against use of a revoked card.,
• Lowlow resistance to the use of an unaltered card by non-ownera ofnon-owner, card.and
• Applicableusable with contact and contactless readers.