BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3 PIV Card Application Card Command Interface

NIST PIV and digital identity SP 800-73-4
All changes in this version
first version loaded 3 PIV Card Application Card Command Interface

Title

PIV Card Application Card Command Interface

Control

Table 2 lists the card commands surfaced by the PIV Card Application at the card edge of the ICC when it is the currently selected card application. All PIV Card Application card commands shall be supported by a PIV Card Application. Card commands indicated with a 'Yes' in the Command Chaining column shall support command chaining for transmitting a data string too long for a single command as defined in [ISO7816 ].

Table 2. PIV Card Application Card Commands

Type Name Contact Interface Contactless Interface Security Condition for Use Command Chaining PIV Card Application Card Commands for Data Access SELECT Yes Yes Always No

GET DATA Yes Yes Data Dependent. See Table 2, Part 1. No

PIV Card Application Card Commands for Authentication VERIFY Yes SM or VCI (see Note 1) Always Yes 3

CHANGE REFERENCE DATA Yes VCI PIN No

RESET RETRY COUNTER Yes No PIN Unblocking Key No

GENERAL AUTHENTICATE Yes Yes (See Note 2) Key Dependent. See Table 4b, Part 1. Yes

PIV Card Application Card Commands for Credential Initialization and Administration PUT DATA Yes No PIV Card Application Administrator Yes

GENERATE ASYMMETRIC KEY PAIR Yes No PIV Card Application Administrator Yes

The PIV Card Application shall return the status word of '6A 81' (Function not supported) when it receives a card command on the contactless interface marked “No” in the Contactless Interface column in Table 2 . The PIV Card Application may return a different status word (e.g., '69 82') if the card command can be performed over the contactless interface in support of card management. The PIV Card Application will only perform the command in support of card management if the requirements specified in Section 2.9.2 of FIPS 201-2 are satisfied.

Note 1: For SM, OCC and pairing code alone can be submitted via secure messaging (SM) over the contactless interface. All other key references require VCI for communication over the contactless interface.

3 The VERIFY command is only required to support command chaining if the PIV Card Application supports on-card biometric comparison (OCC). Note 2: Cryptographic protocols using private/secret keys that require the “PIN” or “OCC” security condition shall only be used on the contactless interface after a virtual contact interface (VCI) has been established. The VCI 4 is established when the following security condition is met:

(command is submitted over secure messaging) AND (the Discovery Object is present) AND (Bit 4 of the first byte of the PIN Usage Policy is one) AND ((the security status indicator associated with the pairing code is TRUE) OR (Bit 3 of the first byte of the PIN Usage Policy is one)).