BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4.2.6 Response with PIV Secure Messaging

NIST PIV and digital identity SP 800-73-4
All changes in this version
first version loaded 4 Secure Messaging part of 4.2

Title

Response with PIV Secure Messaging

Control

For secure messaging, the secure messaging data field that is sent by the PIV Card Application shall be constructed as the concatenation of the following: the BER-TLV encoded encrypted message (when present); the 4-byte BER-TLV encoded status word, as described in Section 4.2.5 ; and the 10-byte BER- TLV encoded R-MAC of the response, as described in Section 4.2.5 .

Figure 6 illustrates a response under secure messaging for the case in which response chaining is not required. The APDU consists of the secure messaging data field and the 2-byte SW processing status ('90 00'), which indicates that the PIV Card Application successfully verified the C-MAC on the command and decrypted the data field in the command (if present). If the PIV Card Application was unable to verify the C-MAC on the command or decrypt the data field in the command, then it shall return a 2-byte error response, as described in Section 4.2.7 . Figure 6. Single Response under Secure Messaging

If the secure messaging data field to be transported is larger than 256 bytes, response chaining 22 will be needed. Figure 7 shows the APDUs for secure messaging that are sent by the PIV Card Application for a case in which the length of the secure messaging data field is between 513 and 768 bytes, requiring the data to be fragmented across three APDUs. After the first response an APDU of '00 C0 00 00 00' would be sent to request the second response, and after the second response an APDU of '00 C0 00 00 xx' would be sent to request the third response.

Figure 7. Chained Response under Secure Messaging