3.2.1.1 PIV Card Application PIN and Global PIN
All changes in this version
Title changed
Before · SP 800-73-4
PIV Card Application PIN and Global PIN
After · SP 800-73-5
PIV Card Application PIN and Global PIN
Control changed
Before · SP 800-73-4
If the key reference is '00' or '80' and the authentication data in the command data field does not satisfy the criteria in Section 2.4.3 , then the card command shall fail and the PIV Card Application shall return either the status word '6A 80' or '63 CX'. If status word '6A 80' is returned, the security status and the retry counter of the key reference shall remain unchanged. 7 If status word '63 CX' is returned, the security status of the key reference shall be set to FALSE and the retry counter associated with the key reference shall be decremented by one.
If the authentication data in the command data field is properly formatted (see previous paragraph) and does not match reference data associated with the key reference, then the card command shall fail, the PIV Card Application shall return the status word '63 CX', the security status of the key reference shall be set to FALSE, and the retry counter associated with the key reference shall be decremented by one.
If the card command succeeds, then the security status of the key reference shall be set to TRUE and the retry counter associated with the key reference shall be set to the reset retry value associated with the key reference. The initial value of the retry counter and the reset retry value associated with the key reference, i.e., the number of successive failures (retries) before the retry counter associated with the key reference reaches zero, are issuer dependent.
6 There is no retry counter associated with the pairing code, and so the authentication method cannot be blocked for that key reference.
After · SP 800-73-5
If the key reference is '00' or '80' and the authentication data in the command data field does not satisfy the criteria in Section 2.4.3 , then the card command shall fail and the PIV Card Application shall return either the status word '6A 80' or '63 CX'. If status word '6A 80' is returned, the security status and the retry counter of the key reference shall remain unchanged. 7 If status word '63 CX' is returned, the security status of the key reference shall be set to FALSE and the retry counter associated with the key reference shall be decremented by one.
If the authentication data in the command data field is properly formatted (see previous paragraph) and does not match reference data associated with the key reference, then the card command shall fail, the PIV Card Application shall return the status word '63 CX', the security status of the key reference shall be set to FALSE, and the retry counter associated with the key reference shall be decremented by one.
If the card command succeeds, then the security status of the key reference shall be set to TRUE and the retry counter associated with the key reference shall be set to the reset retry value associated with the key reference. The initial value of the retry counter and the reset retry value associated with the key reference, i.e., the number of successive failures (retries) before the retry counter associated with the key reference reaches zero, are issuer dependent.
6 There is no retry counter associated with the pairing code, and so the authentication method cannot be blocked for that key reference.