4.2.4 Command with PIV Secure Messaging
All changes in this version
Title changed
Before · SP 800-73-4
Command with PIV Secure Messaging
After · SP 800-73-5
Command with PIV Secure Messaging
Control changed
Before · SP 800-73-4
For secure messaging, the secure messaging data field shall be constructed as the concatenation of the following: the BER-TLV encoded encrypted PIV data; 20 the 3-btye BER-TLV encoded L e , as described in Section 4.2.3 , if L e would have been included in a message sent without secure messaging; the 10-byte BER-TLV encoded C-MAC of the command, as described in Section 4.2.3 ; and a new L e field, which shall be one byte and have shall have a value of '00'. 21
The APDU for secure messaging is shown in Figure 3 for the case in which command chaining is not required. The APDU consists of the CLA byte ('0C'), INS, P1, P2, the length of the secure messaging data field (L c '), the secure messaging data field, and the new L e field ('00').
20 The data field may be absent in the case of the VERIFY command. 21 Note that the new Le field is always included in the command, even if Le would have been absent if the command were sent without secure messaging, since a response is always expected, even if the expected response only consists of the BER-TLV encoded status word and response MAC (R-MAC). Figure 3. Single Command under Secure Messaging If the secure messaging data field to be transported is larger than 255 bytes, command chaining will be needed. Figure 4 shows the APDUs for secure messaging for a case in which the length of the secure messaging data field is between 256 and 510 bytes, requiring the data to be fragmented across two APDUs. The APDUs are constructed in the same manner as when fragmentation is not required, except that the CLA byte for the first APDU is '1C', the first APDU contains the first 255 bytes of the secure messaging data field, and the second APDU contains the remaining bytes of the secure messaging data field and the new L e field ('00'). The PIV Card Application provides a two-byte response of '90 00' for the first APDU. After receiving the second APDU the PIV Card Application reconstructs and processes the entire command.
Figure 4. Chained Command under Secure Messaging
After · SP 800-73-5
For secure messaging, the secure messaging data field shall be constructed as the concatenation of the following: the BER-TLV encoded encrypted PIV data; 20 the 3-btye BER-TLV encoded L e , as described in Section 4.2.3 , if L e would have been included in a message sent without secure messaging; the 10-byte BER-TLV encoded C-MAC of the command, as described in Section 4.2.3 ; and a new L e field, which shall be one byte and have shall have a value of '00'. 21
The APDU for secure messaging is shown in Figure 3 for the case in which command chaining is not required. The APDU consists of the CLA byte ('0C'), INS, P1, P2, the length of the secure messaging data field (L c '), the secure messaging data field, and the new L e field ('00').
20 The data field may be absent in the case of the VERIFY command. 21 Note that the new Le field is always included in the command, even if Le would have been absent if the command were sent without secure messaging, since a response is always expected, even if the expected response only consists of the BER-TLV encoded status word and response MAC (R-MAC). Figure 3. Single Command under Secure Messaging If the secure messaging data field to be transported is larger than 255 bytes, command chaining will be needed. Figure 4 shows the APDUs for secure messaging for a case in which the length of the secure messaging data field is between 256 and 510 bytes, requiring the data to be fragmented across two APDUs. The APDUs are constructed in the same manner as when fragmentation is not required, except that the CLA byte for the first APDU is '1C', the first APDU contains the first 255 bytes of the secure messaging data field, and the second APDU contains the remaining bytes of the secure messaging data field and the new L e field ('00'). The PIV Card Application provides a two-byte response of '90 00' for the first APDU. After receiving the second APDU the PIV Card Application reconstructs and processes the entire command.
Figure 4. Chained Command under Secure Messaging