4.3 Session Key Destruction
All changes in this version
Title changed
Before · SP 800-73-4
Session Key Destruction
After · SP 800-73-5
Session Key Destruction
Control changed
Before · SP 800-73-4
The session keys established after successful execution of the key establishment protocol in Section 4.1 shall be zeroized in the following circumstances:
+ the card is reset;
+ an error occurs in secure messaging; 24 or
22 The response chaining is accomplished by issuing several GET RESPONSE commands to the card. 23 Status word '69 82' is used when secure messaging is requested, but no session keys have been established. + new session keys are requested by the client application by sending a GENERAL AUTHENTICATE command to the card to perform the key establishment protocol using the PIV Secure Messaging key.
24 An error has occurred in secure messaging if the SW processing status in the response to a command sent with secure messaging is other than '61 XX' or '90 00'. Appendix A—Examples of the Use of the GENERAL AUTHENTICATE Command
A.1 Authentication of the PIV Card Application Administrator
The PIV Card Application Administrator is authenticated by the PIV Card Application using a challenge/response protocol. A challenge retrieved from the PIV Card Application is encrypted by the client application and returned to the PIV Card Application associated with key reference '9B', the key reference of the PIV Card Application Administration key. The PIV Card Application decrypts the response using this reference data and the algorithm associated with the key reference (for example, 3 Key Triple DES – ECB, algorithm identifier '00'). If this decrypted value matches the previously provided challenge, then the security status indicator of the PIV Card Application Administration key is set to TRUE within the PIV Card Application.
Table 18 shows the GENERAL AUTHENTICATE card commands sent to the PIV Card Application to realize this particular challenge/response protocol.
Table 18. Authentication of PIV Card Application Administrator
'00 87 00 9B 04 7C 02 81 00 00' Client application requests a challenge from the PIV Card Application. '7C 0A 81 08 01 02 03 04
After · SP 800-73-5
The session keys established after successful execution of the key establishment protocol in Section 4.1 shall be zeroized in the following circumstances:
+ the card is reset;
+ an error occurs in secure messaging; 24 or
22 The response chaining is accomplished by issuing several GET RESPONSE commands to the card. 23 Status word '69 82' is used when secure messaging is requested, but no session keys have been established. + new session keys are requested by the client application by sending a GENERAL AUTHENTICATE command to the card to perform the key establishment protocol using the PIV Secure Messaging key.
24 An error has occurred in secure messaging if the SW processing status in the response to a command sent with secure messaging is other than '61 XX' or '90 00'. Appendix A—Examples of the Use of the GENERAL AUTHENTICATE Command
A.1 Authentication of the PIV Card Application Administrator
The PIV Card Application Administrator is authenticated by the PIV Card Application using a challenge/response protocol. A challenge retrieved from the PIV Card Application is encrypted by the client application and returned to the PIV Card Application associated with key reference '9B', the key reference of the PIV Card Application Administration key. The PIV Card Application decrypts the response using this reference data and the algorithm associated with the key reference (for example, 3 Key Triple DES – ECB, algorithm identifier '00'). If this decrypted value matches the previously provided challenge, then the security status indicator of the PIV Card Application Administration key is set to TRUE within the PIV Card Application.
Table 18 shows the GENERAL AUTHENTICATE card commands sent to the PIV Card Application to realize this particular challenge/response protocol.
Table 18. Authentication of PIV Card Application Administrator
'00 87 00 9B 04 7C 02 81 00 00' Client application requests a challenge from the PIV Card Application. '7C 0A 81 08 01 02 03 04