BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

Appendix A PIV Data Model

NIST PIV and digital identity SP 800-73-5 against SP 800-73-4
All changes in this version
added Appendix A PIV Data Model

Title changed

Before · SP 800-73-4

After · SP 800-73-5

PIV Data Model

Control changed

Before · SP 800-73-4

After · SP 800-73-5

The PIV data model number is 0x10, and the data model version number is 0x01.

The SP 800-73-5 specification does not provide mechanisms to read partial contents of a PIV data object. Individual access to the TLV elements within a container is not supported. For each container, compliant cards SHALL return all TLV elements of the container in the order listed in this appendix.

Both single-chip/dual-interface and dual-chip implementations are feasible. In the single- chip/dual-interface configuration, the PIV Card Application SHALL be provided with information regarding which interface is in use. In the dual-chip configuration, a separate PIV Card Application SHALL be loaded on each chip.

Table 8. PIV data containers

Container Description ContainerID BER-TLV Tag Container Minimum Capacity (Bytes) 17

17 The values in this column denote the guaranteed minimum capacities of the on-card storage containers in bytes. Cards with larger containers may be produced and determined conformant. Access Rule for Read M/O/C Contact Contactless

Card Capability Container 0xDB00 '5FC107' 170 Always VCI M Card Holder Unique Identifier 0x3000 '5FC102' 2881 Always Always M

X.509 Certificate for PIV Authentication (Key Reference '9A') 0x0101 '5FC105' 1857 Always VCI M

Cardholder Fingerprints 0x6010 '5FC103' 4006 PIN VCI and PIN M Security Object 0x9000 '5FC106' 1336 Always VCI M Cardholder Facial Image 0x6030 '5FC108' 12710 PIN VCI and PIN M X.509 Certificate for Card Authentication (Key Reference '9E') 0x0500 '5FC101' 1857 Always Always M

X.509 Certificate for Digital Signature (Key Reference '9C') 0x0100 '5FC10A' 1857 Always VCI C

X.509 Certificate for Key Management (Key Reference '9D') 0x0102 '5FC10B' 1857 Always VCI C

Printed Information 0x3001 '5FC109' 245 PIN or OCC VCI and (PIN or OCC)

Discovery Object 0x6050 '7E' 19 Always Always O Key History Object 0x6060 '5FC10C' 128 Always VCI O Retired X.509 Certificate for Key Management 1 (Key reference '82') 0x1001 '5FC10D' 1895 Always VCI O Container Description ContainerID BER-TLV Tag Container Minimum Capacity (Bytes) 17 Access Rule for Read M/O/C Contact Contactless

Retired X.509 Certificate for Key Management 2 (Key reference '83') 0x1002 '5FC10E' 1895 Always VCI O

Retired X.509 Certificate for Key Management 3 (Key reference '84') 0x1003 '5FC10F' 1895 Always VCI O

Retired X.509 Certificate for Key Management 4 (Key reference '85') 0x1004 '5FC110' 1895 Always VCI O

Retired X.509 Certificate for Key Management 5 (Key reference '86') 0x1005 '5FC111' 1895 Always VCI O

Retired X.509 Certificate for Key Management 6 (Key reference '87') 0x1006 '5FC112' 1895 Always VCI O

Retired X.509 Certificate for Key Management 7(Key reference '88') 0x1007 '5FC113' 1895 Always VCI O

Retired X.509 Certificate for Key Management 8(Key reference '89') 0x1008 '5FC114' 1895 Always VCI O

Retired X.509 Certificate for Key Management 9 (Key reference '8A') 0x1009 '5FC115' 1895 Always VCI O

Retired X.509 Certificate for Key Management 10 (Key reference '8B') 0x100A '5FC116' 1895 Always VCI O

Retired X.509 Certificate for Key Management 11 (Key reference '8C') 0x100B '5FC117' 1895 Always VCI O

Retired X.509 Certificate for Key Management 12 (Key reference '8D') 0x100C '5FC118' 1895 Always VCI O

Retired X.509 Certificate for Key Management 13 (Key reference '8E') 0x100D '5FC119' 1895 Always VCI O

Retired X.509 Certificate for Key Management 14 (Key reference '8F') 0x100E '5FC11A' 1895 Always VCI O

Retired X.509 Certificate for Key Management 15 (Key reference '90') 0x100F '5FC11B' 1895 Always VCI O

Retired X.509 Certificate for Key Management 16 (Key reference '91') 0x1010 '5FC11C' 1895 Always VCI O Container Description ContainerID BER-TLV Tag Container Minimum Capacity (Bytes) 17 Access Rule for Read M/O/C Contact Contactless

Retired X.509 Certificate for Key Management 17 (Key reference '92') 0x1011 '5FC11D' 1895 Always VCI O

Retired X.509 Certificate for Key Management 18 (Key reference '93') 0x1012 '5FC11E' 1895 Always VCI O

Retired X.509 Certificate for Key Management 19 (Key reference '94') 0x1013 '5FC11F' 1895 Always VCI O

Retired X.509 Certificate for Key Management 20 (Key reference '95') 0x1014 '5FC120' 1895 Always VCI O

Cardholder Iris Images 0x1015 '5FC121' 7106 PIN VCI and PIN O Biometric Information Templates Group Template 0x1016 '7F61' 65 Always Always O

Secure Messaging Certificate Signer 0x1017 '5FC122' 2471 Always Always O

Pairing Code Reference Data Container 0x1018 '5FC123' 12 PIN or OCC VCI and (PIN or OCC)

Note that all data elements of the following data objects are mandatory unless specified as optional or conditional. Also note that in all tables that follow, the values in the “Max. Bytes” columns denote the lengths of the value (V) fields of BER-TLV elements.

Table 9. Card Capability Container

Card Capability Container 0xDB00 Card Identifier 0xF0 Fixed 0 or 21 Capability Container version number 0xF1 Fixed 0 or 1 Capability Grammar version number 0xF2 Fixed 0 or 1 Applications CardURL 0xF3 Variable 128 PKCS#15 0xF4 Fixed 0 or 1 Registered Data Model number 0xF5 Fixed 1 Access Control Rule Table 0xF6 Fixed 0 or 17 Card APDUs 0xF7 Fixed 0 Redirection Tag 0xFA Fixed 0 Capability Tuples (CTs) 0xFB Fixed 0 Status Tuples (STs) 0xFC Fixed 0 Next CCC 0xFD Fixed 0

Note that he previously deprecated optional Extended Application CardURL and Security Object Buffer data elements have been eliminated in this version of SP 800-73. Table 10. Card Holder Unique Identifier (CHUID)

CHUID 0x3000 FASC-N 0x30 Fixed 25 GUID 0x34 Fixed 16 Expiration Date 0x35 Date (YYYYMMDD) 8 Cardholder UUID (Optional) 0x36 Fixed 16 Issuer Asymmetric Signature 0x3E Variable 2816 18

18 The values in the “Max. Bytes” columns denote the lengths of the value (V) fields of BER-TLV elements.

Note that the Buffer Length, Organizational Identifier, and DUNS data elements have been eliminated in this version of SP 800-73.

The Error Detection Code is the same element as the Longitudinal Redundancy Code (LRC) in [TIG SCEPACS] . It is present in the CHUID because TIG SCEPACS makes the LRC mandatory. However, this document makes no use of the Error Detection Code, and, therefore the length of the TLV value is set to 0 bytes (i.e., no value will be supplied).

Table 11. X.509 Certificate for PIV Authentication

X.509 Certificate for PIV Authentication 0x0101 19

19 This is the recommended length. The certificate size can exceed the indicated length value. CertInfo 0x71 Fixed 1

Note that the MSCUID data element has been eliminated in this version.

Table 12. Cardholder fingerprints

Cardholder Fingerprints 0x6010 Fingerprint I & II 0xBC Variable 4000 20

20 This is the recommended length. The certificate that signed the Fingerprint I & II data element in the Cardholder Fingerprints data object can either be stored in the CHUID or in the Fingerprint I & II data element itself. For the latter, the “Max. Bytes” value quoted is a recommendation, and the signer certificate in CBEFF_SIGNATURE_BLOCK can exceed the “Max. Bytes.” Note that the use of separate content signing keys for biometric data and CHUID has been deprecated in FIPS 201-3. In future revisions, the CHUID and biometric elements will be signed with the same key. The content signing certificate will not be found in this data element but instead will be contained in the CHUID data element. Hence, the size will be as indicated in the table.

Table 13. Security Object

Security Object 0x9000 Mapping of DG to ContainerID 0xBA Variable 30 Security Object 0xBB Variable 1298 Table 14. Cardholder facial image

Cardholder Facial Image 0x6030 Facial Image 0xBC Variable 12704 21

21 This is the recommended length. The certificate that signed the Facial Image data element (tag 0xBC) can be stored in the CHUID or in the Facial Image data element itself. For the latter, the “Max. Bytes” value quoted is a recommendation, and the signer certificate in CBEFF_SIGNATURE_BLOCK can exceed the “Max. Bytes.” Note that the use of separate content signing keys for biometric data and CHUID has been deprecated in FIPS 201-3. In future revisions, the CHUID and biometric elements will be signed with the same key. The content signing certificate will not be found in this data element but instead will be contained in the CHUID data element. Hence, the size will be as indicated in the table.

Table 15. Printed information

Printed Information 0x3001 Name 0x01 Text (ASCII) 125 Employee Affiliation 0x02 Text (ASCII) 20 Expiration date 0x04 Date (YYYYMMMDD) 9 Agency Card Serial Number 0x05 Text (ASCII) 20 Issuer Identification 0x06 Fixed Text (ASCII) 15 Organization Affiliation (Line 1) (Optional) 0x07 Text (ASCII) 20 Organization Affiliation (Line 2) (Optional) 0x08 Text (ASCII) 20

Agencies SHOULD use tags 0x02, 0x07 and 0x08 to successfully match the printed information for verification on Zone 8F (Employee Affiliation) and Zone 10F (Agency, Department, or Organization) on the face of the card with the printed information stored electronically on the card.

Table 16. X.509 Certificate for Digital Signature

X.509 Certificate for Digital Signature 0x0100 22

22 This is the recommended length. The certificate size can exceed the indicated length value. CertInfo 0x71 Fixed 1

Note that the MSCUID data element has been eliminated in this version.

Table 17. X.509 Certificate for Key Management

X.509 Certificate for Key Management 0x0102 X.509 Certificate for Key Management 0x0102 CertInfo 0x71 Fixed 1

Note that the MSCUID data element has been eliminated in this version.

Table 18. X.509 Certificate for Card Authentication

X.509 Certificate for Card Authentication 0x0500 23

23 This is the recommended length. The certificate size can exceed the indicated length value. CertInfo 0x71 Fixed 1

Note that the MSCUID data element has been eliminated in this version of SP 800-73.

Table 19. Discovery Object

Discovery Object (Tag '7E') 0x6050 Data El Data Element (TLV) Tag Type Max. Bytes PIV Card Application AID 0x4F Fixed 12 PIN Usage Policy 0x5F2F Fixed 2

Table 20. Key History Object

Key History Object 0x6060 keysWithOnCardCerts 0xC1 Fixed 1 keysWithOffCardCerts 0xC2 Fixed 1 24

24 The numeric values indicated in keysWithOnCardCerts and keysWithOffCardCerts are represented as unsigned binary integers. offCardCertURL (Conditional) 25

25 The offCardCertURL data element shall be present if keysWithOffCardCerts is greater than zero and shall be absent if both keysWithOnCardCerts and keysWithOffCardCerts are zero. The offCardCertURL may be present if keyWithOffCardCerts is zero but keysWithOnCardCerts is greater than zero. 0xF3 Variable 118

Table 21. Retired X.509 Certificate for Key Management 1

R etired X.509 Certificate for Key Management 1 0x1001 23 CertInfo 0x71 Fixed 1

Note that the optional MSCUID data element was deprecated in a previous version and eliminated in this version of SP 800-73. However, historic retired key management certificates MAY still include the MSCUID element, so it is retained as an optional data element above. This applies to all of the retired key management key objects represented in Table 21 - Table 40 .

Table 22. Retired X.509 Certificate for Key Management 2

R etired X.509 Certificate for Key Management 2 0x1002 26

26 This is the recommended length. The certificate size can exceed the indicated length value. CertInfo 0x71 Fixed 1

Table 23. Retired X.509 Certificate for Key Management 3

Retired X.509 Certificate for Key Management 3 0x1003 26 CertInfo 0x71 Fixed 1

Table 24. Retired X.509 Certificate for Key Management 4

Retired X.509 Certificate for Key Management 4 0x1004 26 CertInfo 0x71 Fixed 1

Table 25. Retired X.509 Certificate for Key Management 5

Retired X.509 Certificate for Key Management 5 0x1005 26 CertInfo 0x71 Fixed 1

Table 26. Retired X.509 Certificate for Key Management 6

Retired X.509 Certificate for Key Management 6 0x1006 26 CertInfo 0x71 Fixed 1 Table 27. Retired X.509 Certificate for Key Management 7

Retired X.509 Certificate for Key Management 7 0x1007 26 CertInfo 0x71 Fixed 1

Table 28. Retired X.509 Certificate for Key Management 8

Retired X.509 Certificate for Key Management 8 0x1008 27

27 This is the recommended length. The certificate size can exceed the indicated length value. CertInfo 0x71 Fixed 1

Table 29. Retired X.509 Certificate for Key Management 9

Retired X.509 Certificate for Key Management 9 0x1009 27 CertInfo 0x71 Fixed 1

Table 30. Retired X.509 Certificate for Key Management 10

Retired X.509 Certificate for Key Management 10 0x100A 27 CertInfo 0x71 Fixed 1

Table 31. Retired X.509 Certificate for Key Management 11

Retired X.509 Certificate for Key Management 11 0x100B 27 CertInfo 0x71 Fixed 1

Table 32. Retired X.509 Certificate for Key Management 12

Retired X.509 Certificate for Key Management 12 0x100C Retired X.509 Certificate for Key Management 12 0x100C CertInfo 0x71 Fixed 1

Table 33. Retired X.509 Certificate for Key Management 13

Retired X.509 Certificate for Key Management 13 0x100D 28

28 This is the recommended length. The certificate size can exceed the indicated length value. CertInfo 0x71 Fixed 1

Table 34. Retired X.509 Certificate for Key Management 14

Retired X.509 Certificate for Key Management 14 0x100E 28 CertInfo 0x71 Fixed 1

Table 35. Retired X.509 Certificate for Key Management 15

Retired X.509 Certificate for Key Management 15 0x100F 28 CertInfo 0x71 Fixed 1

Table 36. Retired X.509 Certificate for Key Management 16

Retired X.509 Certificate for Key Management 16 0x1010 28 CertInfo 0x71 Fixed 1

Table 37. Retired X.509 Certificate for Key Management 17

Retired X.509 Certificate for Key Management 17 0x1011 28 CertInfo 0x71 Fixed 1 Retired X.509 Certificate for Key Management 17 0x1011

Table 38. Retired X.509 Certificate for Key Management 18

Retired X.509 Certificate for Key Management 18 0x1012 28 CertInfo 0x71 Fixed 1

Table 39. Retired X.509 Certificate for Key Management 19

Retired X.509 Certificate for Key Management 19 0x1013

Certificate 0x70 Variable 1856 Error! Bookmark not defined. CertInfo 0x71 Fixed 1

Table 40. Retired X.509 Certificate for Key Management 20

Retired X.509 Certificate for Key Management 20 0x1014

Certificate 0x70 Variable 1856 Error! Bookmark not defined. CertInfo 0x71 Fixed 1

The CertInfo byte in the certificate data objects identified in this appendix SHALL be encoded as follows:

b8 b7 b6 b5 b4 b3 b2 b1 RFU8 RFU7 RFU6 RFU5 RFU4 IsX509 CompressionTypeLsb CompressionTypeMsb

CompressionTypeMsb SHALL be 0 if the certificate is encoded in uncompressed form and 1 if the certificate is encoded using GZIP compression. 29

29 GZIP formats are specified in RFC 1951 and RFC 1952. CompressionTypeLsb and IsX509 SHALL be set to 0 for PIV Card Applications. Thus, for a certificate encoded in uncompressed form, CertInfo SHALL be 0x00. For a certificate encoded using GZIP compression, CertInfo SHALL be 0x01. Table 41. Cardholder iris images

Cardholder Iris Images 0x1015 Images for Iris 0xBC Variable 7100 30

30 This is the recommended length. The certificate that signed the Images for Iris data element (tag 0xBC) can be stored in the CHUID or in the Images for Iris data element itself. For the latter, the “Max. Bytes” value quoted is a recommendation, and the signer certificate in CBEFF_SIGNATURE_BLOCK can exceed the “Max. Bytes.” Note that the use of separate content signing keys for biometric data and CHUID has been deprecated in FIPS 201-3. In future revisions, the CHUID and biometric elements will be signed with the same key. The content signing certificate will not be found in this data element but instead will be contained in the CHUID data element. Hence, the size will be as indicated in the table

Table 42. Biometric Information Templates Group template

BIT Group template (Tag '7F61') 0x1016 Number of Fingers 0x02 Fixed 1 BIT for first Finger 0x7F60 Variable 28 BIT for second Finger (Optional) 0x7F60 Variable 28

Table 43. Secure Messaging Certificate Signer

Secure Messaging Certificate Signer 0x1017 X.509 Certificate for Content Signing 0x70 Variable 1856 CertInfo 0x71 Fixed 1 Intermediate CVC (Conditional) 31

31 The Intermediate CVC shall be absent if the X.509 Certificate for Content Signing contains the public key needed to verify the signature on the secure messaging CVC and shall be present otherwise. 0x7F21 Variable 601

The CertInfo byte in the Secure Messaging Certificate Signer data object SHALL provide information about the X.509 Certificate for Content Signing. The Intermediate CVC, if present, shall be stored in uncompressed form.

Table 44. Pairing Code Reference Data Container

Pairing Code 0x1018 Pairing Code 0x99 Fixed Text (ASCII) 8