C.2 PIV Algorithm Identifier Discovery for Symmetric Cryptographic Authentication

Before · SP 800-73-4

After · SP 800-73-5

PIV Algorithm Identifier Discovery for Symmetric Cryptographic Authentication

Before · SP 800-73-4

After · SP 800-73-5

In the absence of an X.509 certificate, as is the case with symmetric cryptography, the PIV algorithm identifier discovery mechanism has to rely on a lookup table that resides on the local system. The table maps a unique card identifier and key reference (inputs) to an associated PIV algorithm identifier (output). The unique identifier supplied by the card MAY be the Agency Code || System Code || Credential Number of the FASC-N or the Card UUID.

The symmetric Card Authentication key is optional to implement, and a relying party has no prior knowledge of the key’s existence. The following routine discovers the Card Authentication key’s native implementation:

• Read the CHUID, and extract either the Card UUID or the Agency Code || System code || Credential Number from the CHUID’s FASC-N.

• Retrieve the PIV algorithm identifier from the local lookup table. If no algorithm identifier is returned, authentication CANNOT be performed using the optional symmetric Card Authentication key, either because the PIV Card does not implement the key or the local system CANNOT authenticate the response from the card.