BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4.1 The Key Establishment Protocol

NIST PIV and digital identity SP 800-73-4
All changes in this version
first version loaded 4 Secure Messaging part of 4

Title

The Key Establishment Protocol

Control

The key establishment protocol for the PIV Card Application uses the One-Pass Diffie-Hellman, C(1e, 1s, ECC CDH) Scheme from [SP800-56A ] in a manner that is based on a simplified profile of OPACITY with Zero Key Management [ANSI504-1] , as depicted below.

Client Application (H) PIV Card Application (ICC) CB H = 0x00 H1 Generate an ephemeral key pair (d eH ; Q eH ) from the domain H2 parameters specified in the response to the SELECT command Send CB H || ID sH || Q eH H3 CB H || ID sH || Q eH

CB ICC || N ICC || AuthCryptogram ICC || C ICC ID sICC = T 8 (SHA256(C ICC )) C1 CB ICC = CB H & 'F0' C2 Check that CB ICC is 0x00 C3 Verify that Q eH is a valid public key for the domain C4 parameters of Q sICC Z = ECC_CDH(d sICC , Q eH ) C5 Generate nonce N ICC C6 SK CFRM || SK MAC || SK ENC || SK RMAC = KDF(Z, len , OtherInfo ) C7 Zeroize Z C8 AuthCryptogram ICC = C9 CMAC(SK CRFM , “KC_1_V” || ID sICC || ID sH || Q eH ) Zeroize SK CFRM C10 Return CB ICC || N ICC || AuthCryptogram ICC || C ICC C11

Check that CB ICC is 0x00 H4 Verify C ICC signature and subject public key H5 ID sICC = T 8 (SHA256(C ICC )) H6 Extract Q sICC from C ICC H7 Z = ECC_CDH(d eH , Q sICC ) H8 Zeroize d eH H9 SK CFRM || SK MAC || SK ENC || SK RMAC = KDF(Z, len , OtherInfo ) H10 Zeroize Z H11 Check that AuthCryptogram ICC equals H12 CMAC(SK CFRM , “KC_1_V” || ID sICC || ID sH || Q eH ) Zeroize SK CFRM H13

13 The protocol does not provide forward secrecy. Sections 4.1.1 and 4.1.2 provide additional details about each of the protocol steps performed by the client application and the PIV Card Application, and Section 4.1.3 defines the notations used in the description of the protocol. Section 4.1.4 provides the details of the two cipher suites that may be supported by the PIV Card Application. Section 4.1.5 specifies the format for the secure messaging card verifiable certificate (CVC) that is used to authenticate the PIV Card Application and for the optional Intermediate CVC that is used to verify the signature on the secure messaging CVC when the public key needed to verify the signature on the secure messaging CVC does not appear in an X.509 content signing certificate. Section 4.1.6 provides additional information about the key derivation function (KDF) used to derive the session keys that are used during secure messaging, and Section 4.1.7 provides additional information about the computation of the authentication cryptogram for key confirmation. Section 4.1.8 demonstrates the use of the GENERAL AUTHENTICATE command to perform the key establishment protocol.