NIST PIV and digital identity SP 800-73-4
All1 The value of the GUID data element of the CHUID data object shall be a 16-byte binary2 Overview: Concepts and Constructs3 PIV Card Application Card Command Interface4 Secure Messaging5 06 07 08 90 00'
| Ref | Title | Text | |
|---|---|---|---|
| 1 | The value of the GUID data element of the CHUID data object shall be a 16-byte binary | representation of a valid UUID [RFC4122] . The UUID shall be version 1, 4, or 5, as specified in [RFC4122 , Section 4.1.3]. 2. The same 16-byte binary representation of the UUID value shall be present as the value of an entryUUID attribute | |
| 1.1 in 1 |
Purpose | FIPS 201 defines procedures for the PIV lifecycle activities including identity proofing, registration, PIV Card issuance, and PIV Card usage. FIPS 201 also specifies that the identity credentials must be stored on a smart card. SP 800-73-4 | |
| 1.2 in 1 |
Scope | SP 800-73-4 specifies the PIV data model, application programming interface (API), and card interface requirements necessary to comply with the use cases, as defined in Section 6 of FIPS 201 and further described in Appendix B of SP 800-73- | |
| 1.3 in 1 |
Audience and Assumptions | This document is targeted at Federal agencies and implementers of PIV systems. Readers are assumed to have a working knowledge of smart card standards and applications. Readers should also be aware of SP 800-73-4 Part 1, Section I, for the | |
| 1.4 in 1 |
Content and Organization | All sections in this document are normative (i.e., mandatory for compliance) unless specified as informative (i.e., non-mandatory). Following is the structure of Part 2: + Section 1 , Introduction , provides the purpose, scope, audience, a | |
| 2 | Overview: Concepts and Constructs | SP 800-73-4 Parts 2 and 3 define two interfaces to an ICC that contains the PIV Card Application: a low- level card command interface (Part 2) and a high-level client API (Part 3). The information processing concepts and data constructs on | |
| 3 | PIV Card Application Card Command Interface | Table 2 lists the card commands surfaced by the PIV Card Application at the card edge of the ICC when it is the currently selected card application. All PIV Card Application card commands shall be supported by a PIV Card Application. Card c | |
| 3.1 in 3 |
PIV Card Application Card Commands for Data Access | ||
| 3.1.1 in 3.1 |
SELECT Card Command | The SELECT card command sets the currently selected application. The PIV Card Application shall be selected by providing its application identifier (see Part 1, Section 2.2) in the data field of the SELECT command. There shall be at most o | |
| 3.1.2 in 3.1 |
GET DATA Card Command | The GET DATA card command retrieves the data content of the single data object whose tag is given in the data field. 5 Command Syntax CLA '00' or '0C' for secure messaging INS 'CB' P1 '3F' P2 'FF' L c Length of data field * Data Field See | |
| 3.2 in 3 |
PIV Card Application Card Commands for Authentication | ||
| 3.2.1 in 3.2 |
VERIFY Card Command | The VERIFY card command initiates the comparison in the card of the reference data indicated by the key reference with authentication data in the data field of the command. Key reference '80' specific to the PIV Card Application (i.e., loc | |
| 3.2.1.1 in 3.2.1 |
PIV Card Application PIN and Global PIN | If the key reference is '00' or '80' and the authentication data in the command data field does not satisfy the criteria in Section 2.4.3 , then the card command shall fail and the PIV Card Application shall return either the status word '6 | |
| 3.2.1.2 in 3.2.1 |
On-Card Biometric Comparison | If the key reference is '96' or '97' and the authentication data in the command data field is not of length 3N, where N satisfies the requirements for minimum and maximum number of minutiae specified in the BIT, then the card command shall | |
| 3.2.1.3 in 3.2.1 |
Pairing Code | If the key reference is '98' and the authentication data in the command data field does not match the reference data associated with the key reference, the command shall fail and the PIV Card Application shall return the status word '63 00' | |
| 3.2.2 in 3.2 |
CHANGE REFERENCE DATA Card Command | The CHANGE REFERENCE DATA card command initiates the comparison of the authentication data in the command data field with the current value of the reference data and, if this comparison is successful, replaces the reference data with new re | |
| 3.2.3 in 3.2 |
RESET RETRY COUNTER Card Command | The RESET RETRY COUNTER card command resets the retry counter of the PIN to its initial value and changes the reference data. The command enables recovery of the PIV Card Application PIN in the case that the cardholder has forgotten the PIV | |
| 3.2.4 in 3.2 |
GENERAL AUTHENTICATE Card Command | The GENERAL AUTHENTICATE card command performs a cryptographic operation, such as an authentication protocol, using the data provided in the data field of the command and returns the result of the cryptographic operation in the response dat | |
| 4 | Secure Messaging | If a PIV Card Application implements the optional secure messaging protocol for non-card-management operations, it shall be implemented as specified in this section. Secure messaging is initiated through the use of a key establishment proto | |
| 4.1 in 4 |
The Key Establishment Protocol | The key establishment protocol for the PIV Card Application uses the One-Pass Diffie-Hellman, C(1e, 1s, ECC CDH) Scheme from [SP800-56A ] in a manner that is based on a simplified profile of OPACITY with Zero Key Management [ANSI504-1] , as | |
| 4.1.1 in 4.1 |
Client Application Steps | Step # Description Comment H1 Set CB H to 0x00 The client application’s control byte is set to 0x00 to indicate the client application does not support persistent binding. H2 Generate an ephemeral key pair (d eH ; Q eH ) Generate an ephemer | |
| 4.1.2 in 4.1 |
PIV Card Application Protocol Steps | Step # Description Comment C1 ID sICC = T 8 (SHA256(C ICC )) ID sICC , the left-most 8 bytes of the SHA- 256 hash of C ICC , is used as an input for session key derivation. (Note that ID sICC is static, and so may be pre-computed off card.) | |
| 4.1.3 in 4.1 |
Notations | Name Comment Format Size (in bytes) ICC Integrated Circuit Card (PIV Card) N/A N/A ID sICC Static, non-anonymous PIV Card identifier, which is the truncated hash of C ICC Binary 8 bytes GUID Card UUID (see Section 3.4.1 of Part 1) Binary 1 | |
| 4.1.4 in 4.1 |
Cipher Suite | This document specifies two cipher suites (see Table 14 ) that may be used for key establishment and secure messaging, one that provides 128 bits of channel strength and one that provides 192 bits of channel strength. If the PIV Card Applic | |
| 4.1.5 in 4.1 |
Card Verifiable Certificates | Table 15 specifies the format for the secure messaging CVC, C ICC , and Table 16 specifies the format for the optional Intermediate CVC. C ICC is used to authenticate the PIV Card Application. The specific data object tags and specified or | |
| 4.1.6 in 4.1 |
Key Derivation | The session keys shall be derived in Steps C7 and H10 of the protocol using the key derivation function from [SP800-56A , Section 5.8.1], with the auxiliary function H being the hash function specified as the KDF hash in Table 14 , the leng | |
| 4.1.7 in 4.1 |
Key Confirmation | Key confirmation shall be performed in Steps C9 and H12 of the protocol in accordance with Sections 5.9.1.1 and 6.2.2.3 of [SP800-56A ] by the generation of AuthCryptogram ICC . AuthCryptogram ICC shall be computed as CMAC( MacKey , MacLen | |
| 4.1.8 in 4.1 |
Command Interface | The following command interface shall be used for the key establishment protocol. Command Syntax CLA '00' INS '87' P1 Algorithm reference ('27' or '2E'), as specified in the 0xAC tag of the application property template P2 '04' (PIV Secur | |
| 4.2 in 4 |
Secure Messaging | PIV secure messaging is used to protect the integrity and confidentiality of the PIV data being transmitted between the card and the relying system. PIV secure messaging shall be provided using symmetric session keys derived using the key e | |
| 4.2.1 in 4.2 |
Secure Messaging Data Objects | The command and response messages shall be BER-TLV encoded according to Table 17 . Table 17. Secure Messaging Data Objects Tag Description '87' Padding-content indicator byte followed by the encrypted data '8E' Cryptographic checksum (MAC | |
| 4.2.2 in 4.2 |
Command and Response Data Confidentiality | Under secure messaging, the PIV data is encrypted using AES in Cipher Block Chaining (CBC) mode with the SK ENC session key, where SK ENC is a 128-bit key for CS2 and a 256-bit key for CS7 as per Table 14 . The encryption and encoding proce | |
| 4.2.3 in 4.2 |
Command Integrity | The Command MAC (C-MAC) shall be generated by applying the cipher-based MAC (CMAC) [SP800-38B] to the header and data field of a command using the SK MAC session key. In the case that fragmentation is required for data transmission, the com | |
| 4.2.4 in 4.2 |
Command with PIV Secure Messaging | For secure messaging, the secure messaging data field shall be constructed as the concatenation of the following: the BER-TLV encoded encrypted PIV data; 20 the 3-btye BER-TLV encoded L e , as described in Section 4.2.3 , if L e would have | |
| 4.2.5 in 4.2 |
Response Integrity | The Response MAC (R-MAC) shall be generated by applying CMAC [SP800-38B] to the data field and status bytes of the response using the SK RMAC session key. An R-MAC shall be generated for each response that corresponds to a command that was | |
| 4.2.6 in 4.2 |
Response with PIV Secure Messaging | For secure messaging, the secure messaging data field that is sent by the PIV Card Application shall be constructed as the concatenation of the following: the BER-TLV encoded encrypted message (when present); the 4-byte BER-TLV encoded stat | |
| 4.2.7 in 4.2 |
Error Handling | The SW processing status is the status word of the overall secure messaging command and response processing. It indicates if the secure messaging was performed successfully. If the processing was successful, it shall be '90 00'; otherwise, | |
| 4.3 in 4 |
Session Key Destruction | The session keys established after successful execution of the key establishment protocol in Section 4.1 shall be zeroized in the following circumstances: + the card is reset; + an error occurs in secure messaging; 24 or 22 The response | |
| 05 | 06 07 08 90 00' | Challenge ('01 02 03 04 05 06 07 08') returned to client application by the PIV Card Application. '00 87 00 9B 0C 7C 0A 82 |
38 of 38.