BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3.2.1 VERIFY Card Command

NIST PIV and digital identity SP 800-73-5 against SP 800-73-4
All changes in this version
modified 3 PIV Card Application Card Command Interface part of 3.2

Title

VERIFY Card Command

Control changed

Before · SP 800-73-4

The VERIFY card command initiates the comparison in the card of the reference data indicated by the key reference with authentication data in the data field of the command.

Key reference '80' specific to the PIV Card Application (i.e., local key references) and, optionally, the Global PIN with key reference '00', the OCC data (key references '96' and '97'), and pairing code (key reference '98') are the only key references that may be verified by the PIV Card Application’s VERIFY command. The PIV Card Application may allow other key references to be verified by the PIV Card Application’s VERIFY command, if they are used for card management operations.

Key reference '80' shall be able to be verified by the PIV Card Application VERIFY command. If the PIV Card Application does not contain the Discovery Object as described in Part 1, then no other key reference shall be able to be verified by the PIV Card Application VERIFY command. If the PIV Card Application contains the Discovery Object, then the ability of the PIV Card Application’s VERIFY command to verify key references '00', '96', '97', and '98' shall be as specified by the first byte of the Discovery Object’s PIN Usage Policy value:

• If Bit 6 is one, then key reference '00' shall be able to be verified by the PIV Card Application VERIFY command.

• If Bit 5 is one, then key references '96' and/or '97', as specified in the Biometric Information Templates Group Template, shall be able to be verified by the PIV Card Application VERIFY command.

• If Bit 4 is one, then key reference '98' shall be able to be verified by the PIV Card Application VERIFY command.

If any key reference value is specified that cannot be verified by the PIV Card Application, then the PIV Card Application shall return the status word '6A 88'.

The VERIFY command may be submitted over the contact interface and, under some conditions, over the contactless interface. The card command shall fail if:

• the key reference is '00' or '80' and the command is not submitted over either the contact interface or the VCI, or

• the key reference is '96', '97', or '98' and the command is submitted over the contactless interface without secure messaging. The P1 parameter shall be either '00' or 'FF'. If any other value is specified for the P1 parameter, then the PIV Card Application shall return the status word '6A 86'.

If the VERIFY command fails for one of the reasons specified above, then the security status and the retry counter of the key reference shall remain unchanged.

If P1='00', and L c and the command data field are absent, the command can be used to retrieve the number of further retries allowed ('63 CX'), or to check whether verification is not needed ('90 00').

If P1='00', and L c and the command data field are present, then the authentication data in the command data field shall be compared against the reference data associated with the key reference, as specified in the following subsections. However, if the key reference is '00', '80', '96', or '97' and the current value of the retry counter associated with the key reference is zero, then the PIV Card Application shall return the status word '69 83'. 6 In order to protect against blocking over the contactless interface, PIV Card Applications that implement secure messaging shall define an issuer-specified intermediate retry value for each of these key references and return '69 83' if the command is submitted over the contactless interface (over secure messaging or the VCI, as required for the key reference) and the current value of the retry counter associated with the key reference is at or below the issuer-specified intermediate retry value. If status word '69 83' is returned, then the comparison shall not be made, and the security status and the retry counter of the key reference shall remain unchanged.

If P1='FF', and L c and the command data field are absent, the command shall reset the security status of the key reference in P2. The security status of the key reference specified in P2 shall be set to FALSE and the retry counter associated with the key reference shall remain unchanged.

After · SP 800-73-5

The VERIFY card command initiates the comparison in the card of the reference data indicated by the key reference with authentication data in the data field of the command.

Key reference '80' specific to the PIV Card Application (i.e., local key references) and, optionally, the Global PIN with key reference '00', the OCC data (key references '96' and '97'), and pairing code (key reference '98') are the only key references that mayMAY be verified by the PIV Card Application’s VERIFY command. The PIV Card Application mayMAY allow other key references to be verified by the PIV Card Application’s VERIFY command, if they are used for card management operations.

Key reference '80' shallSHALL be able to be verified by the PIV Card Application VERIFY command. If the PIV Card Application does not contain the Discovery Object as described in Part 1, then no other key reference shallSHALL be able to be verified by the PIV Card Application VERIFY command. If the PIV Card Application contains the Discovery Object, then the ability of the PIV Card Application’s VERIFY command to verify key references '00', '96', '97', and '98' shallSHALL be as specified by the first byte of the Discovery Object’s PIN Usage Policy value:

• If Bit 6 is one, then key reference '00' shallSHALL be able to be verified by the PIV Card Application VERIFY command.

• If Bit 5 is one, then key references '96' and/or '97', as specified in the Biometric Information Templates Group Template, shallSHALL be able to be verified by the PIV Card Application VERIFY command.

• If Bit 4 is one, then key reference '98' shallSHALL be able to be verified by the PIV Card Application VERIFY command.

If any key reference value is specified that cannotCANNOT be verified by the PIV Card Application, then the PIV Card Application shallSHALL return the status word '6A 88'.

The VERIFY command mayMAY be submitted over the contact interface and, under some conditions, over the contactless interface. The card command shallSHALL fail if:

• theThe key reference is '00' or '80', and the command is not submitted over either the contact interface or the VCI, or

• theThe key reference is '96', '97', or '98', and the command is submitted over the contactless interface without secure messaging. The P1 parameter shallSHALL be either '00' or 'FF'. If any other value is specified for the P1 parameter, then the PIV Card Application shallSHALL return the status word '6A 86'.

If the VERIFY command fails for one of the reasons specified above, then the security status and the retry counter of the key reference shallSHALL remain unchanged.

If P1='00', and L cLc and the command data field are absent, the command canCAN be used to retrieve the number of further retries allowed ('63 CX'), or to check whether verification is not needed ('90 00').

If P1='00', and L cLc and the command data field are present, then the authentication data in the command data field shallSHALL be compared against the reference data associated with the key reference, as specified in the following subsections. However, if the key reference is '00', '80', '96', or '97' and the current value of the retry counter associated with the key reference is zero, then the PIV Card Application shallSHALL return the status word '69 83'. 67

7 There is no retry counter associated with the pairing code, so the authentication method cannot be blocked for that key reference. In order to protect against blocking over the contactless interface, PIV Card Applications that implement secure messaging shallSHALL define an issuer-specified intermediate retry value for each of these key references and return '69 83' if the command is submitted over the contactless interface (over secure messaging or the VCI, as required for the key reference) and the current value of the retry counter associated with the key reference is at or below the issuer-specified intermediate retry value. If status word '69 83' is returned, then the comparison shallSHALL notNOT be made, and the security status and the retry counter of the key reference shallSHALL remain unchanged.

If P1='FF', and L cLc and the command data field are absent, the command shallSHALL reset the security status of the key reference in P2. The security status of the key reference specified in P2 shallSHALL be set to FALSE, and the retry counter associated with the key reference shallSHALL remain unchanged.