4.1 Key Establishment Protocol (was: The Key Establishment Protocol)
All changes in this version
Title changed
Before · SP 800-73-4
The Key Establishment Protocol
After · SP 800-73-5
The Key Establishment Protocol
Control changed
Before · SP 800-73-4
The key establishment protocol for the PIV Card Application uses the One-Pass Diffie-Hellman, C(1e, 1s, ECC CDH) Scheme from [SP800-56A ] in a manner that is based on a simplified profile of OPACITY with Zero Key Management [ANSI504-1] , as depicted below.
Client Application (H) PIV Card Application (ICC) CB H = 0x00 H1 Generate an ephemeral key pair (d eH ; Q eH ) from the domain H2 parameters specified in the response to the SELECT command Send CB H || ID sH || Q eH H3 CB H || ID sH || Q eH
CB ICC || N ICC || AuthCryptogram ICC || C ICC ID sICC = T 8 (SHA256(C ICC )) C1 CB ICC = CB H & 'F0' C2 Check that CB ICC is 0x00 C3 Verify that Q eH is a valid public key for the domain C4 parameters of Q sICC Z = ECC_CDH(d sICC , Q eH ) C5 Generate nonce N ICC C6 SK CFRM || SK MAC || SK ENC || SK RMAC = KDF(Z, len , OtherInfo ) C7 Zeroize Z C8 AuthCryptogram ICC = C9 CMAC(SK CRFM , “KC_1_V” || ID sICC || ID sH || Q eH ) Zeroize SK CFRM C10 Return CB ICC || N ICC || AuthCryptogram ICC || C ICC C11
Check that CB ICC is 0x00 H4 Verify C ICC signature and subject public key H5 ID sICC = T 8 (SHA256(C ICC )) H6 Extract Q sICC from C ICC H7 Z = ECC_CDH(d eH , Q sICC ) H8 Zeroize d eH H9 SK CFRM || SK MAC || SK ENC || SK RMAC = KDF(Z, len , OtherInfo ) H10 Zeroize Z H11 Check that AuthCryptogram ICC equals H12 CMAC(SK CFRM , “KC_1_V” || ID sICC || ID sH || Q eH ) Zeroize SK CFRM H13
13 The protocol does not provide forward secrecy. Sections 4.1.1 and 4.1.2 provide additional details about each of the protocol steps performed by the client application and the PIV Card Application, and Section 4.1.3 defines the notations used in the description of the protocol. Section 4.1.4 provides the details of the two cipher suites that may be supported by the PIV Card Application. Section 4.1.5 specifies the format for the secure messaging card verifiable certificate (CVC) that is used to authenticate the PIV Card Application and for the optional Intermediate CVC that is used to verify the signature on the secure messaging CVC when the public key needed to verify the signature on the secure messaging CVC does not appear in an X.509 content signing certificate. Section 4.1.6 provides additional information about the key derivation function (KDF) used to derive the session keys that are used during secure messaging, and Section 4.1.7 provides additional information about the computation of the authentication cryptogram for key confirmation. Section 4.1.8 demonstrates the use of the GENERAL AUTHENTICATE command to perform the key establishment protocol.
After · SP 800-73-5
The key establishment protocol for the PIV Card Application uses the One-Pass Diffie-Hellman, C(1e, 1s, ECC CDH) Scheme from [SP800-56A ] in a manner that is based on a simplified profile of OPACITY with Zero Key Management [ANSI504-1] , as depicted in below.
Table 14: Key Establishment Protocol for PIV Card Application
Client Application (H) PIV Card Application (ICC) CB HCBH = 0x00 H1 Generate an ephemeral key pair (d eH deH; Q eH QeH) from the domain H2 parameters specified in the response to the SELECT command Send CB HCBH || ID sHIDsH || QQeH eHH1 H2
H3 CB HCBH || ID sHIDsH || Q eHQeHCB ICCCBICC || N ICCNICC || AuthCryptogram ICCAuthCryptogramICC || C ICC IDCICC sICCIDsICC = T 8 T8(SHA256(C ICC CICC)) C1 CB ICCCBICC = CB HCBH & 'F0' C2 Check that CB ICCCBICC is 0x00 C3 Verify that Q eHQeH is a valid public key for the domain C4 domain parameters of Q sICCQsICC Z = ECC_CDH(d sICC dsICC, Q eH QeH) C5 Generate nonce N ICCNICC C6 SK CFRMSKCFRM || SK MACSKMAC || SK ENCSKENC || SK RMACSKRMAC = KDF(Z, len , OtherInfo ) C7 Zeroize Z C8 AuthCryptogram ICCAuthCryptogramICC = C9 CMAC(SK CRFM SKCRFM, “KC_1_V” || ID sICCIDsICC || ID sHIDsH || Q eH QeH) Zeroize SK CFRMSKCFRM C10 Return CB ICCCBICC || N ICCNICC || AuthCryptogram ICCAuthCryptogramICC || C ICCCICC C11
Check that CB ICCCBICC is 0x00 H4 Verify C ICCCICC signature and subject public key H5 ID sICCIDsICC = T 8 T8(SHA256(C ICC CICC)) H4 H5 H6 Extract Q sICCQsICC from C ICC H7CICC Z = ECC_CDH(d eH deH, Q sICC QsICC) H8 Zeroize d eH H9 SKdeH CFRMSKCFRM || SK MACSKMAC || SK ENCSKENC || SK RMACSKRMAC = KDF(Z, len , OtherInfoO )therInfo H10) Zeroize Z H11 Check that AuthCryptogram ICCAuthCryptogramICC equals H12 CMAC(SK CFRM SKCFRM, “KC_1_V” || ID sICCIDsICC || ID sHIDsH || Q eH QeH) Zeroize SK CFRM H13SKCFRM
13 TheprotocolH7 doesH8 notH9 provideH10 forwardH11 secrecy.H12 H13
Sections 4.1.1 and 4.1.2 provide additional details about each of the protocol steps performed by the client application and the PIV Card Application, and. Section 4.1.3 defines the notations used in the description of the protocol. Section 4.1.4 provides the details ofabout the two cipher suites that mayMAY be supported by the PIV Card Application. Section 4.1.5 specifies the format for the secure messaging card verifiable certificate (CVC) that is used to authenticate the PIV Card Application and for the optional Intermediate CVC that is used to verify the signature on the secure messaging CVC when the public key needed to verify the signature on the secure messaging CVC does not appear in an X.509 content signing certificate. Section 4.1.6 provides additional information about the key derivation function (KDF) used to derive the session keys that are used during secure messaging, and. Section 4.1.7 provides additional information about the computation of the authentication cryptogram for key confirmation. Section 4.1.8 demonstrates the use of the GENERAL AUTHENTICATE command to perform the key establishment protocol.