4.1.1 Client Application Steps
All changes in this version
Title
Client Application Steps
Control changed
Before · SP 800-73-4
Step # Description Comment H1 Set CB H to 0x00 The client application’s control byte is set to 0x00 to indicate the client application does not support persistent binding. H2 Generate an ephemeral key pair (d eH ; Q eH ) Generate an ephemeral ECC key pair for the client application using an approved method [FIPS186, Appendix B] and perform partial public-key validation [SP800-56A , Section 5.6.2.3.2], either as part of the key generation process or as a separate process. If the 0xAC tag of the application property template (APT) includes '27', then generate an ephemeral key pair over Curve P-256. If the 0xAC tag of the APT includes '2E', then generate an ephemeral key pair over Curve P-384. H3 Send CB H || ID sH || Q eH Wait for response from PIV Card Application: CB ICC || N ICC || AuthCryptogram ICC || C ICC H4 Check that CB ICC is 0x00 Verify that the card executed the protocol in accordance with the parameters specified in Step H1. Return an authentication error if check fails. Step # Description Comment H5 Verify C ICC signature and subject public key Verify signature on C ICC and, using standards-compliant PKI path validation, validate the content signing certificate needed to verify the signature on C ICC . 14 , 15 Verify that the domain parameters of the subject public key in C ICC are the same as the domain parameters for Q eH by checking the Algorithm OID in the CardHolderPublicKey Data Object (see Table 15 ). Return an authentication error if either verification fails. H6 ID sICC = T 8 (SHA256(C ICC )) ID sICC , the left-most 8 bytes of the SHA- 256 hash of C ICC , is used as an input for session key derivation. H7 Extract Q sICC from C ICC H8 Z = ECC_CDH (d eH , Q sICC ) Compute the shared secret, Z, using the ECC CDH primitive [SP800-56A , Section 5.7.1.2]. H9 Zeroize d eH Destroy the ephemeral private key generated in Step H2. H10 SK CFRM || SK MAC || SK ENC || SK RMAC = KDF(Z, len , OtherInfo ) Compute the key confirmation key and the session keys. See Section 4.1.6 . H11 Zeroize Z Destroy the shared secret generated in Step H8. H12 Check that AuthCryptogram ICC equals CMAC(SK CFRM , "KC_1_V" || ID sICC || ID sH || Q eH ) Perform key confirmation by verifying the authentication cryptogram as described in Section 4.1.7 . Return an authentication error if verification fails. H13 Zeroize SK CFRM Destroy the key confirmation key derived in Step H10.
After · SP 800-73-5
Table 15: Protocol Steps for Client Application
Step # Description Comment H1 Set CB HCBH to 0x00 The client application’s control byte is set to 0x00 to indicate that the client application does not support persistent binding. H2 Generate an ephemeral key pair (d eH deH; Q eH QeH) Generate an ephemeral ECC key pair for the client application using an approved method [FIPS186, Appendix B], and perform partial public-key validation [SP800-56A , SectionSec. 5.6.2.3.2], either as part of the key generation process or as a separate process. If the 0xAC tag of the application property template (APT) includes '27', then generate an ephemeral key pair over Curve P-256. If the 0xAC tag of the APT includes '2E', then generate an ephemeral key pair over Curve P-384. H3 Send CB HCBH || ID sHIDsH || Q eHQeH Wait for response from PIV Card Application: CB ICCCBICC || N ICCNICC || AuthCryptogram ICCAuthCryptogramICC || CCICC ICCStep # Description Comment H4 Check that CB ICCCBICC is 0x00 Verify that the card executed the protocol in accordance with the parameters specified in Step H1. Return an authentication error if check fails. Step # Description Comment H5 Verify C ICCCICC signature and subject public key Verify signature on C ICCCICC and, using standards-compliantstandards- compliant PKI path validation, validate the content signing certificate needed to verify the signature on CCICC. ICC15
15 .If 14the public key needed to verify the signature on CICC appears in an Intermediate CVC, 15then verify the signatures on both CICC and the Intermediate CVC and — using standards-compliant PKI validation — validate the content signing certificate needed to verify the signature on the Intermediate CVC. , 16
16 Validation of the content signing certificate does not need to be performed at the time of signature verification if the certificate has been previously validated or if the public key needed to verify the signature on CICC has been previously obtained from a trusted source. Verify that the domain parameters of the subject public key in C ICCCICC are the same as the domain parameters for Q eHQeH by checking the Algorithm OID in the CardHolderPublicKey Datadata Objectobject (see Table 1519 ). Return an authentication error if either verification fails. H6 ID sICCIDsICC = T 8 T8(SHA256(C ICC CICC)) ID sICCIDsICC ,— the left-mostleftmost 8 bytes of the SHA- 256SHA-256 hash of C ICCCICC ,— is used as an input for session key derivation. H7 Extract Q sICCQsICC from C ICCCICC H8 Z = ECC_CDH (d eH deH, Q sICC QsICC) Compute the shared secret, Z, using the ECC CDH primitive [SP800-56A , SectionSec. 5.7.1.2]. H9 Zeroize d eHdeH Destroy the ephemeral private key generated in Step H2. H10 SK CFRMSKCFRM || SK MACSKMAC || SK ENCSKENC || SK RMACSKRMAC = KDF(Z, len , OtherInfo ) Compute the key confirmation key and the session keys. See SectionSec. 4.1.6 . H11 Zeroize Z Destroy the shared secret generated in Step H8. H12 Check that AuthCryptogram ICCAuthCryptogramICC equals CMAC(SK CFRM SKCFRM, "KC_1_V" || ID sICCIDsICC || ID sHIDsH || Q eH QeH) Perform key confirmation by verifying the authentication cryptogram, as described in SectionSec. 4.1.7 . Return an authentication error if verification fails. H13 Zeroize SK CFRMSKCFRM Destroy the key confirmation key derived in Step H10.