BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4.1.2 PIV Card Application Protocol Steps

NIST PIV and digital identity SP 800-73-5 against SP 800-73-4
All changes in this version
modified 4 Secure Messaging part of 4.1

Title

PIV Card Application Protocol Steps

Control changed

Before · SP 800-73-4

Step # Description Comment C1 ID sICC = T 8 (SHA256(C ICC )) ID sICC , the left-most 8 bytes of the SHA- 256 hash of C ICC , is used as an input for session key derivation. (Note that ID sICC is static, and so may be pre-computed off card.)

14 If the public key needed to verify the signature on CICC appears in an Intermediate CVC, then verify the signatures on both CICC and the Intermediate CVC and, using standards-compliant PKI validation, validate the content signing certificate needed to verify the signature on the Intermediate CVC. 15 Validation of the content signing certificate does not need to be performed at the time of signature verification if the certificate has been previously validated or if the public key needed to verify the signature on CICC has been previously obtained from a trusted source. Step # Description Comment C2 CB ICC = CB H & 'F0' Create the PIV Card Application’s control byte from client application’s control byte, indicating that persistent binding has not been used in this transaction, even if CB H indicates that the client application supports it. This may be done by setting CB ICC to the value of CB H and then setting the 4 least significant bits of CB ICC to 0. C3 Check that CB ICC is 0x00 Return an error ('6A 80') if CB ICC is not 0x00. C4 Verify that Q eH is a valid public key for the domain parameters of Q sICC Perform partial public-key validation of Q eH [SP800-56A , Section 5.6.2.3.3], 16 where the domain parameters are those of Q sICC . Also verify that P1 is '27' if the domain parameters of Q sICC are those of Curve P-256 or that P1 is '2E' if the domain parameters of Q sICC are those of Curve P-384. Return '6A 86' if P1 has the incorrect value. Return '6A 80' if public- key validation fails. C5 Z = ECC_CDH (d sICC , Q eH ) Compute the shared secret, Z, using the ECC CDH primitive [SP800-56A , Section 5.7.1.2]. C6 Generate nonce N ICC Create a random nonce, where the length is as specified in Table 14 . The nonce should be created using an approved random bit generator where the security strength supported by the random bit generator is at least as great as the bit length of the nonce being generated [SP800-56A , Section 5.3]. C7 SK CFRM || SK MAC || SK ENC || SK RMAC = KDF (Z, len , Otherinfo ) Compute the key confirmation key and the session keys. See Section 4.1.6 . C8 Zeroize Z Destroy shared secret generated in Step C5. C9 AuthCryptogram ICC = CMAC(SK CFRM , "KC_1_V" || ID sICC || ID sH || Q eH ) Compute the authentication cryptogram for key confirmation as described in Section 4.1.7 . C10 Zeroize SK CFRM Destroy the key confirmation key derived in Step C7. C11 Return CB ICC || N ICC || AuthCryptogram ICC || C ICC

16 The PIV Card Application may perform full public-key validation instead [SP800-56A, Section 5.6.2.3.2].

After · SP 800-73-5

Table 16: Protocol Steps for PIV Card Application

Step # Description Comment C1 ID sICCIDsICC = T 8 T8(SHA256(C ICC CICC)) ID sICCIDsICC ,— the left-mostleftmost 8 bytes of the SHA- 256SHA-256 hash of C ICCCICC ,— is used as an input for session key derivation. (Note that ID sICCIDsICC is static, and so mayMAY be pre-computed off cardoff-card.)

14 If the public key needed to verify the signature on CICC appears in an Intermediate CVC, then verify the signatures on both CICC and the Intermediate CVC and, using standards-compliant PKI validation, validate the content signing certificate needed to verify the signature on the Intermediate CVC. 15 Validation of the content signing certificate does not need to be performed at the time of signature verification if the certificate has been previously validated or if the public key needed to verify the signature on CICC has been previously obtained from a trusted source. Step # Description Comment C2 CB ICCCBICC = CB HCBH & 'F0' Create the PIV Card Application’s control byte from the client application’s control byte, indicating that persistent binding has not been used in thisthe transaction, even if CB HCBH indicates that the client application supports it. This mayMAY be done by setting CB ICCCBICC to the value of CB HCBH and then setting the 4four least significant bits of CB ICCCBICC to 0. C3 Check that CB ICCCBICC is 0x00 Return an error ('6A 80') if CB ICCCBICC is not 0x00. C4 Verify that Q eHQeH is a valid public key for the domain parameters of Q sICCQsICC Perform partial public-key validation of Q eHQeH [SP800-56A , SectionSec. 5.6.2.3.3], 1617

17 The PIV Card Application may perform full public-key validation instead [SP800-56A, Sec. 5.6.2.3.2]. where the domain parameters are those of Q sICC QsICC. Also verifyVerify that P1 is '27' if the domain parameters of Q sICCQsICC are those of Curve P-256 or that P1 is '2E' if the domain parameters of Q sICCQsICC are those of Curve P-384. Return '6A 86' if P1 has the incorrect value. Return '6A 80' if public- keypublic-key validation fails. C5 Z = ECC_CDH (d sICC dsICC, Q eH QeH) Compute the shared secret, Z, using the ECC CDH primitive [SP800-56A , SectionSec. 5.7.1.2]. C6 Generate nonce N ICCNICC Create a random nonce, where the length is as specified in Table 1418 . The nonce should be created using an approved random bit generator where the security strength supported by the random bit generator is at least as great as the bit length of the nonce being generated [SP800-56A , SectionSec. 5.3]. C7 SK CFRMSKCFRM || SK MACSKMAC || SK ENCSKENC || SK RMACSKRMAC = KDF (Z, len , Otherinfo ) Compute the key confirmation key and the session keys. See SectionSec. 4.1.6 . C8 Zeroize Z Destroy the shared secret generated in Step C5. C9 AuthCryptogram ICCAuthCryptogramICC = CMAC(SK CFRM SKCFRM, "KC_1_V" || ID sICCIDsICC || ID sHIDsH || Q eH QeH) Compute the authentication cryptogram for key confirmation, as described in SectionSec. 4.1.7 . C10 Zeroize SK CFRMSKCFRM Destroy the key confirmation key derived in Step C7. C11 Return CB ICCCBICC || N ICCNICC || AuthCryptogram ICCAuthCryptogramICC || C ICC

16 The PIV Card Application may perform full public-key validation instead [SP800-56A, Section 5.6.2.3.2].CICC