4.2.6 Response With PIV Secure Messaging (was: Response with PIV Secure Messaging)
All changes in this version
Title changed
Before · SP 800-73-4
Response with PIV Secure Messaging
After · SP 800-73-5
Response withWith PIV Secure Messaging
Control changed
Before · SP 800-73-4
For secure messaging, the secure messaging data field that is sent by the PIV Card Application shall be constructed as the concatenation of the following: the BER-TLV encoded encrypted message (when present); the 4-byte BER-TLV encoded status word, as described in Section 4.2.5 ; and the 10-byte BER- TLV encoded R-MAC of the response, as described in Section 4.2.5 .
Figure 6 illustrates a response under secure messaging for the case in which response chaining is not required. The APDU consists of the secure messaging data field and the 2-byte SW processing status ('90 00'), which indicates that the PIV Card Application successfully verified the C-MAC on the command and decrypted the data field in the command (if present). If the PIV Card Application was unable to verify the C-MAC on the command or decrypt the data field in the command, then it shall return a 2-byte error response, as described in Section 4.2.7 . Figure 6. Single Response under Secure Messaging
If the secure messaging data field to be transported is larger than 256 bytes, response chaining 22 will be needed. Figure 7 shows the APDUs for secure messaging that are sent by the PIV Card Application for a case in which the length of the secure messaging data field is between 513 and 768 bytes, requiring the data to be fragmented across three APDUs. After the first response an APDU of '00 C0 00 00 00' would be sent to request the second response, and after the second response an APDU of '00 C0 00 00 xx' would be sent to request the third response.
Figure 7. Chained Response under Secure Messaging
After · SP 800-73-5
For secure messaging, the secure messaging data field that is sent by the PIV Card Application shallSHALL be constructed as the concatenation of the following: the
• BER-TLVThe encodedBER-TLV-encoded encrypted message (when present);
• theThe 4-byte BER-TLV encodedBER-TLV-encoded status word, as described in Section 4.2.5 ; and
• theThe 10-byte BER- TLV encodedBER-TLV-encoded R-MAC of the response, as described in Section 4.2.5 .
Figure 6 illustrates a response under secure messaging for the case in whichwhen response chaining is not required. The APDU consists of the secure messaging data field and the 2-byte SW processing status ('90 00'), which indicates that the PIV Card Application successfully verified the C-MAC on the command and decrypted the data field in the command (if present). If the PIV Card Application was unable to verify the C-MAC on the command or decrypt the data field in the command, then it shallSHALL return a 2-byte error response, as described in Section 4.2.7 . Figure
Fig. 6. Single Responseresponse under Securesecure MessagingmessagingIfResponse chaining 23
23 Response chaining is accomplished by issuing several GET RESPONSE commands to the card. will be needed if the secure messaging data field to be transported is larger than 256 bytes, response chaining 22 will be needed. Figure 7 shows the APDUs for secure messaging that are sent by the PIV Card Application for a case in whichwhen the length of the secure messaging data field is between 513 and 768 bytes, requiringwhich requires the data to be fragmented across three APDUs. After the first response, an APDU of '00 C0 00 00 00' wouldwill be sent to request the second response, and. afterAfter the second response, an APDU of '00 C0 00 00 xx' wouldwill be sent to request the third response.FigureFig. 7. Chained Responseresponse under Securesecure Messagingmessaging