BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4.3 Session Key Destruction

NIST PIV and digital identity SP 800-73-5 against SP 800-73-4
All changes in this version
modified 4 Secure Messaging part of 4

Title

Session Key Destruction

Control changed

Before · SP 800-73-4

The session keys established after successful execution of the key establishment protocol in Section 4.1 shall be zeroized in the following circumstances:

+ the card is reset;

+ an error occurs in secure messaging; 24 or

22 The response chaining is accomplished by issuing several GET RESPONSE commands to the card. 23 Status word '69 82' is used when secure messaging is requested, but no session keys have been established. + new session keys are requested by the client application by sending a GENERAL AUTHENTICATE command to the card to perform the key establishment protocol using the PIV Secure Messaging key.

24 An error has occurred in secure messaging if the SW processing status in the response to a command sent with secure messaging is other than '61 XX' or '90 00'. Appendix A—Examples of the Use of the GENERAL AUTHENTICATE Command

A.1 Authentication of the PIV Card Application Administrator

The PIV Card Application Administrator is authenticated by the PIV Card Application using a challenge/response protocol. A challenge retrieved from the PIV Card Application is encrypted by the client application and returned to the PIV Card Application associated with key reference '9B', the key reference of the PIV Card Application Administration key. The PIV Card Application decrypts the response using this reference data and the algorithm associated with the key reference (for example, 3 Key Triple DES – ECB, algorithm identifier '00'). If this decrypted value matches the previously provided challenge, then the security status indicator of the PIV Card Application Administration key is set to TRUE within the PIV Card Application.

Table 18 shows the GENERAL AUTHENTICATE card commands sent to the PIV Card Application to realize this particular challenge/response protocol.

Table 18. Authentication of PIV Card Application Administrator

'00 87 00 9B 04 7C 02 81 00 00' Client application requests a challenge from the PIV Card Application. '7C 0A 81 08 01 02 03 04

After · SP 800-73-5

The session keys established after successful execution of the key establishment protocol in Section 4.1 shallSHALL be zeroized in the following circumstances:

+• theThe card is reset;,

+• anAn error occurs in secure messaging; 24, or25

22 The response25 chainingAn iserror accomplishedhas byoccurred issuingin severalsecure GETmessaging RESPONSEif commandsthe toSW theprocessing card.status 23in Statusthe wordresponse '69to 82'a iscommand usedsent whenwith secure messaging is requested, butother nothan session'61 keysXX' haveor been'90 established00'. +or

• newNew session keys are requested by the client application by sending a GENERAL AUTHENTICATE command to the card to perform the key establishment protocol using the PIV Secure Messaging key.

24 AnReferences

[ANSI504-1] errorInterNational hasCommittee occurredfor inInformation secureTechnology messagingStandards if(2023) theINCITS SW504-1-2013 processing(R2023) status- inInformation theTechnology response- toGeneric aIdentity commandCommand sentSet with– securePart messaging1: isCard otherApplication thanCommand '61Set XX', [or '90as 00'amended]. AppendixAvailable A—Examplesat https://webstore.ansi.org/standards/incits/incits5042013r2023 [FIPS201] National Institute of theStandards Useand Technology (2022) Personal Identity Verification (PIV) of theFederal GENERALEmployees AUTHENTICATEand Command

AContractors.1 Authentication(Department of theCommerce, PIVWashington, CardDC), ApplicationFederal Administrator

TheInformation PIVProcessing CardStandards ApplicationPublication Administrator(FIPS) is201-3. authenticatedhttps://doi.org/10.6028/NIST.FIPS.201-3 by[ISO7816] theInternational PIVOrganization Cardfor ApplicationStandardization/International usingElectrotechnical aCommission challenge(2004-2020) ISO/responseIEC protocol7816 — Identification cards — Integrated circuit cards. A(multiple challengeparts): retrieved fromInternational theOrganization PIVfor CardStandardization/International ApplicationElectrotechnical isCommission encrypted(2020) byISO/IEC the7816-4:2020 client— applicationIdentification andcards returned— toIntegrated thecircuit PIVcards Card— ApplicationPart associated4: withOrganization, keysecurity referenceand '9B'commands for interchange. (International Organization for Standardization, theGeneva, keySwitzerland) reference[or as amended]. Available at https://www.iso.org/standard/77180.html  International Organization for Standardization/International Electrotechnical Commission (2004) ISO/IEC 7816-5:2004 — Identification cards — Integrated circuit cards — Part 5: Registration of theapplication PIVproviders. Card(International ApplicationOrganization Administrationfor keyStandardization, Geneva, Switzerland) [or as amended]. TheAvailable PIVat Cardhttps://www.iso.org/standard/34259.html Application decryptsInternational theOrganization responsefor usingStandardization/International thisElectrotechnical referenceCommission (2023) ISO/IEC 7816-6:2023 — Identification cards — Integrated circuit cards — Part 6: Interindustry data elements for interchange. (International Organization for Standardization, Geneva, Switzerland) [or as amended]. Available at https://www.iso.org/standard/77181.html  International Organization for Standardization/International Electrotechnical Commission (2021) ISO/IEC 7816-8:2021 — Identification cards — Integrated circuit cards — Part 8: Commands and themechanisms algorithmfor associatedsecurity withoperations. the(International keyOrganization referencefor Standardization, Geneva, Switzerland) [or as amended]. Available at https://www.iso.org/standard/79893.html  International Organization for Standardization/International Electrotechnical Commission (2017) ISO/IEC 7816-9:2017 — Identification cards — Integrated circuit cards — Part 9: Commands for examplecard management. (International Organization for Standardization, 3Geneva, KeySwitzerland) Triple[or DESas amended]. Available at https://www.iso.org/standard/67802.html [ISO8824] International Organization for Standardization/International Electrotechnical Commission (2021) ISO/IEC 8824-2:2021 — Information technology — Abstract Syntax Notation One (ASN.1) – ECBPart 2: Information object specification. (International Organization for Standardization, algorithmGeneva, identifierSwitzerland) '00'[or as amended]. Available at https://www.iso.org/standard/81417.html [ISO8825] International Organization for Standardization/International Electrotechnical Commission (2015) ISO/IEC 8825-1:2015— Information technology — ASN.1 Ifencoding thisrules: decryptedSpecification valueof matchesBasic theEncoding previouslyRules provided(BER), challengeCanonical Encoding Rules (CER) and Distinguished Encoding Rules (DER) Part 1. (International Organization for Standardization, thenGeneva, theSwitzerland) security[or statusas indicatoramended]. ofAvailable theat PIVhttps://www.iso.org/standard/81420.html Card[PKCS1] ApplicationMoriarty AdministrationK, keyKaliski isB, setJonsson toJ, TRUERusch withinA the(2016). PIVPublic-Key CardCryptography ApplicationStandards (PKCS) #1: RSA Cryptography Specifications Version 2.

Table2. 18(Internet showsEngineering theTask GENERALForce AUTHENTICATE(IETF)), cardIETF commandsRequest sentfor toComments (RFC) 8017. Available at https://www.rfc-editor.org/rfc/rfc8017 [SECG] Certicom (2009) Standards for Efficient Cryptography, SEC 1: Elliptic Curve Cryptography, Version 2.0. Available at https://www.secg.org/sec1-v2.pdf [SP800-38B] Dworkin MJ (2005) Recommendation for Block Cipher Modes of Operation: the PIVCMAC CardMode Applicationfor toAuthentication. realize(National thisInstitute particularof challengeStandards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-38B, Includes updates as of October 6, 2016 [or as amended]. https:/response/doi.org/10.6028/NIST.SP.800-38B protocol[SP800-56A] Barker EB, Chen L, Roginsky AL, Vassilev A, Davis R (2018) Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography.

Table 18(National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-56A, Rev. Authentication3 [or as amended]. https://doi.org/10.6028/NIST.SP.800-56Ar3 [SP800-76] Grother PJ, Salamon WJ, Chandramouli R (2013) Biometric Specifications for Personal Identity Verification. (National Institute of PIVStandards Cardand ApplicationTechnology, Administrator

'00Gaithersburg, 87MD), 00NIST 9BSpecial 04Publication 7C(SP) 02800-76-2 81[or 00as 00'amended]. Clienthttps://doi.org/10.6028/NIST.SP.800-76-2 application[SP800-78] requestsFerraiolo aH, challengeRegenscheid fromA the(2024) PIVCryptographic CardAlgorithms Applicationand Key Sizes for Personal Identity Verification. '7C(National 0AInstitute 81of 08Standards 01and 02Technology, 03Gaithersburg, 04MD), NIST Special Publication (SP) 800-78-5 [or as amended]. https://doi.org/10.6028/NIST.SP.800-78-5