BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3 Client Application Programming Interface (was: PIV Card Application Card Command Interface)

NIST PIV and digital identity SP 800-73-5 against SP 800-73-4
All changes in this version
modified 3 Client Application Programming Interface

Title changed

Before · SP 800-73-4

PIV Card Application Card Command Interface

After · SP 800-73-5

PIV CardClient Application Card CommandProgramming Interface

Control changed

Before · SP 800-73-4

Table 2 lists the card commands surfaced by the PIV Card Application at the card edge of the ICC when it is the currently selected card application. All PIV Card Application card commands shall be supported by a PIV Card Application. Card commands indicated with a 'Yes' in the Command Chaining column shall support command chaining for transmitting a data string too long for a single command as defined in [ISO7816 ].

Table 2. PIV Card Application Card Commands

Type Name Contact Interface Contactless Interface Security Condition for Use Command Chaining PIV Card Application Card Commands for Data Access SELECT Yes Yes Always No

GET DATA Yes Yes Data Dependent. See Table 2, Part 1. No

PIV Card Application Card Commands for Authentication VERIFY Yes SM or VCI (see Note 1) Always Yes 3

CHANGE REFERENCE DATA Yes VCI PIN No

RESET RETRY COUNTER Yes No PIN Unblocking Key No

GENERAL AUTHENTICATE Yes Yes (See Note 2) Key Dependent. See Table 4b, Part 1. Yes

PIV Card Application Card Commands for Credential Initialization and Administration PUT DATA Yes No PIV Card Application Administrator Yes

GENERATE ASYMMETRIC KEY PAIR Yes No PIV Card Application Administrator Yes

The PIV Card Application shall return the status word of '6A 81' (Function not supported) when it receives a card command on the contactless interface marked “No” in the Contactless Interface column in Table 2 . The PIV Card Application may return a different status word (e.g., '69 82') if the card command can be performed over the contactless interface in support of card management. The PIV Card Application will only perform the command in support of card management if the requirements specified in Section 2.9.2 of FIPS 201-2 are satisfied.

Note 1: For SM, OCC and pairing code alone can be submitted via secure messaging (SM) over the contactless interface. All other key references require VCI for communication over the contactless interface.

3 The VERIFY command is only required to support command chaining if the PIV Card Application supports on-card biometric comparison (OCC). Note 2: Cryptographic protocols using private/secret keys that require the “PIN” or “OCC” security condition shall only be used on the contactless interface after a virtual contact interface (VCI) has been established. The VCI 4 is established when the following security condition is met:

(command is submitted over secure messaging) AND (the Discovery Object is present) AND (Bit 4 of the first byte of the PIN Usage Policy is one) AND ((the security status indicator associated with the pairing code is TRUE) OR (Bit 3 of the first byte of the PIN Usage Policy is one)).

After · SP 800-73-5

Table 21 lists the card commandsentry surfacedpoints byon the PIV Card Application at the card edge of the ICC when it is the currently selected cardclient applicationAPI. All PIV Card Application card commands shall beThis supportedsection byreferences aobject PIVidentifiers Card(OIDs), Application.which Cardare commandsdefined indicatedand withcan abe 'Yes'found in the Command Chaining column shall support command chaining for transmitting a data string too long for a single command asSP defined800-73-5 inPart1, [ISO7816Table ]3.

Table 21. Entry points on PIV Cardclient Applicationapplication Cardprogramming Commandsinterface

Type Name Contact Interface Contactless Interface Security

Entry ConditionPoints for Use Command Chaining PIV Card ApplicationCommunication CardpivMiddlewareVersion

pivConnect

pivDisconnect

Entry CommandsPoints for Data Access SELECT Yes Yes Always NopivSelectCardApplication

GET DATA Yes Yes Data Dependent. See Table 2, Part 1. NopivEstablishSecureMessaging

PIV Card Application Card Commands for Authentication VERIFY Yes SM or VCI (see Note 1) Always Yes 3pivLogIntoCardApplication

CHANGE REFERENCE DATA Yes VCI PIN NopivGetData

RESET RETRY COUNTER Yes No PIN Unblocking Key NopivLogoutOfCardApplication

GENERAL AUTHENTICATE Yes Yes (See Note 2) Key Dependent. SeeEntry TablePoints 4b,for PartCryptographic 1.Operations YespivCrypt

PIV Card Application CardEntry CommandsPoints for Credential Initialization and Administration PUT DATApivPutData

pivGenerateKeyPair

If Yesboth Nothe PIV CardMiddleware Applicationand Administratorthe Yes

GENERATEPIV ASYMMETRICCard KEYsupport PAIRsecure Yesmessaging, Nothen PIVall Cardnon-card Applicationmanagement Administratorfunctionality Yes1

The PIV1 CardOnly Applicationthe shallpivPutData returnand thepivGenerateKeyPair statusAPI wordfunctions ofperform '6Acard 81'management (Functionfunctionality. notof supported)the whenPIV itCard receivesMAY abe cardaccessed commandover oneither the contactlesscontact interfaceor markedcontactless “No”interface inof the Contactless Interfacecard. columnIn inorder Tableto 2perform .non-card Themanagement PIVfunctionality Cardthat Applicationwould mayotherwise returnbe alimited differentto statusthe wordcontact (e.g.interface, '69 82') if the cardclient commandapplication canmust befirst performedestablish overa thevirtual contactlesscontact interface inby supportcalling ofthe cardpivEstablishSecureMessaging management.function Theand PIVusing Cardthe ApplicationpivLogIntoCardApplication willfunction onlyto performsubmit the command in support of cardpairing managementcode ifto the requirements specified in Sectioncard. 2.9.

2 of FIPSAs 201-2noted arein satisfied.

NotePart 1:, ForSec. SM5.5, OCC andthe pairing code alone can bedoes submittednot vianeed secureto messagingbe (SM)submitted overif the contactless interface. All other keyBit references3 requireof VCIthe forfirst communicationbyte overof the contactless interface.

3 ThePIN VERIFYUsage commandPolicy is only requiredset to support command chainingone. ifIf the PIVclient Cardapplication Applicationdoes supportsnot on-cardhave biometricanother comparisonmeans (OCC).of Notedetermining 2:whether Cryptographiccommunication protocolswith usingthe private/secretPIV keysCard thatis requireover thea “PIN”contact or “OCC”contactless securityinterface, conditionit shallMAY onlyuse bethe usedpivGetData onfunction theto contactlessattempt interfaceto afterread a virtualmandatory contactdata interfaceobject (VCI)e.g., hassuch beenas established.the TheX.509 VCICertificate 4for isPIV establishedAuthentication whenor the following security conditionobject) isthat met:

(commandhas isan submittedaccess overrule securefor messaging)read ANDof (the“Always.” DiscoveryHowever, Objectthat is present) AND (Bit 4 of the firstonly byteaccessible ofover the PIN Usagecontact Policyand isvirtual one)contact ANDinterfaces ((thesee securitySP status800-73-5 indicatorPart1, associatedTable with2). If the pairingreturn code isfrom TRUE)pivGetData ORis (BitPIV_SECURITY_CONDITIONS_NOT_SATISFIED 3, ofthen the first bytecommunication ofwith the PINcard Usageis Policyover isa one))contactless interface.