3.1.1 SELECT Card Command
All changes in this version
Title changed
Before · SP 800-73-4
SELECT Card Command
After · SP 800-73-5
SELECT Card Command
Control changed
Before · SP 800-73-4
The SELECT card command sets the currently selected application. The PIV Card Application shall be selected by providing its application identifier (see Part 1, Section 2.2) in the data field of the SELECT command.
There shall be at most one PIV Card Application on any ICC. The PIV Card Application can also be made the currently selected application by providing the right-truncated version (see Part 1, Section 2.2); that is, without the two-byte version number in the data field of the SELECT command.
The complete AID, including the two-byte version, of the PIV Card Application that became the currently selected card application upon successful execution of the SELECT command (using the full or right- truncated PIV AID) shall be returned in the application property template.
If the currently selected application is the PIV Card Application when the SELECT command is given and the AID in the data field of the SELECT command is either the AID of the PIV Card Application or the right-truncated version thereof, then the PIV Card Application shall continue to be the currently selected card application and the setting of all security status indicators in the PIV Card Application shall be unchanged.
If the currently selected application is the PIV Card Application when the SELECT command is given and the AID in the data field of the SELECT command is not the PIV Card Application (or the right- truncated version thereof), but a valid AID supported by the ICC, then the PIV Card Application shall be deselected and all the PIV Card Application security status indicators in the PIV Card Application shall be set to FALSE.
If the currently selected application is the PIV Card Application when the SELECT command is given and the AID in the data field of the SELECT command is an invalid AID not supported by the ICC, then the PIV Card Application shall remain the currently selected application and all PIV Card Application security status indicators shall remain unchanged.
Command Syntax
CLA '00' INS 'A4' P1 '04' P2 '00' L c Length of application identifier
4 The VCI is explained in further details in Part 1, Section 5.5. Data Field AID of the PIV Card Application using the full AID or the right-truncated AID (See Section 2.2, Part 1) L e '00'
Data Field Application property template (APT). See Table 3 below SW1-SW2 Status word
Upon selection, the PIV Card Application shall return the application property template described in Table 3 .
Table 3. Data Objects in the PIV Card Application Property Template (Tag '61')
Description Tag M/O/C Comment
Application identifier of application '4F' M The PIX of the AID includes the encoding of the version of the PIV Card Application. See Section 2.2, Part 1.
Coexistent tag allocation authority '79' M Coexistent tag allocation authority template. See Table 4 .
Application label '50' O Text describing the application; e.g., for use on a man-machine interface.
Uniform resource locator '5F50' O Reference to the specification describing the application. Cryptographic algorithms supported 'AC' C Cryptographic algorithm identifier template. See Table 5 .
Table 4. Data Objects in a Coexistent Tag Allocation Authority Template (Tag '79')
Name Tag M/O Comment Application identifier '4F' M See Section 2.2, Part 1
A PIV Card Application may use a subset of the cryptographic algorithms defined in SP 800-78. Tag 0xAC encodes the cryptographic algorithms supported by the PIV Card Application. The encoding of tag 0xAC shall be as specified in Table 5 . Each instance of tag 0x80 shall encapsulate one algorithm. The presence of algorithm identifier '27' or '2E' indicates that the corresponding cipher suite is supported by the PIV Card Application for secure messaging and that the PIV Card Application possesses a PIV Secure Messaging key of the appropriate size for the specified cipher suite. Tag 0xAC shall be present and indicate algorithm identifier 0x27 or 0x2E (but not both) when the PIV Card Application supports secure messaging.
Table 5. Data Objects in a Cryptographic Algorithm Identifier Template (Tag 'AC')
Name Tag M/O Comment Cryptographic algorithm identifier '80' M For values see [SP800-78 , Table 6-2]
Object identifier '06' M Its value is set to 0x00 '6A' '82' Application not found
After · SP 800-73-5
The SELECT card command sets the currently selected application. The PIV Card Application shall be selected by providing its application identifier (see Part 1, Section 2.2) in the data field of the SELECT command.
There shall be at most one PIV Card Application on any ICC. The PIV Card Application can also be made the currently selected application by providing the right-truncated version (see Part 1, Section 2.2); that is, without the two-byte version number in the data field of the SELECT command.
The complete AID, including the two-byte version, of the PIV Card Application that became the currently selected card application upon successful execution of the SELECT command (using the full or right- truncated PIV AID) shall be returned in the application property template.
If the currently selected application is the PIV Card Application when the SELECT command is given and the AID in the data field of the SELECT command is either the AID of the PIV Card Application or the right-truncated version thereof, then the PIV Card Application shall continue to be the currently selected card application and the setting of all security status indicators in the PIV Card Application shall be unchanged.
If the currently selected application is the PIV Card Application when the SELECT command is given and the AID in the data field of the SELECT command is not the PIV Card Application (or the right- truncated version thereof), but a valid AID supported by the ICC, then the PIV Card Application shall be deselected and all the PIV Card Application security status indicators in the PIV Card Application shall be set to FALSE.
If the currently selected application is the PIV Card Application when the SELECT command is given and the AID in the data field of the SELECT command is an invalid AID not supported by the ICC, then the PIV Card Application shall remain the currently selected application and all PIV Card Application security status indicators shall remain unchanged.
Command Syntax
CLA '00' INS 'A4' P1 '04' P2 '00' L c Length of application identifier
4 The VCI is explained in further details in Part 1, Section 5.5. Data Field AID of the PIV Card Application using the full AID or the right-truncated AID (See Section 2.2, Part 1) L e '00'
Data Field Application property template (APT). See Table 3 below SW1-SW2 Status word
Upon selection, the PIV Card Application shall return the application property template described in Table 3 .
Table 3. Data Objects in the PIV Card Application Property Template (Tag '61')
Description Tag M/O/C Comment
Application identifier of application '4F' M The PIX of the AID includes the encoding of the version of the PIV Card Application. See Section 2.2, Part 1.
Coexistent tag allocation authority '79' M Coexistent tag allocation authority template. See Table 4 .
Application label '50' O Text describing the application; e.g., for use on a man-machine interface.
Uniform resource locator '5F50' O Reference to the specification describing the application. Cryptographic algorithms supported 'AC' C Cryptographic algorithm identifier template. See Table 5 .
Table 4. Data Objects in a Coexistent Tag Allocation Authority Template (Tag '79')
Name Tag M/O Comment Application identifier '4F' M See Section 2.2, Part 1
A PIV Card Application may use a subset of the cryptographic algorithms defined in SP 800-78. Tag 0xAC encodes the cryptographic algorithms supported by the PIV Card Application. The encoding of tag 0xAC shall be as specified in Table 5 . Each instance of tag 0x80 shall encapsulate one algorithm. The presence of algorithm identifier '27' or '2E' indicates that the corresponding cipher suite is supported by the PIV Card Application for secure messaging and that the PIV Card Application possesses a PIV Secure Messaging key of the appropriate size for the specified cipher suite. Tag 0xAC shall be present and indicate algorithm identifier 0x27 or 0x2E (but not both) when the PIV Card Application supports secure messaging.
Table 5. Data Objects in a Cryptographic Algorithm Identifier Template (Tag 'AC')
Name Tag M/O Comment Cryptographic algorithm identifier '80' M For values see [SP800-78 , Table 6-2]
Object identifier '06' M Its value is set to 0x00 '6A' '82' Application not found