3.2.3 RESET RETRY COUNTER Card Command
All changes in this version
Title changed
Before · SP 800-73-4
RESET RETRY COUNTER Card Command
After · SP 800-73-5
RESET RETRY COUNTER Card Command
Control changed
Before · SP 800-73-4
The RESET RETRY COUNTER card command resets the retry counter of the PIN to its initial value and changes the reference data. The command enables recovery of the PIV Card Application PIN in the case that the cardholder has forgotten the PIV Card Application PIN. The only key reference allowed in the P2 parameter of the RESET RETRY COUNTER command is the PIV Card Application PIN. The PIV Card Application may allow the reference data associated with other key references to be changed by the PIV Card Application RESET RETRY COUNTER, if PIV Card Application will only perform the command with other key references if the requirements specified in Section 2.9.2 of FIPS 201-2 are satisfied. If a key reference is specified in P2 that is not supported by the card, the PIV Card Application shall return the status word '6A 88'. 10
If the current value of the PUK’s retry counter is zero, then the PIN’s retry counter shall not be reset and the PIV Card Application shall return the status word '69 83'.
If the reset retry counter authentication data (PUK) in the command data field of the command does not match reference data associated with the PUK, then the PIV Card Application shall return the status word '63 CX'. If the new reference data (PIN) in the command data field of the command does not satisfy the criteria in Section 2.4.3 , then the PIV Card Application shall return the status word '6A 80'. If the reset retry counter authentication data (PUK) in the command data field of the command does not match reference data associated with the PUK and the new reference data (PIN) in the command data field of the command does not satisfy the criteria in Section 2.4.3 , then the PIV Card Application shall return either status word '6A 80' or '63 CX'. If the PIV Card Application returns status word '6A 80', then the retry counter associated with the PIN shall not be reset, the security status of the PIN’s key reference shall remain unchanged, and the PUK’s retry counter shall remain unchanged. 11 If the PIV Card Application returns status word '63 CX', then the retry counter associated with the PIN shall not be reset, the security status of the PIN’s key reference shall be set to FALSE, and the PUK’s retry counter shall be decremented by one.
If the card command succeeds, then the PIN’s retry counter shall be set to its reset retry value. Optionally, the PUK’s retry counter may be set to its initial reset retry value. The security status of the PIN’s key reference shall not be changed.
The initial retry counter associated with the PUK, i.e., the number of failures of the RESET RETRY COUNTER command before the PUK’s retry counter reaches zero, is issuer dependent.
Command Syntax
CLA '00' INS '2C' P1 '00' P2 '80' (PIV Card Application PIN). L c '10'
Data Field Reset retry counter authentication data (PUK) concatenated without delimitation with the new reference data (PIN) (both PUK and PIN as described in Section 2.4.3 ) L e Absent
10 The PIV Card Application may be implemented to reset the retry counter associated with OCC data when new OCC data is loaded onto the card. '63' 'CX' Reset failed, X indicates the number of further allowed resets '69' '83' Reset operation blocked '6A' '80' Incorrect parameter in command data field '6A' '81' Function not supported '6A' '88' Key reference not found
After · SP 800-73-5
The RESET RETRY COUNTER card command resets the retry counter of the PIN to its initial value and changes the reference data. The command enables recovery of the PIV Card Application PIN in the case that the cardholder has forgotten the PIV Card Application PIN. The only key reference allowed in the P2 parameter of the RESET RETRY COUNTER command is the PIV Card Application PIN. The PIV Card Application may allow the reference data associated with other key references to be changed by the PIV Card Application RESET RETRY COUNTER, if PIV Card Application will only perform the command with other key references if the requirements specified in Section 2.9.2 of FIPS 201-2 are satisfied. If a key reference is specified in P2 that is not supported by the card, the PIV Card Application shall return the status word '6A 88'. 10
If the current value of the PUK’s retry counter is zero, then the PIN’s retry counter shall not be reset and the PIV Card Application shall return the status word '69 83'.
If the reset retry counter authentication data (PUK) in the command data field of the command does not match reference data associated with the PUK, then the PIV Card Application shall return the status word '63 CX'. If the new reference data (PIN) in the command data field of the command does not satisfy the criteria in Section 2.4.3 , then the PIV Card Application shall return the status word '6A 80'. If the reset retry counter authentication data (PUK) in the command data field of the command does not match reference data associated with the PUK and the new reference data (PIN) in the command data field of the command does not satisfy the criteria in Section 2.4.3 , then the PIV Card Application shall return either status word '6A 80' or '63 CX'. If the PIV Card Application returns status word '6A 80', then the retry counter associated with the PIN shall not be reset, the security status of the PIN’s key reference shall remain unchanged, and the PUK’s retry counter shall remain unchanged. 11 If the PIV Card Application returns status word '63 CX', then the retry counter associated with the PIN shall not be reset, the security status of the PIN’s key reference shall be set to FALSE, and the PUK’s retry counter shall be decremented by one.
If the card command succeeds, then the PIN’s retry counter shall be set to its reset retry value. Optionally, the PUK’s retry counter may be set to its initial reset retry value. The security status of the PIN’s key reference shall not be changed.
The initial retry counter associated with the PUK, i.e., the number of failures of the RESET RETRY COUNTER command before the PUK’s retry counter reaches zero, is issuer dependent.
Command Syntax
CLA '00' INS '2C' P1 '00' P2 '80' (PIV Card Application PIN). L c '10'
Data Field Reset retry counter authentication data (PUK) concatenated without delimitation with the new reference data (PIN) (both PUK and PIN as described in Section 2.4.3 ) L e Absent
10 The PIV Card Application may be implemented to reset the retry counter associated with OCC data when new OCC data is loaded onto the card. '63' 'CX' Reset failed, X indicates the number of further allowed resets '69' '83' Reset operation blocked '6A' '80' Incorrect parameter in command data field '6A' '81' Function not supported '6A' '88' Key reference not found