3.3 Entry Points for Cryptographic Operations

Before · SP 800-73-4

After · SP 800-73-5

Entry Points for Cryptographic Operations

Before · SP 800-73-4

After · SP 800-73-5

3.3.1. pivCrypt

Purpose: Perform a cryptographic operation, 3

3 The pivCrypt function does not perform any cryptographic operations itself. It provides the interface to the GENERAL AUTHENTICATE command to perform cryptographic operations on-card. All cryptographic operations are performed outside of the PIV Middleware except for SM on the client side. such as encryption or signing on a sequence of bytes. SP 800-73-5 Part1, Appendix C describes recommended procedures for PIV algorithm identifier discovery.

Prototype: status_word pivCrypt ( IN handle cardHandle , IN byte algorithmIdentifier, IN byte keyReference, IN sequence of byte algorithmInput, IN LONG inputLength, OUT sequence of byte algorithmOutput, INOUT LONG outputLength );

Parameters: cardHandle Opaque identifier of the card to be acted upon as returned by pivConnect

algorithmIdentifier Identifier of the cryptographic algorithm to be used for the cryptographic operation [SP800-78, Tables 9 and 10 ]

keyReference Identifier of the on-card key to be used for the cryptographic operation. See [SP800-78, Table 8] and SP 800-73-5 Part1, Table 5. algorithmInput Sequence of bytes used as the input to the cryptographic operation. The algorithmInput for RSA algorithms SHALL be restricted to the range 0 to n -1, where n is the RSA modulus.

inputLength Length of the algorithm input

algorithmOutput Sequence of bytes output by the cryptographic operation

outputLength As an input, length of the buffer allocated for algorithmOutput. As an output, length of the algorithm output.

Return Codes: PIV_OK PIV_INVALID_CARD_HANDLE PIV_INVALID_KEYREF_OR_ALGORITHM PIV_SECURITY_CONDITIONS_NOT_SATISFIED PIV_INPUT_BYTES_MALFORMED PIV_CARD_READER_ERROR PIV_SM_FAILED PIV_INSUFFICIENT_BUFFER

The PIV_INPUT_BYTES_MALFORMED error condition indicates that some property of the data to be processed, such as the length or padding, was inappropriate for the requested cryptographic algorithm or key.

If the value of keyReference is '04' (PIV Secure Messaging key), then the PIV Middleware SHALL return PIV_INVALID_KEYREF_OR_ALGORITHM .

If the length of the algorithm output is longer than the buffer allocated by the client application, then the PIV Middleware SHALL return PIV_INSUFFICIENT_BUFFER but SHALL still set outputLength to the length of the algorithm output.