BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3.4 Entry Points for Credential Initialization and Administration

NIST PIV and digital identity SP 800-73-5 against SP 800-73-4
All changes in this version
added 3 Client Application Programming Interface part of 3

Title changed

Before · SP 800-73-4

After · SP 800-73-5

Entry Points for Credential Initialization and Administration

Control changed

Before · SP 800-73-4

After · SP 800-73-5

The PIV Middleware SHALL NOT submit data provided to the pivPutData or pivGenerateKeyPair function over the contactless interface. If the PIV Middleware is not communicating with the PIV Card via the card’s contact interface, then the pivPutData or pivGenerateKeyPair function SHALL return PIV_FUNCTION_NOT_SUPPORTED .

3.4.1. pivPutData

Purpose: Replace the entire data content of the named data object with the provided data.

Prototype: status_word pivPutData ( IN handle cardHandle , IN string OID , IN LONG oidLength , IN sequence of byte data, IN LONG dataLength );

Parameters: cardHandle Opaque identifier of the card to be acted upon as returned by pivConnect

OID Object identifier of the object whose data content is to be replaced coded as a string (e.g., “2.16.840.1.101.3.7.2.96.80”). See SP 800-73-5 Part1, Table 3.

oidLength Length of the object identifier

data Data to be used to replace in its entirety the data content of the named data object

dataLength Length of the provided data

Return Codes: PIV_OK PIV_INVALID_CARD_HANDLE PIV_INVALID_OID PIV_CARD_READER_ERROR PIV_INSUFFICIENT_CARD_RESOURCE PIV_SECURITY_CONDITIONS_NOT_SATISFIED PIV_FUNCTION_NOT_SUPPORTED

3.4.2. pivGenerateKeyPair

Purpose: Generates an asymmetric key pair in the currently selected card application.

If the provided key reference exists and the cryptographic mechanism associated with the reference data identified by this key reference is the same as the provided cryptographic mechanism, then the generated key pair replaces in entirety the key pair currently associated with the key reference.

Prototype: status_word pivGenerateKeyPair ( IN handle cardHandle , IN byte keyReference, IN byte cryptographicMechanism, OUT sequence of byte publicKey, INOUT LONG KeyLength );

Parameters: cardHandle Opaque identifier of the card to be acted upon as returned by pivConnect keyReference The key reference of the generated key pair

cryptographicMechanism The type of key pair to be generated. See SP 800- 73-5 Part1, Table 7.

publicKey BER-TLV data objects defining the public key of the generated key pair. See SP 800-73-5 Part2, Table 11.

KeyLength As an input, the length of the buffer allocated for publicKey; as an output, length of the public key- related data retrieved from the PIV Card

Return Codes: PIV_OK PIV_INVALID_CARD_HANDLE PIV_SECURITY_CONDITIONS_NOT_SATISFIED PIV_FUNCTION_NOT_SUPPORTED PIV_INVALID_KEY_OR_KEYALG_COMBINATION PIV_UNSUPPORTED_CRYPTOGRAPHIC_MECHANISM PIV_CARD_READER_ERROR PIV_INSUFFICIENT_BUFFER

If the length of public key-related data retrieved from the PIV Card is longer than the buffer allocated by the client application, then the PIV Middleware SHALL return PIV_INSUFFICIENT_BUFFER but SHALL still set KeyLength to the length of the public key- related data retrieved from the PIV Card. References

[FIPS201] National Institute of Standards and Technology (2022) Personal Identity Verification (PIV) of Federal Employees and Contractors. (Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) 201-3. https://doi.org/10.6028/NIST.FIPS.201-3 [ISO7816] International Organization for Standardization/International Electrotechnical Commission (2004-2020) ISO/IEC 7816 — Identification cards — Integrated circuit cards. (multiple parts):  International Organization for Standardization/International Electrotechnical Commission (2020) ISO/IEC 7816-4:2020 — Identification cards — Integrated circuit cards — Part 4: Organization, security and commands for interchange. (International Organization for Standardization, Geneva, Switzerland) [or as amended]. Available at https://www.iso.org/standard/77180.html  International Organization for Standardization/International Electrotechnical Commission (2004) ISO/IEC 7816-5:2004 — Identification cards — Integrated circuit cards — Part 5: Registration of application providers. (International Organization for Standardization, Geneva, Switzerland) [or as amended]. Available at https://www.iso.org/standard/34259.html  International Organization for Standardization/International Electrotechnical Commission (2023) ISO/IEC 7816-6:2023 — Identification cards — Integrated circuit cards — Part 6: Interindustry data elements for interchange. (International Organization for Standardization, Geneva, Switzerland) [or as amended]. Available at https://www.iso.org/standard/77181.html  International Organization for Standardization/International Electrotechnical Commission (2021) ISO/IEC 7816-8:2021 — Identification cards — Integrated circuit cards — Part 8: Commands and mechanisms for security operations. (International Organization for Standardization, Geneva, Switzerland) [or as amended]. Available at https://www.iso.org/standard/79893.html  International Organization for Standardization/International Electrotechnical Commission (2017) ISO/IEC 7816-9:2017 — Identification cards — Integrated circuit cards — Part 9: Commands for card management. (International Organization for Standardization, Geneva, Switzerland) [or as amended]. Available at https://www.iso.org/standard/67802.html [ISO8825] International Organization for Standardization/International Electrotechnical Commission (2015) ISO/IEC 8825-1:2015— Information technology — ASN.1 encoding rules: Specification of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER) Part 1. (International Organization for Standardization, Geneva, Switzerland) [or as amended]. Available at https://www.iso.org/standard/81420.html [SP800-76] Grother PJ, Salamon WJ, Chandramouli R (2013) Biometric Specifications for Personal Identity Verification. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-76-2 [or as amended]. https://doi.org/10.6028/NIST.SP.800-76-2 [SP800-78] Ferraiolo H, Regenscheid A (2024) Cryptographic Algorithms and Key Sizes for Personal Identity Verification. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-78-5 [or as amended]. https://doi.org/10.6028/NIST.SP.800-78-5