4.1.2 PIV Card Application Protocol Steps
All changes in this version
Title changed
Before · SP 800-73-4
PIV Card Application Protocol Steps
After · SP 800-73-5
PIV Card Application Protocol Steps
Control changed
Before · SP 800-73-4
Step # Description Comment C1 ID sICC = T 8 (SHA256(C ICC )) ID sICC , the left-most 8 bytes of the SHA- 256 hash of C ICC , is used as an input for session key derivation. (Note that ID sICC is static, and so may be pre-computed off card.)
14 If the public key needed to verify the signature on CICC appears in an Intermediate CVC, then verify the signatures on both CICC and the Intermediate CVC and, using standards-compliant PKI validation, validate the content signing certificate needed to verify the signature on the Intermediate CVC. 15 Validation of the content signing certificate does not need to be performed at the time of signature verification if the certificate has been previously validated or if the public key needed to verify the signature on CICC has been previously obtained from a trusted source. Step # Description Comment C2 CB ICC = CB H & 'F0' Create the PIV Card Application’s control byte from client application’s control byte, indicating that persistent binding has not been used in this transaction, even if CB H indicates that the client application supports it. This may be done by setting CB ICC to the value of CB H and then setting the 4 least significant bits of CB ICC to 0. C3 Check that CB ICC is 0x00 Return an error ('6A 80') if CB ICC is not 0x00. C4 Verify that Q eH is a valid public key for the domain parameters of Q sICC Perform partial public-key validation of Q eH [SP800-56A , Section 5.6.2.3.3], 16 where the domain parameters are those of Q sICC . Also verify that P1 is '27' if the domain parameters of Q sICC are those of Curve P-256 or that P1 is '2E' if the domain parameters of Q sICC are those of Curve P-384. Return '6A 86' if P1 has the incorrect value. Return '6A 80' if public- key validation fails. C5 Z = ECC_CDH (d sICC , Q eH ) Compute the shared secret, Z, using the ECC CDH primitive [SP800-56A , Section 5.7.1.2]. C6 Generate nonce N ICC Create a random nonce, where the length is as specified in Table 14 . The nonce should be created using an approved random bit generator where the security strength supported by the random bit generator is at least as great as the bit length of the nonce being generated [SP800-56A , Section 5.3]. C7 SK CFRM || SK MAC || SK ENC || SK RMAC = KDF (Z, len , Otherinfo ) Compute the key confirmation key and the session keys. See Section 4.1.6 . C8 Zeroize Z Destroy shared secret generated in Step C5. C9 AuthCryptogram ICC = CMAC(SK CFRM , "KC_1_V" || ID sICC || ID sH || Q eH ) Compute the authentication cryptogram for key confirmation as described in Section 4.1.7 . C10 Zeroize SK CFRM Destroy the key confirmation key derived in Step C7. C11 Return CB ICC || N ICC || AuthCryptogram ICC || C ICC
16 The PIV Card Application may perform full public-key validation instead [SP800-56A, Section 5.6.2.3.2].
After · SP 800-73-5
Step # Description Comment C1 ID sICC = T 8 (SHA256(C ICC )) ID sICC , the left-most 8 bytes of the SHA- 256 hash of C ICC , is used as an input for session key derivation. (Note that ID sICC is static, and so may be pre-computed off card.)
14 If the public key needed to verify the signature on CICC appears in an Intermediate CVC, then verify the signatures on both CICC and the Intermediate CVC and, using standards-compliant PKI validation, validate the content signing certificate needed to verify the signature on the Intermediate CVC. 15 Validation of the content signing certificate does not need to be performed at the time of signature verification if the certificate has been previously validated or if the public key needed to verify the signature on CICC has been previously obtained from a trusted source. Step # Description Comment C2 CB ICC = CB H & 'F0' Create the PIV Card Application’s control byte from client application’s control byte, indicating that persistent binding has not been used in this transaction, even if CB H indicates that the client application supports it. This may be done by setting CB ICC to the value of CB H and then setting the 4 least significant bits of CB ICC to 0. C3 Check that CB ICC is 0x00 Return an error ('6A 80') if CB ICC is not 0x00. C4 Verify that Q eH is a valid public key for the domain parameters of Q sICC Perform partial public-key validation of Q eH [SP800-56A , Section 5.6.2.3.3], 16 where the domain parameters are those of Q sICC . Also verify that P1 is '27' if the domain parameters of Q sICC are those of Curve P-256 or that P1 is '2E' if the domain parameters of Q sICC are those of Curve P-384. Return '6A 86' if P1 has the incorrect value. Return '6A 80' if public- key validation fails. C5 Z = ECC_CDH (d sICC , Q eH ) Compute the shared secret, Z, using the ECC CDH primitive [SP800-56A , Section 5.7.1.2]. C6 Generate nonce N ICC Create a random nonce, where the length is as specified in Table 14 . The nonce should be created using an approved random bit generator where the security strength supported by the random bit generator is at least as great as the bit length of the nonce being generated [SP800-56A , Section 5.3]. C7 SK CFRM || SK MAC || SK ENC || SK RMAC = KDF (Z, len , Otherinfo ) Compute the key confirmation key and the session keys. See Section 4.1.6 . C8 Zeroize Z Destroy shared secret generated in Step C5. C9 AuthCryptogram ICC = CMAC(SK CFRM , "KC_1_V" || ID sICC || ID sH || Q eH ) Compute the authentication cryptogram for key confirmation as described in Section 4.1.7 . C10 Zeroize SK CFRM Destroy the key confirmation key derived in Step C7. C11 Return CB ICC || N ICC || AuthCryptogram ICC || C ICC
16 The PIV Card Application may perform full public-key validation instead [SP800-56A, Section 5.6.2.3.2].