BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4.1.4 Cipher Suite

NIST PIV and digital identity SP 800-73-5 against SP 800-73-4
All changes in this version
removed 4 Secure Messaging part of 4.1

Title changed

Before · SP 800-73-4

Cipher Suite

After · SP 800-73-5

Cipher Suite

Control changed

Before · SP 800-73-4

This document specifies two cipher suites (see Table 14 ) that may be used for key establishment and secure messaging, one that provides 128 bits of channel strength and one that provides 192 bits of channel strength. If the PIV Card Application supports the VCI and either the digital signature key ('9C'), the key management key ('9D'), or one of the retired key management keys ('82' – '95') is an ECC (Curve P-384) key, then PIV Card Application shall only support cipher suite CS7. Otherwise, the PIV Card Application may support either CS2 or CS7.

Table 14. Cipher Suite for PIV Secure Messaging

128 bit channel strength 192 bit channel strength Cipher Suite ID CS2 CS7 Algorithm Identifier (P1) '27' '2E' Key confirmation and session keys (SK CFRM , SK MAC , SK RMAC , SK ENC ) AES 128 AES 256 128 bit channel strength 192 bit channel strength C ICC signature ECDSA with SHA-256 using an ECDSA (Curve P-256) key ECDSA with SHA-384 using an ECDSA (Curve P-384) key C ICC public key ECDH (Curve P-256) ECDH (Curve P-384) KDF hash SHA-256 SHA-384 Nonce (N ICC ) 16 bytes 24 bytes

After · SP 800-73-5

This document specifies two cipher suites (see Table 14 ) that may be used for key establishment and secure messaging, one that provides 128 bits of channel strength and one that provides 192 bits of channel strength. If the PIV Card Application supports the VCI and either the digital signature key ('9C'), the key management key ('9D'), or one of the retired key management keys ('82' – '95') is an ECC (Curve P-384) key, then PIV Card Application shall only support cipher suite CS7. Otherwise, the PIV Card Application may support either CS2 or CS7.

Table 14. Cipher Suite for PIV Secure Messaging

128 bit channel strength 192 bit channel strength Cipher Suite ID CS2 CS7 Algorithm Identifier (P1) '27' '2E' Key confirmation and session keys (SK CFRM , SK MAC , SK RMAC , SK ENC ) AES 128 AES 256 128 bit channel strength 192 bit channel strength C ICC signature ECDSA with SHA-256 using an ECDSA (Curve P-256) key ECDSA with SHA-384 using an ECDSA (Curve P-384) key C ICC public key ECDH (Curve P-256) ECDH (Curve P-384) KDF hash SHA-256 SHA-384 Nonce (N ICC ) 16 bytes 24 bytes