BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3.2.1 Specification of Digital Signatures on Authentication Information

NIST PIV and digital identity SP 800-78-5 against SP 800-78-4
All changes in this version
modified 3 On-Card Cryptographic Requirements part of 3.2

Title

Specification of Digital Signatures on Authentication Information

Control changed

Before · SP 800-78-4

FIPS 201-2 requires the use of digital signatures to protect the integrity and authenticity of information stored on the PIV Card. FIPS 201-2 and SP 800-73-4 require digital signatures on the following objects stored on the PIV Card:

+ X.509 public key certificates; + the optional secure messaging card verifiable certificate (CVC); + the optional Intermediate CVC; + the CHUID; + biometric information (e.g., fingerprints); and + the SP 800-73-4 Security Object.

Approved digital signature algorithms are specified in [FIPS186] . Table 3-2 provides specific requirements for public key algorithms and key sizes, hash algorithms, and padding schemes for generating digital signatures for digitally signed information stored on the PIV Card. Agencies are cautioned that generating digital signatures with elliptic curve algorithms may initially limit interoperability.

3 3TDEA is Triple DES using Keying Option 1 from [SP800-67] , which requires that all three keys be unique (i.e., Key 1 ≠ Key 2, Key 2 ≠ Key 3, and Key 3 ≠ Key 1). Table 3-2. Signature Algorithm and Key Size Requirements for PIV Information

Public Key Algorithms and Key Sizes Hash Algorithms Padding Scheme

RSA (2048 or 3072) SHA-256 PKCS #1 v1.5 SHA-256 PSS ECDSA (Curve P-256) SHA-256 N/A ECDSA (Curve P-384) SHA-384 N/A

Note: As of January 1, 2011, only SHA-256 may be used to generate RSA signatures on PIV objects. RSA signatures may use either the PKCS #1 v1.5 padding scheme or the Probabilistic Signature Scheme (PSS) padding as defined in [PKCS1] . The PSS padding scheme object identifier (OID) is independent of the hash algorithm; the hash algorithm is specified as a parameter (for details, see [PKCS1] ).

The secure messaging CVC shall be signed using ECDSA (Curve P-256) with SHA-256 if it contains an ECDH (Curve P-256) subject public key, and shall be signed using ECDSA (Curve P-384) with SHA-384 otherwise. The Intermediate CVC shall be signed using RSA with SHA- 256 and PKCS #1 v1.5 padding.

FIPS 201-2, SP 800-73-4, and SP 800-76-2 specify formats for the CHUID, the Security Object, the biometric information, and X.509 public key certificates, which rely on OIDs to specify which signature algorithm was used to generate the digital signature. The object identifiers specified in Table 3-3 , below, must be used in FIPS 201-2 implementations to identify the signature algorithm. 4 , 5

Table 3-3. FIPS 201-2 Signature Algorithm Object Identifiers

Signature Algorithm Object Identifier (OID) RSA with SHA-1 and PKCS #1 v1.5 padding sha1WithRSAEncryption ::= {iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-1(1) 5} RSA with SHA-256 and PKCS #1 v1.5 padding sha256WithRSAEncryption ::= {iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-1(1) 11} RSA with SHA-256 and PSS padding id-RSASSA-PSS ::= {iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-1(1) 10} ECDSA with SHA-256 ecdsa-with-SHA256 ::= {iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2 (3) 2} ECDSA with SHA-384 ecdsa-with-SHA384 ::= {iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2 (3) 3}

After · SP 800-78-5

FIPS 201-2201-3 requires the use of digital signatures to protect the integrity and authenticity of information stored on the PIV Card. FIPS 201-2201-3 and SP 800-73-4800-73 require digital signatures on the following objects stored on the PIV Card:

+• X.509 public key certificates; +,

• theThe optional secure messaging card verifiable certificate (CVC); +,

• theThe optional Intermediateintermediate CVC; +,

• theThe CHUID; +,

• biometricBiometric information (e.g., fingerprints);, and +

• theThe SP 800-73-4 Security Object.

Approved digital signature algorithms are specified in [FIPS186] . Table 3-22 provides specific requirements for public key algorithms andas well as key sizes, hash algorithms, and padding schemes for generating digital signatures for digitally signed information stored on the PIV Card. Agencies are cautioned that generating digital signatures with elliptic curve algorithms may initially limit interoperability.

3 3TDEA is Triple DES using Keying Option 1 from [SP800-67] , which requires that all three keys be unique (i.e., Key 1 ≠ Key 2, Key 2 ≠ Key 3, and Key 3 ≠ Key 1). Table 3-22. Signature Algorithmalgorithm and Keykey Sizesize Requirementsrequirements for PIV Informationinformation

Public Key Algorithms and Key Sizes Hash Algorithms Padding Scheme

Through 2030 RSA (2048, 3072 or 30724096) SHA-256 or SHA-384 PKCS #1 v1.5 SHA-256 or SHA-384 PSS ECDSA (Curve P-256) SHA-256 N/A ECDSA (Curve P-384) SHA-384 N/A

Note:2031 Asand ofBeyond JanuaryRSA 1,(3072 2011,or only4096) SHA-256 mayor beSHA-384 usedPKCS to#1 generatev1.5 RSASHA-256 signaturesor onSHA-384 PIVPSS objects.ECDSA (Curve P-256) SHA-256 N/A ECDSA (Curve P-384) SHA-384 N/A

RSA signatures may use either the PKCS #1 v1.5 padding scheme or the Probabilistic Signature Scheme (PSS) padding, as definedspecified in [PKCS1FIPS186] through reference to [PKCS1]. The PSS padding scheme object identifier (OID) is independent of the hash algorithm;. theThe hash algorithm is specified as a parameter (for details, see [PKCS1] ).

The secure messaging CVC shall be signed using ECDSA (Curve P-256) with SHA-256 if it contains an ECDH (Curve P-256) subject public key, and shall be signed using ECDSA (Curve P-384) with SHA-384 otherwise. The Intermediate CVC shall be signed using RSA with SHA- 256SHA-256 and PKCS #1 v1.5 padding.

FIPS 201-2201-3, SP 800-73-4800-73, and SP 800-76-2800-76 specify formats for the CHUID, the Security Object, the biometric information, and X.509 public key certificates, which rely on OIDs to specify which signature algorithm was used to generate the digital signature. The object identifiers specified in Table 3-3 , below,3 must be used in FIPS 201-2201-3 implementations to identify the signature algorithm. 4

4 The OID for RSA with SHA-1 and PKCS #1 v1.5 padding is included in Table 3 since applications may encounter X.509 certificates that were signed before January 1, 2011, using this algorithm. , 5

5 For the CHUID, Security Object, and biometric information, the signatureAlgorithm field of SignerInfo shall contain rsaEncryption (1.2.840.113549.1.1.1) when the signature algorithm is RSA with PKCS #1 v1.5 padding. Table 3-33. FIPS 201-2201-3 Signaturesignature Algorithmalgorithm Objectobject Identifiersidentifiers

Signature Algorithm Object Identifier (OID) RSA with SHA-1 and PKCS #1 v1.5 padding sha1WithRSAEncryption ::= {iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-1(1) 5} RSA with SHA-256 and PKCS #1 v1.5 padding sha256WithRSAEncryption ::= {iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-1(1) 11} RSA with SHA-256 and PSS padding id-RSASSA-PSS ::= {iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-1(1) 10} RSA with SHA-384 and PKCS #1 v1.5 padding Sha384WithRSAEncryption ::= {iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-1(1) 12} RSA with SHA-384 and PSS padding id-RSASSA-PSS ::= {iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-1(1) 10} ECDSA with SHA-256 ecdsa-with-SHA256 ::= {iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2 (3) 2} ECDSA with SHA-384 ecdsa-with-SHA384 ::= {iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2 (3) 3}