BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3.2.3 Specification of Message Digests in the SP 800-73-4 Security Object

NIST PIV and digital identity SP 800-78-5 against SP 800-78-4
All changes in this version
modified 3 On-Card Cryptographic Requirements part of 3.2

Title

Specification of Message Digests in the SP 800-73-4 Security Object

Control changed

Before · SP 800-78-4

SP 800-73-4 mandates inclusion of a Security Object consistent with the Authenticity/Integrity Code defined by the International Civil Aviation Organization (ICAO) in [MRTD] . This object contains message digests of other digital information stored on the PIV Card and is digitally signed. This specification requires that the message digests of digital information be computed using the same hash algorithm used to generate the digital signature on the Security Object. The set of acceptable algorithms is specified in Table 3-2 . The Security Object format identifies the hash algorithm used when computing the message digests by inclusion of an object identifier; the appropriate object identifiers are identified in Table 3-6 . 6

Table 3-6. Hash Algorithm Object Identifiers Hash Algorithm Object Identifier (OID) SHA-1 id-sha1 ::= {iso(1) identified-organization(3) oiw(14) secsig(3) algorithms(2) 26} SHA-256 id-sha256 ::= {joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistalgorithm(4) hashalgs(2) 1} SHA-384 id-sha384 ::= {joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistalgorithm(4) hashalgs(2) 2}

6 The OID for SHA-1 is included in Table 3-6 since applications may encounter Security Objects that were signed before January 1, 2011, using RSA with SHA-1 and PKCS #1 v1.5 padding.

After · SP 800-78-5

SP 800-73-4800-73 mandates the inclusion of a Security Object consistent with the Authenticity/Integrity Code defined by the International Civil Aviation Organization (ICAO) in [MRTD] . This object contains message digests of other digital information stored on the PIV Card and is digitally signed. This specification requires that the message digests of digital information be computed using the same hash algorithm used to generate the digital signature on the Security Object. The set of acceptable algorithms is specified in Table 3-22 . The Security Object format identifies the hash algorithm used when computing the message digests by inclusion ofincluding an object identifier;. theThe appropriate object identifiers are identified in Table 3-66 . 6

Table 3-66. Hash Algorithm Objectalgorithm Identifiersobject identifiers

Hash Algorithm Object Identifier (OID) SHA-1 id-sha1 ::= {iso(1) identified-organization(3) oiw(14) secsig(3) algorithms(2) 26} SHA-256 id-sha256 ::= {joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistalgorithm(4) hashalgs(2) 1} SHA-384 id-sha384 ::= {joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistalgorithm(4) hashalgs(2) 2}

6 The OID for SHA-1 is included in Table 3-6 since applications may encounter Security Objects that were signed before January 1, 2011, using RSA with SHA-1 and PKCS #1 v1.5 padding.