BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

6.2 PIV Card Algorithm Identifiers

NIST PIV and digital identity SP 800-78-5 against SP 800-78-4
All changes in this version
modified 6 Identifiers for PIV Card Interfaces part of 6

Title

PIV Card Algorithm Identifiers

Control changed

Before · SP 800-78-4

A PIV Card algorithm identifier is a one-byte identifier that specifies a cryptographic algorithm and key size, or a suite of algorithms and key sizes. For symmetric cryptographic operations, the algorithm identifier also specifies a mode of operation (i.e., ECB). Table 6-2 lists the algorithm identifiers for the cryptographic algorithms that may be recognized on the PIV interfaces. All other algorithm identifier values are reserved for future use. Table 6-2. Identifiers for Supported Cryptographic Algorithms

Algorithm Identifier Algorithm – Mode '00' 3 Key Triple DES – ECB '03' 3 Key Triple DES – ECB '06' RSA 1024 bit modulus, 65 537 ≤ exponent ≤ 2 256
- 1 '07' RSA 2048 bit modulus, 65 537 ≤ exponent ≤ 2 256
- 1 '08' AES-128 – ECB '0A' AES-192 – ECB '0C' AES-256 – ECB '11' ECC: Curve P-256 '14' ECC: Curve P-384 '27' Cipher Suite 2 '2E' Cipher Suite 7

Note that both the '00' and '03' algorithm identifiers correspond to 3 Key Triple DES – ECB.

Algorithm identifiers '27' and '2E' represent suites of algorithms and key sizes for use with secure messaging and key establishment. Cipher Suite 2 (CS2) is the cipher suite used to establish session keys and for secure messaging when the PIV Secure Messaging key is an ECDH (Curve P-256) key, and Cipher Suite 7 (CS7) is the cipher suite used to establish session keys and for secure messaging when the PIV Secure Messaging key is an ECDH (Curve P-384) key. Details of secure messaging, the key establishment protocol, and the algorithms and key sizes for these two cipher suites are specified in SP 800-73-4, Part 2.

After · SP 800-78-5

A PIV Card algorithm identifier is a one-byte identifier that specifies a cryptographic algorithm and key size, or a suite of algorithms and key sizes. For symmetric cryptographic operations, the algorithm identifier also specifies a mode of operation (i.e., ECB). Table 6-29 lists the algorithm identifiers for the cryptographic algorithms that may be recognized on the PIV interfaces. All other algorithm identifier values are reserved for future use. Table 6-29. Identifiers for Supportedsupported Cryptographiccryptographic Algorithmsalgorithms

Algorithm Identifier Algorithm – Mode '00' 3 Key Triple DES – ECB (deprecated) '03' 3 Key Triple DES – ECB (deprecated) '05' RSA 3072 bit modulus, 65537 ≤ exponent ≤ 2 256
- 1 '06' RSA 1024 bit modulus, 65 53765537 ≤ exponent ≤ 2 256
- 1 '07' RSA 2048 bit modulus, 65 53765537 ≤ exponent ≤ 2 256
- 1 '08' AES-128 – ECB '0A' AES-192 – ECB '0C' AES-256 – ECB '11' ECC: Curve P-256 '14' ECC: Curve P-384 '27' Cipher Suite 2 '2E' Cipher Suite 7

Note that both3 theKey Triple DES – ECB with identifier '00' and '03' algorithmis identifiersdeprecated correspondand towill 3be Keyremoved Triplein DESthe –next ECBrevision of this document.

Algorithm identifiers '27' and '2E' represent suites of algorithms and key sizes for use with secure messaging and key establishment. Cipher Suite 2 (CS2) is the cipher suite used to establish session keys and for secure messaging when the PIV Secure Messaging key is an ECDH (Curve P-256) key, and. Cipher Suite 7 (CS7) is the cipher suite used to establish session keys and for secure messaging when the PIV Secure Messaging key is an ECDH (Curve P-384) key. Details of secure messaging, the key establishment protocol, and the algorithms and key sizes for these two cipher suites are specified in SP 800-73-4, Part 2.