BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4 Derived Test Requirements

NIST PIV and digital identity SP 800-85A-4 against SP 800-85A-2
All changes in this version
modified 4 Derived Test Requirements

Title

Derived Test Requirements

Control changed

Before · SP 800-85A-2

DTRs show the type of tests required based on the specifications in SP 800-73-3. These specifications cover expected command behavior (in the case of interface specification), data object representation (in the case of PIV data model) and data contents (in the case of PIV authentication use cases). Each DTR consists of the following: Actual condition statements taken/derived from the SP 800-73-3 specification – these include conditions for successful command execution for each command as well as exception behaviors explicitly called out through ‘shall’ statements in SP 800-73-3. Those exception behaviors that are implicit in SP 800-73-3 through listing of error codes associated with each command are tested only through Test Assertions (Appendices B, C and D) and are not part of the DTR condition statements. The condition statements are identified by codes starting with ‘AS’ followed by a running sequence that denotes the section in this document where they occur.

Required Vendor Information – these include information that the vendors are mandated to provide in their documentation. The Required Vendor Information is identified by codes starting with ‘VE’ followed by a running sequence that denotes the section in this document where they occur.

Required Test Procedures – these are actions that the tester has to perform in order to satisfy the requirements stated in actual condition statements. These include verifying the information mandated in the “Required Vendor Information” for the condition as well as performing software-based tests. It must be mentioned; however, that some of the required test procedures will not call out explicitly for verification of information in the associated “Required Vendor Information”. In these instances it is implicitly assumed that such information is provided by the vendor and verified by the tester. The Required Test Procedures are identified by codes starting with TE followed by a running sequence that denotes the section in this document where they occur.

Validations of some DTRs are not covered by the test assertions provided in this document. These DTRs require compliance of the component with an external specification or standard such as ISO/IEC 7816 or ISO/IEC 14443. No required test procedures are provided for these DTRs, and a note is added to indicate that the assertion is externally tested. The tester checks the vendor documentation for claimed compliance with such requirement or the presence of an external test/compliance certificate obtained from the related standards testing body, when applicable. Some DTRs cannot be validated through the test tools provided in this document. For example, the test tool cannot access the asymmetric private keys generated and stored on the card. Therefore, a note is added to indicate the assertion is not separately tested for these DTRs. The same note is added for DTRs that make general statements on the nature of the PIV Card and are validated as a result of the validation of many other DTRs. For example, the statement “each command that appears on the card command interface shall be implemented by a Card Application that is resident in the Integrated Circuit Card (ICC)” is validated through the entire card command interface test and does not require an individual test assertion.

After · SP 800-85A-4

DTRs show the type of tests required based on the specifications in SP 800-73-3800-73-4 . These specifications cover expected command behavior (in the case of interface specification), data object representation (in the case of PIV data model) and data contents (in the case of PIV authentication use cases). Each DTR consists of the following: + Actual condition statements taken/derived from the SP 800-73-3800-73-4 specification – these include conditions for successful command execution for each command as well as exception behaviors explicitly called out through ‘shall’ statements in SP 800-73-3800-73-4 . Those exception behaviors that are implicit in SP 800-73-3800-73-4 through listing of error codes associated with each command are tested only through Test Assertions (Appendices B , C and D ) and are not part of the DTR condition statements. The condition statements are identified by codes starting with ‘AS’ followed by a running sequence that denotes the section in this document where they occur.

 All DTRs that are new to Revision 4 of this document are identified by the suffix ‘-R4’. Updated DTRs that existed previously are requirements updated in SP 800-73-4 and these retain their original identifiers. + Required Vendor Information – these include information that the vendors are mandated to provide in their documentation. The Requiredrequired Vendorvendor Informationinformation is identified by codes starting with ‘VE’ followed by a running sequence that denotes the section in this document where they occur.

 All vendor information requirements that are new to Revision 4 of this document are identified by the suffix ‘-R4’. Updated required vendor information that existed previously are requirements updated in SP 800-73-4 and these retain their original identifiers. + Required Test Procedures – these are actions that the tester has to perform in order to satisfy the requirements stated in actual condition statements. These include verifying the information mandated in the “Required Vendor Information” for the condition as well as performing software-based tests. It must be mentioned;, however, that some of the required test procedures will not callbe called out explicitly for verification of information in the associated “Required Vendor Information”.” In these instances, it is implicitly assumed that suchthe information is provided by the vendor and verified by the tester. The Required Test Procedures are identified byhave codesidentifiers starting with TE‘TE’ followed by a running sequence that denotes the section in this document where they occur.

 All test procedure requirements that are new to Revision 4 of this document are identified by the suffix ‘-R4’. Updated required test procedures that existed previously are requirements updated in SP 800-73-4 and these retain their original identifiers. Validations of some DTRs are not covered by the test assertions provided in this document. These DTRs require compliance of the component with an external specification or standard such as ISO/IEC 7816 or ISO/IEC 14443 . No required test procedures are provided for these DTRs, and a note is added to indicate that the assertion is externally tested. The tester checks the vendor documentation for claimed compliance with such requirement or the presence of an external test/compliance certificate obtained from the related standards testing body, when applicable. Some DTRs cannot be validated through the test tools provided in this document. For example, the test tool cannot access the asymmetric private keys generated and stored on the card. Therefore, a note is added to indicate the assertion is not separately tested for these DTRs. The same note is added for DTRs that make general statements on the nature of the PIV Card and are validated as a result of the validation of many other DTRs. For example, the statement “each[e]ach command that appears on the card command interface shall be implemented by a Cardcard Applicationapplication that is resident inon the IntegratedICC Circuit[integrated Cardcircuit (ICC)card]” is validated through the entire card command interface test and does not require an individual test assertion.