BaselineWatch
30 requirements
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

NIST PIV and digital identity SP 800-85A-4

30 requirements · published 2016-04-13
Changes in this version
All1 Introduction10 Send VERIFY card command repeatedly until after2 System Overview3 Test Suite Elements4 Derived Test Requirements5 Test Assertions6 Test and Compliance Documentation7 Acceptance Criteria8 Test and Compliance Process9 Repeat steps 1 – 6, but with the '9D' key (key management
RefTitleText
1 Introduction Federal Information Processing Standard 201, Personal Identity Verification (PIV) of Federal Employees and Contractors [ FIPS 201 ], was developed to establish standards for identity credentials. FIPS 201 sets the minimum requirements for a changed here
1.1
in 1
 Purpose The objective of this document is to provide test requirements and test assertions that could be used to validate the compliance/conformance of two PIV components – PIV Middleware and PIV Card Applications – with the specifications in NIST changed here
1.2
in 1
 Scope This document provides guidelines for running conformance tests for the following three classes of specifications in NIST SP 800-73-4 : 1 The term PIV Card in the context of this document refers to a smart card loaded with a PIV Card Appli changed here
1.3
in 1
 Target Audience This document is intended to: + Enable developers of PIV Middleware and PIV Card Applications to develop their software modules to be testable for interface requirements specified in SP 800-73-4 . + Enable developers of PIV Middleware and P changed here
1.4
in 1
 Document Overview The document is organized as follows: + Section 2 provides a conceptual software overview of a typical PIV system and introduces the PIV test components. + Section 3 lists the various elements of the test suite under the two broad categorie changed here
2 System Overview The conceptual architecture involving the PIV Middleware and PIV Card Application for which conformance tests are given in this document is shown in Figure 1 . The conformance tests in this document apply to the areas highlighted with dashe changed here
2.1
in 2
 Test Plan The test plan identifies the tasks/artifacts required for testing the PIV Middleware and PIV Card Applications. These artifacts include the following: PIV Middleware and a smart card populated with a PIV Card Application; the test toolkit ( changed here
2.2
in 2
 Test Set-up The test system consists of the following components: 2  Test toolkit application software that resides on a personal computer (PC).  Smart card (SC) readers: o An ISO/IEC 7816 and PC/SC-compliant contact-based smart card reader and o An changed here
2.3
in 2
 Test System Configuration The test system shown in Figure 2 will be configured in both the PIV Middleware tests and the PIV Card Application tests to accommodate the different components to be tested, as explained in Section 3 . 2 Compliance of the readers and inpu changed here
2.3.1
in 2.3
 PIV Middleware Test Configuration The middleware test configuration is used to test a vendor’s middleware software application that implements the PIV client API and generates the appropriate commands in the PIV card command interface (refer to Table A-1 for mapping between changed here
2.3.2
in 2.3
 PIV Card Application Test Configuration The card application test configuration is used to test any PIV Card Application through commands of the PIV card command interface defined in SP 800-73-4 Part 2. The following list shows the test system components included in this configur changed here
3 Test Suite Elements Based on the conceptual software architecture shown in Figure 1 , the PIV software components that are subject to testing are as follows: + PIV Middleware that implements the functions for the PIV Client API and interfaces with the PIV Card changed here
3.1
in 3
 PIV Middleware Tests These tests will validate that the PIV Middleware conforms to the specification in Part 3 of SP 800-73-4 . Conformance criteria include correct implementation of the functions for the PIV client API, generation of appropriate commands for t changed here
3.2
in 3
 PIV Card Application Tests PIV Card Application tests cover the following: + The PIV Card Application card command interface as per Part 2 of SP 800-73-4 , including the security conditions for executing each command in the interface as well as the security condition changed here
3.2.1
in 3.2
 PIV Card Application Card Command Interface Tests These tests will validate that the card under test can successfully execute the commands in the PIV card command interface. Successful execution constitutes the card responding with appropriate data and response status codes to the commands changed here
3.2.2
in 3.2
 PIV Data Objects Accessibility and Storage Tests The testing covers the following data objects: + The seven mandatory data objects as defined in Part 1 of SP 800-73-4 :  Card Capability Container.  Card Holder Unique Identifier (CHUID).  X.509 Certificate for PIV authentication.  X.50 changed here
4 Derived Test Requirements DTRs show the type of tests required based on the specifications in SP 800-73-4 . These specifications cover expected command behavior (in the case of interface specification), data object representation (in the case of PIV data model) and changed here
5 Test Assertions Test assertions are statements of behavior, action, or condition that can be measured or tested. They provide the procedures to guide the tester in executing and managing the test. They include the purpose of the test, starting conditions a changed here
5.1
in 5
 Mapping from Test Categories to Test Assertions All the DTRs in Appendix A conceptually come under one of the two broad categories of tests stated in Section 3 , i.e., PIV Middleware tests and PIV Card Application tests. Similarly, each test assertion makes specific references to the rel changed here
5.2
in 5
 PIV Client API Test Assertions This section provides conformance tests in the form of test assertions for the functions specified in Section 3, SP 800-73-4 Part 3 (referred to as the client API) that the PIV Middleware is expected to support. The test assertions are desc changed here
5.3
in 5
 PIV Card Command Interface Test Assertions This section provides conformance tests in the form of test assertions for the command set that is specified in Section 3, Part 2 of SP 800-73-4 (PIV Card Application Card Command Interface) that the PIV Card Application is required to supp changed here
5.4
in 5
 PIV Data Objects Accessibility and Storage Test Assertions The following assumptions have been made with respect to the PIV data object representation test assertions: + A PIV Card Application with a valid Application Identifier (AID) is resident on the card. + The PIV Card Application is expected changed here
6 Test and Compliance Documentation There are two sets of compliance documentation: vendor required and test facility generated. The vendor-required documents consist of the following: + Installation and Execution instructions (for PIV Middleware): The vendor provides technic changed here
7 Acceptance Criteria Acceptance criteria are based on the compliance of the item under the test with the requirements defined in FIPS 201 and the accompanying special publication documents. The criteria are further specified in the following sections, based on changed here
7.1
in 7
 Acceptance Criteria for the PIV Middleware Test The PIV Middleware test acceptance criteria will be based on the middleware application under the test passing the SP 800-73-4 client API test assertions. The middleware should return appropriate return codes in response to executing the cl changed here
7.2
in 7
 Acceptance Criteria for the PIV Card Application Tests Acceptance criteria for the PIV Card Application tests are based on the PIV Card Application passing the following two classes of tests: PIV Card Application card command interface tests and PIV data objects accessibility and storage tests. changed here
8 Test and Compliance Process The PIV software component that passes all applicable tests, as explained in this document, will be considered conformant. This document provides the technical details for the testing of the two PIV software components. In this context, com changed here
8.1
in 8
 Failure Review The test will be repeated once for components that do not pass the tests. After the retest, the tester prepares, for each failure, a discrepancy report that summarizes the purpose of the test, the progression of steps, and the responses rec changed here
9 Repeat steps 1 – 6, but with the '9D' key (key management key), algorithm <<'07', '11' or '14'>> and an encrypted key (with algorithm '07') or a public key (with algorithms '11' or '14') instead of a challenge Expected Result(s) Call returns with status_word of PIV_OK with the algorithmOutput car changed here
10 Send VERIFY card command repeatedly until after the issuer specified maximum number of PIN tries is exceeded with • P2, key reference value is set to '00' • Data field of the command will contain an arbitrary, but correctly formatted, PIN value other than what is obtained from the vendor changed here

30 of 30.