BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

B.2 Derived PIV Application Token Command Interface

NIST PIV and digital identity SP 800-157 Rev. 1 (Draft)
All changes in this version
first version loaded Appendix B Data Model and Interfaces for Removable or Wireless PKI-Based Cryptographic 840 part of B

Title

Derived PIV Application Token Command Interface

Control

This appendix contains the technical specifications for the command interface to the derived PIV application surfaced by the card edge of the integrated circuit card (ICC) that represents the removable cryptographic authenticator. The command interface for the derived PIV application SHALL implement all of the card commands supported by the PIV Card application as described in [SP800-73pt2] , which include:

• SELECT

• GET DATA

• VERIFY

• CHANGE REFERENCE DATA

• RESET RETRY COUNTER

• GENERAL AUTHENTICATE

• PUT DATA

• GENERATE ASYMMETRIC KEY PAIR

The specifications for the token command interface SHALL be the same as the specifications for the corresponding card edge commands for a PIV Card as described in [SP800-73pt2] , except for the following deviations:
• References to “PIV Card application” are replaced with “derived PIV application.” 1020

1021

1022 1023

1024 1025

1026

1027 1028

1029 1030

1031 1032 1033

1034 1035 1036

1037 1038 1039 1040 1041 1042 1043

1044 1045

1046 1047

1048 1049 1050 1051 1052
• References to “PIV data objects” are replaced with “derived PIV data objects.”

• References to “PIV authentication key” are replaced with “derived PIV authentication key.”

• The derived PIV activation secret SHALL satisfy the criteria specified in Appendix B.2.1 of this document rather than Sec. 2.4.3 of [SP800-73pt2] .

• In Appendix A:

– References to “PIV Card application administrator” are replaced with “derived PIV application administrator.”

– References to “card management key” are replaced with “derived PIV token management key.”

The token platform SHALL support a default selected application, which is the application chosen following a cold or warm reset. This default application may be the derived PIV application or another application.