Page Comparison

Never

The object may not be read or used under any circumstances.

Pin

The object may be accessed only after PIN authentication.

Pin Always

The object may be accessed only IMMEDIATELY after PIN authentication in the current session.

Occ

The object may be accessed only after a successful Biometric On-Card Comparison in the current session.

User Admin

The object may be managed after the access conditions have been successfully met.

Always

The object may be read or used without any authentication.

Key Mechanism

Type: Enumeration

Describes which cryptographic primitive (mechanism) will be associated with this key.

Key Role

Type: Enumeration

Specifies what role(s) this key may perform for GENERAL AUTHENTICATE commands.

Key Attribute

Type: Enumeration

Specifies what special attributes / options are flagged against this key.

TDEA192

Triple-DES-ECB using 3-key length (192 bits)

RSA1024

RSA Asymmetric Keypair, 1024-bit key length

RSA2048

RSA Asymmetric Keypair, 2048-bit key length

AES128

Advanced Encryption Standard, 128-bit key length

AES192

Advanced Encryption Standard, 192-bit key length

AES256

Advanced Encryption Standard, 256-bit key length

ECC256

Elliptic Curve using curve NIST P-256

ECC384

Elliptic Curve using curve NIST P-384

SMCS2

Cipher Suite 2 - Used for Secure Messaging (PIV Opacity ZKM) based on curve NIST P256, SHA-256 and AES 128-bit

SMCS7

Cipher Suite 7 - Used for Secure Messaging (PIV Opacity ZKM) based on curve NIST P384, SHA-384 and AES 256-bit

Authenticate

This key can be used for card (internal), host (external) or card/host (mutual) authentication.

• For TDEA or AES key types, this role indicates the key may be used for authentication operations.

• For RSA key types, this role is not supported.

• For ECC key types, this role is not supported.

• For SM key types, this role is not supported.

Key Establish

This key can be used for key establishment schemes.

• For TDEA or AES key types, this role is not supported.

• For RSA key types, this role indicates the key may be used for RSA Key Transport.

• For ECC key types, this role indicates the key may be used for Elliptic-Curve Diffie-Helman Agreements (ECDH).

• For SM key types, this role indicates the key may be used for PIV Opacity Zero-Key Management (ZKM).

Sign

This key can be used for digital signature mechanisms.

• For TDEA or AES key types, this role is not currently supported.

• For RSA key types, this role indicates the key may be used for RSA Digital Signatures against pre-formatted signature blocks.

• For ECC key types, this role indicates the key may be used for Elliptic-Curve Digital Signature Algorithm operations (ECDSA).

• For SM key types, this role is not supported.

Verify

Reserved for future use

Encrypt

Reserved for future use

Decrypt

Reserved for future use

Permit Internal

Symmetric Keys Only - Permits the PIV General Authenticate command to used to request an INTERNAL authentication.

Permit External

Symmetric Keys Only - Permits the PIV General Authenticate command to used to request an INTERNAL authentication.

Importable

Permits the key value to be injected instead of generated on the card. If this is set to False, only the GENERATE ASSYMETRIC KEYPAIR command may be used to generate key pairs.