...
OpenFIPS201 is intended to be highly flexible to support a variety of usage scenarios whilst being capable of fully complying with the PIV card application standard.
To support this:
It has a dynamic file system, which can describe any number of data objects, including access permissions
It has a dynamic key store, which permits any combination of keys and mechanisms (algorithms), with flexible access permissions, key roles and attributes.
The applet has a number of configuration parameters which drive behaviour of the applet. These can be dynamically configured during issuance, post-issuance or even left untouched to make use of NIST-compliant default values.
All of the above can be managed securely using a GlobalPlatform Secure Channel either locally or over a network.
3 Personalisation Steps
Apply any Configuration changes required (this should be done first as it may effect subsequent steps)
Define which Data Objects and Keys are required on the card.
Populate data objects using standard PIV interoperable commands.
Generate or Inject Key values using either standard PIV interoperable commands or the Secure Messaging interface.
4 Configuration
OpenFIPS201 configuration parameters can be applied at any time during the card life-cycle, so long as it is done under a GlobalPlatform Secure Channel or using Delegated Administrative Commands.
...
Element | Description | ||||
|---|---|---|---|---|---|
Id TYPE: OCTET STRING (1 to 3 bytes for data objects, 1 byte for keys) | The unique identifier for this object on the card.
| ||||
Mode Contact Type: Enumeration | Provides access control restrictions and permissions for this object when connecting over the Contact interface.
| ||||
Mode Contactless Type: Enumeration | Provides access control restrictions and permissions for this object when connecting over the Contactless interface.
| ||||
Admin Key Type: OCTET STRING (1 byte) OPTIONAL | Specifies which symmetric key can be used for managing this object using the This is useful where a particular implementation wishes to define specific Data or Key objects that are managed by a third party, where it is desirable to compartmentalise access to only those objects.
| ||||
Key Mechanism Type: Enumeration | Describes which cryptographic primitive (mechanism) will be associated with this key.
| ||||
Key Role Type: Enumeration | Specifies what role(s) this key may perform for
| ||||
Key Attribute Type: Enumeration | Specifies what special attributes / options are flagged against this key.
|
5.1.1 Enumeration - Access Mode
| Info |
|---|
This enumeration is a |
Element
Description
Never
The object may not be read or used under any circumstances.
| Info |
|---|
This is a special value that cannot be combined with any other value. |
Pin
The object may be accessed only after PIN authentication.
Pin Always
The object may be accessed only IMMEDIATELY after PIN authentication in the current session.
| Info |
|---|
It is acceptable to also set the |
Occ
The object may be accessed only after a successful Biometric On-Card-Comparison in the current session.
User Admin
The object may be managed after the access conditions have been successfully met.
| Info |
|---|
This has the effect or permitting the PUT DATA and GENERATE ASSYMMETRIC KEYPAIR commands for these values. It does not permit extended administration commands such as |
Always
The object may be read or used without any authentication.
| Info |
|---|
This is a special value that cannot be combined with any other value. |
Always and Never special values first, as the Always value sets all lower 7 bits, which can look like other options are setElement | Description | ||||
|---|---|---|---|---|---|
Id TYPE: OCTET STRING (1 to 3 bytes for data objects, 1 byte for keys) | The unique identifier for this object on the card.
| ||||
Mode Contact Type: Enumeration | Provides access control restrictions and permissions for this object when connecting over the Contact interface.
| ||||
Mode Contactless Type: Enumeration | Provides access control restrictions and permissions for this object when connecting over the Contactless interface.
| ||||
Admin Key Type: OCTET STRING (1 byte) OPTIONAL | Specifies which symmetric key can be used for managing this object using the This is useful where a particular implementation wishes to define specific Data or Key objects that are managed by a third party, where it is desirable to compartmentalise access to only those objects.
|
5.1.1 Enumeration - Access Mode
| Info |
|---|
This enumeration is a |
Element | Description | ||||
|---|---|---|---|---|---|
Never | The object may not be read or used under any circumstances.
| ||||
Pin | The object may be accessed only after PIN authentication. | ||||
Pin Always | The object may be accessed only IMMEDIATELY after PIN authentication in the current session.
| ||||
Occ | The object may be accessed only after a successful Biometric On-Card Comparison in the current session. | ||||
User Admin | The object may be managed after the access conditions have been successfully met.
| ||||
Always | The object may be read or used without any authentication.
|
Key Object Parameters
Element | Description | ||
|---|---|---|---|
Key Mechanism Type: Enumeration | Describes which cryptographic primitive (mechanism) will be associated with this key.
| ||
Key Role Type: Enumeration | Specifies what role(s) this key may perform for
| ||
Key Attribute Type: Enumeration | Specifies what special attributes / options are flagged against this key.
|
5.1.2 Enumeration - Key Mechanism
...