This page was not yet optimized for use on mobile devices.
IDPrime PIV 4.0 FIDO on IDCore3230 Platform
Certificate details
| Certificate ID | #5532 |
|---|---|
| Status | active |
| Validation dates | 28.09.2026 |
| Sunset date | 27-09-2031 |
| Standard | FIPS 140-3 |
| Security level | 2 |
| Type | Hardware |
| Embodiment | SingleChip |
| Caveat | None |
| Exceptions |
|
| Description | The IDPrime PIV 4.0 FIDO on IDCore3230 Platform is a single-chip "contact" or "contact and contactless" (aka as "Dual") module implementing the Global Platform operational environment, with Card Manager, PIV, PIV Admin, MoC Server (for Match-on-Card) and FIDO Applets. |
| Vendor | Thales http://cpl.thalesgroup.com |
| Lab | Leidos Accredited Testing & Evaluation (AT&E) Lab |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES-256, AES192, AES, AES-, CAST, HMAC, KMAC, CMACAsymmetric Algorithms
ECDH, ECDSA, ECCHash functions
SHA2Schemes
MAC, Key AgreementRandomness
TRNG, DRBG, RBGElliptic Curves
P-256, P-384, P-224Block cipher modes
ECB, CBC, CTRJavaCard versions
Java Card 3.1.0Trusted Execution Environments
PSP, SSC, SEVendor
Infineon, ThalesSecurity level
Level 2, level 3Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.No automatically derived data are available in this section.
Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5532,
"dgst": "6220b303a7d895e4",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"SHA2-384A2877",
"ECDSA SigGen (FIPS186-5)A2877",
"SHA2-224A2877",
"KAS-ECC Sp800-56Ar3A2877",
"AES-CMACA2877",
"KDF SP800-108A2877",
"KTS-IFCA2877",
"SHA2-256A2877",
"RSA KeyGen (FIPS186-5)A2877",
"AES-CBCA2877",
"Counter DRBGA2877",
"SHA2-512A2877",
"#A2877",
"RSA SigGen (FIPS186-5)A2877",
"HMAC-SHA2-256A2877",
"KAS-ECC-SSC Sp800-56Ar3A2877",
"KDA HKDF SP800-56Cr2A2877",
"KDA OneStep SP800-56Cr2A2877",
"AES-ECBA2877",
"ECDSA KeyGen (FIPS186-5)A2877"
]
},
"cpe_matches": null,
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"4.0"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": null,
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES-CBC, AES-ECB",
"cavpCertName": "A2877",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CMAC",
"cavpCertName": "A2877",
"properties": "Direction - Generation, Verification Key Length - 128, 192, 256 MAC Length - MAC Length: 128 Message Length - Message Length: 128-256 Increment 8",
"reference": "SP 800-38B"
},
{
"algorithm": "Counter DRBG",
"cavpCertName": "A2877",
"properties": "Prediction Resistance - No Supports Reseed - No Mode - AES-256 Derivation Function Enabled - Yes Additional Input - Additional Input: 0 Entropy Input - Entropy Input: 1024 Nonce - Nonce: 384 Personalization String Length - Personalization String Length: 0 Returned Bits - 128",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "ECDSA KeyGen (FIPS186-5)",
"cavpCertName": "A2877",
"properties": "Curve - P-256, P-384 Secret Generation Mode - extra bits",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigGen (FIPS186-5)",
"cavpCertName": "A2877",
"properties": "Curve - P-256, P-384 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-5"
},
{
"algorithm": "HMAC-SHA2-256",
"cavpCertName": "A2877",
"properties": "MAC - MAC: 256 Key Length - Key Length: 128, 256",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS-ECC Sp800- 56Ar3",
"cavpCertName": "A2877",
"properties": "Domain Parameter Generation Methods - P- 256, P-384 Function - Partial Validation iutId - 123456ABCD Scheme - onePassDh - KAS Role - Responder KDF Methods - oneStepKdf - Auxiliary Function Methods - Auxiliary Function Name - SHA2-384 Fixed Info Pattern - algorithmId||l||uPartyInfo||vPartyInfo Fixed Info Encoding - Concatenation Key Confirmation Methods - Key Confirmation Directions - Key Confirmation Roles - Key Confirmation MAC Methods - CMAC - Key Length - 256 MAC Length - 128 Key Length - 1024",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KAS-ECC-SSC Sp800-56Ar3",
"cavpCertName": "A2877",
"properties": "Domain Parameter Generation Methods - P- 256, P-384 Scheme - ephemeralUnified - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KDA HKDF SP800- 56Cr2",
"cavpCertName": "A2877",
"properties": "Fixed Info Pattern - uPartyInfo||vPartyInfo Fixed Info Encoding - concatenation Derived Key Length - 512 Shared Secret Length - Shared Secret Length: 256 HMAC Algorithm - SHA2-256 Perform Multiple Expansion Tests - No",
"reference": "SP 800-56C Rev. 2"
},
{
"algorithm": "KDA OneStep SP800-56Cr2",
"cavpCertName": "A2877",
"properties": "Auxiliary Function Methods - Auxiliary Function Name - SHA2-256 Fixed Info Pattern - uPartyInfo||vPartyInfo Fixed Info Encoding - concatenation Derived Key Length - 256 Shared Secret Length - Shared Secret Length: 256",
"reference": "SP 800-56C Rev. 2"
},
{
"algorithm": "KDF SP800-108",
"cavpCertName": "A2877",
"properties": "KDF Mode - Counter MAC Mode - CMAC-AES128, CMAC- AES192, CMAC-AES256 Supported Lengths - Supported Lengths: 128-256 Increment 64 Fixed Data Order - In the Middle of Fixed Data Counter Length - 8 Supports Empty IV - No Requires Empty IV - No Custom Key In Length - 0",
"reference": "SP 800-108 Rev. 1"
},
{
"algorithm": "KTS-IFC",
"cavpCertName": "A2877",
"properties": "IUT ID - CAFECAFE Modulo - 2048, 3072, 4096 Key Generation Methods - rsakpg1-crt Fixed Public Exponent - 010001 Scheme - KTS-OAEP-basic - KAS Role - responder Key Transport Method - Hash Algorithms - SHA2-224, SHA2-256, SHA2-384, SHA2-512 Supports Null Associated Data - Yes Associated Data Encoding - concatenation Key Length - 512",
"reference": "SP 800-56B Rev. 2"
},
{
"algorithm": "RSA KeyGen (FIPS186-5)",
"cavpCertName": "A2877",
"properties": "Key Generation Mode - probable Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512 Modulo - 2048, 3072, 4096",
"reference": "FIPS 186-5"
},
{
"algorithm": "",
"cavpCertName": "",
"properties": "p mod 8 - 0 Primality Tests - 2pow100 q mod 8 - 0 Fixed Public Exponent - 010001 Info Generated By Server - No Private Key Format - crt, standard Public Exponent Mode - fixed",
"reference": ""
},
{
"algorithm": "RSA SigGen (FIPS186-5)",
"cavpCertName": "A2877",
"properties": "Hash Pair - Hash Algorithm - SHA2-224 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss Mask Function - MGF1",
"reference": "FIPS 186-5"
},
{
"algorithm": "SHA2-224, SHA2- 256, SHA2-384, SHA2-512",
"cavpCertName": "A2877",
"properties": "Message Length - Message Length: 8-65536 Increment 8 Function - SHA2",
"reference": "FIPS 180-4"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Reset the",
"indicator": "IND _1",
"inputs": "none",
"name": "Authenticator_Reset (FIDO Service)",
"outputs": "none",
"rolesSspAccess": "Unauthe nticated",
"secFunImpl": "CKG Symm"
},
{
"description": "applet, renderi ng all credent ials created useless",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- FID- ECDH- ECC: E - FID- KG-AS- ECDSA- PUB: Z - FID- KG-RK- ECDSA: Z - FID- PIN- KEY: G - FID- RK- HMAC- NONCE: Z - FID- SC- AUTH- HMAC: G - FID- SC- ENC- AES: G - FID- SEED: Z - FID- SHARE D- SECRET : E,G - FID- SHARE D- SECRET -INTER: E,G,Z - OS- DRBG- EI: E - OS- DRBG-",
"secFunImpl": "etric KDA HKDF Key Agree ment HMAC"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "KEY: G,E - OS- DRBG- S: E - OS- DRBG- V: G,E",
"secFunImpl": ""
},
{
"description": "Select an applet or manag e logical channe ls.",
"indicator": "IND _1",
"inputs": "data",
"name": "Context - Select an applet or manage logical channels. (Platform service)",
"outputs": "return Status Word",
"rolesSspAccess": "Unauthe nticated - FID- PIN- KEY: Z - FID- SHARE D- SECRET : Z - SD- SENC: Z - SD- SMAC: Z",
"secFunImpl": ""
},
{
"description": "Retriev e the authent ication nonce of the applicat ion",
"indicator": "IND _1",
"inputs": "CTAP data includi ng encry pted pin",
"name": "CTAP2_ClientPIN _GetPinToken CTAP2_ClientPin _ GetPinUvAuthTokenUsingPinWithPer missions (FIDO service)",
"outputs": "ctap data, status word",
"rolesSspAccess": "FUSR - FID- ECDH- ECC: E - FID- PIN- KEY: G,E - FID- PLAT- ECDH- PUB: W,E,Z - FID- SHARE D- SECRET : E,G - FID- TOKEN- NONCE- V2: G,R - OS- DRBG-",
"secFunImpl": "Key Agree ment CKG Symm etric KDA HKDF Encry ption - Decry ption"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "EI: E - OS- DRBG- KEY: G,E - OS- DRBG- S: E - OS- DRBG- V: G,E",
"secFunImpl": ""
},
{
"description": "Update the pin of the applicat ion",
"indicator": "IND _1",
"inputs": "CTAP data includi ng encry pted pin",
"name": "CTAP2_ClientPIN_ChangePin (FIDO service)",
"outputs": "status word",
"rolesSspAccess": "FUSR - FID- ECDH- ECC: E,G - FID- ECDH- ECC- PUB: G - FID- PIN- KEY: G,E - FID- PLAT- ECDH- PUB: W,E,Z - FID- SHARE D- SECRET : G,E - FID- SHARE D- SECRET -INTER: G,E,Z - FID- UV-PIN: W,E - FID- UV-PIN- Hash: G",
"secFunImpl": "HMAC KDA HKDF Key Agree ment Encry ption - Decry ption Secur e Hash Gener ate Key Pair EC"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- OS- MKDK: E",
"secFunImpl": ""
},
{
"description": "Return the number transie nt ECDH public key of the applicat ion",
"indicator": "IND _1",
"inputs": "CTAP data",
"name": "CTAP2_ClientPIN_GetKeyAgreement (FIDO service)",
"outputs": "ctap data, status word",
"rolesSspAccess": "Unauthe nticated - FID- ECDH- ECC- PUB: R",
"secFunImpl": ""
},
{
"description": "Return the number of remaini ng attempt for the PIN",
"indicator": "IND _1",
"inputs": "CTAP data",
"name": "CTAP2_ClientPIN_GetRetries (FIDO service)",
"outputs": "ctap data, status word",
"rolesSspAccess": "Unauthe nticated",
"secFunImpl": ""
},
{
"description": "Set the pin of the applicat ion",
"indicator": "IND _1",
"inputs": "CTAP data includi ng encry pted pin",
"name": "CTAP2_ClientPIN_SetPin (FIDO service)",
"outputs": "status word",
"rolesSspAccess": "Unauthe nticated - FID- ECDH- ECC: E,G - FID- ECDH- ECC- PUB: G - FID- PIN- KEY: G,E - FID- PLAT- ECDH- PUB: W,E,Z - FID- SHARE D- SECRET : G,E",
"secFunImpl": "Gener ate Key Pair EC KDA HKDF Secur e Hash Encry ption - Decry ption HMAC Key Agree ment"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- FID- SHARE D- SECRET -INTER: G,E,Z - FID- UV-PIN: W,E - FID- UV-PIN- Hash: G - OS- MKDK: E",
"secFunImpl": ""
},
{
"description": "Used to set a minimu m PIN Length",
"indicator": "IND _1",
"inputs": "CTAP data",
"name": "CTAP2_Config _SettingAMinimumPINLength (FIDO service)",
"outputs": "status word",
"rolesSspAccess": "FUSR - FID- TOKEN- NONCE- V2: E",
"secFunImpl": "HMAC"
},
{
"description": "Used to enforce User Verifific ation",
"indicator": "IND _1",
"inputs": "CTAP data",
"name": "CTAP2_Config _ToggleAlwaysRequireUserVerificatio n (FIDO service)",
"outputs": "status word",
"rolesSspAccess": "FUSR - FID- TOKEN- NONCE- V2: E",
"secFunImpl": "HMAC"
},
{
"description": "Deactiv ate the applet, until the applet is explicitl y selecte d again",
"indicator": "IND _1",
"inputs": "none",
"name": "CTAP2_ControlEnd (FIDO service)",
"outputs": "status word",
"rolesSspAccess": "Unauthe nticated",
"secFunImpl": "None"
},
{
"description": "Used for enumer ation of Creden tials for a RP present on the",
"indicator": "IND _1",
"inputs": "CTAP data",
"name": "CTAP2_CredentialManagement_Enu maratingCredentialsForAnRP_Begin _EnumaratingCredentialsForAnRP_Ne xt (FIDO service)",
"outputs": "ctap data, status word",
"rolesSspAccess": "FUSR - FID- TOKEN- NONCE- V2: E",
"secFunImpl": "HMAC"
},
{
"description": "Descript ion authent",
"indicator": "Indi cat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Output s",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Securit y Functi ons"
},
{
"description": "icator Used for enumer ation of RPs present on the authent",
"indicator": "IND _1",
"inputs": "CTAP data",
"name": "CTAP2_CredentialManagement_Enu maratingRPs_Begin_EnumaratingRPs _Next (FIDO service)",
"outputs": "ctap data, status word",
"rolesSspAccess": "FUSR - FID- TOKEN- NONCE- V2: E",
"secFunImpl": "HMAC"
},
{
"description": "icator Used to get credent ials metada ta",
"indicator": "IND _1",
"inputs": "CTAP data",
"name": "CTAP2_CredentialManagement_Getti ngCredentialsMetadata (FIDO service)",
"outputs": "ctap data, status word",
"rolesSspAccess": "FUSR - FID- TOKEN- NONCE- V2: E",
"secFunImpl": "HMAC"
},
{
"description": "Used to delete a credent ial",
"indicator": "IND _1",
"inputs": "CTAP data",
"name": "CTAP2_CredentialManagement_Delet eCredential (FIDO service)",
"outputs": "status word",
"rolesSspAccess": "FUSR - FID- KG-RK- ECDSA: Z - FID- KG-RK- ECDSA- PUB: Z - FID- RK- HMAC- NONCE: Z - FID- TOKEN- NONCE- V2: E",
"secFunImpl": "HMAC"
},
{
"description": "Used to update user informa tion associa ted to a credent ial",
"indicator": "IND _1",
"inputs": "CTAP data",
"name": "CTAP2_CredentialManagement _UpdatingUserInformation (FIDO service)",
"outputs": "status word",
"rolesSspAccess": "FUSR - FID- TOKEN- NONCE- V2: E",
"secFunImpl": "HMAC"
},
{
"description": "initiate a CTAP2 token authent ication",
"indicator": "IND _1",
"inputs": "CTAP data",
"name": "CTAP2_GetAssertion CTAP2_GetNextAssertion (FIDO service)",
"outputs": "ctap data, status word",
"rolesSspAccess": "FUSR - FID- HMAC- NONCE: E,G - FID- KG-AS- ECDSA: E - FID- KG-RK- ECDSA: E - FID- RK- HMAC- NONCE: E - FID- SC- AUTH- HMAC: E - FID- SC- ENC- AES: E - FID- SEED: E,W - FID- TOKEN- NONCE- V2: E",
"secFunImpl": "CKG Symm etric Digital Signat ure Gener ation ECC Encry ption - Decry ption FIDO Authe nticati on FIDO KTS FIDO Regist ration HMAC KDA HKDF"
},
{
"description": "Retriev e the authent icator informa tion",
"indicator": "IND _1",
"inputs": "none",
"name": "CTAP2_GetInfo (FIDO service)",
"outputs": "getInf o data return Status Word",
"rolesSspAccess": "Unauthe nticated",
"secFunImpl": ""
},
{
"description": "Genera tes a new key pair for token",
"indicator": "IND _1",
"inputs": "ctap data",
"name": "CTAP2_MakeCredential (FIDO service)",
"outputs": "ctap data, status word",
"rolesSspAccess": "FUSR - FID- AT- ECDSA: E - FID-",
"secFunImpl": "FIDO KTS FIDO Regist ration"
},
{
"description": "registra tion",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "AT- ECDSA- PUB: R - FID- HMAC- NONCE: G - FID- KG-AS- ECDSA: G - FID- KG-AS- ECDSA- PUB: G,R - FID- KG-RK- ECDSA: G - FID- KG-RK- ECDSA- PUB: G - FID- RK- HMAC- NONCE: G - FID- SC- AUTH- HMAC: E - FID- SC- ENC- AES: E - FID- SEED: G,R - FID- TOKEN- NONCE- V2: E",
"secFunImpl": ""
},
{
"description": "Retriev e the authent icator informa tion",
"indicator": "IND _1",
"inputs": "none",
"name": "FIDO GetData (Applet Info) (FIDO service)",
"outputs": "return Status Word / info data",
"rolesSspAccess": "Unauthe nticated",
"secFunImpl": ""
},
{
"description": "allows the platfor m to let a user select a certain authent icator",
"indicator": "IND _1",
"inputs": "datas such as a DF an EF by its file ID, path or name",
"name": "FIDO Select (FIDO service)",
"outputs": "return Status Word",
"rolesSspAccess": "CO Unauthe nticated",
"secFunImpl": "None"
},
{
"description": "Get informa tion of the approv ed mode of operati on",
"indicator": "IND _1",
"inputs": "none",
"name": "Get Approved mode parameters (Platform service)",
"outputs": "data return Status Word",
"rolesSspAccess": "Unauthe nticated",
"secFunImpl": ""
},
{
"description": "Modify the card or applet life cycle status. May be employ ed to perform zeroiza tion.",
"indicator": "IND _1",
"inputs": "Set / Get Status : life cycle state to updat e/ empty",
"name": "Lifecycle (Platform service)",
"outputs": "return Status Word / life cycle state and packa ge list",
"rolesSspAccess": "CO - FID- HMAC- NONCE: Z - DAP- SYM: Z - FID- AT- ECDSA: Z - FID- AT- ECDSA- PUB: Z - FID- ECDH- ECC: Z - FID- ECDH-",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "ECC- PUB: Z - FID- KG-AS- ECDSA: Z - FID- KG-AS- ECDSA- PUB: Z - FID- KG-RK- ECDSA: Z - FID- PIN- KEY: Z - FID- RK- HMAC- NONCE: Z - FID- SEED: Z - FID- SHARE D- SECRET : Z - FID- TOKEN- NONCE- V2: Z - FID- UV-PIN: Z - MOC- OCC: Z - OPACIT Y- SCONFI RMATIO N: Z - OPACIT",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Y-SENC: Z - OPACIT Y- SMAC: Z - OPACIT Y- SRMAC: Z - OS- DRBG- EI: Z - OS- DRBG- KEY: Z - OS- DRBG- S: Z - OS- DRBG- V: Z - PIV- AKM- ECC: Z - PIV- AKM- RSA: Z - PIV- AS-ECC: Z - PIV- AS-ECC- PUB: Z - PIV- AS-RSA: Z - PIV- AS-RSA- PUB: Z - PIV- AUTH- AES: Z - PIV- AUTH-",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "ECC: Z - PIV- AUTH- ECC- PUB: Z - PIV- AUTH- RSA: Z - PIV- AUTH- RSA- PUB: Z - PIV- AUTH- CH-AES: Z - PIV- AUTH- CH- ECC: Z - PIV- AUTH- CH-RSA: Z - PIV- KS-ECC: Z - PIV- KS-RSA: Z - PIV- PC: Z - PIV- PIN: Z - PIV- PUK: Z - PIV- SM- ECC: Z - PIV- SM- ECC- PUB: Z - SD- KDEK: Z - SD-",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "KENC: Z - SD- KMAC: Z - SD- SENC: Z - SD- SMAC: Z",
"secFunImpl": ""
},
{
"description": "Load, install, and delete applicat ion packag es",
"indicator": "IND _1",
"inputs": "Applic ations and associ ated data",
"name": "Manage Content (Platform service)",
"outputs": "return Status Word",
"rolesSspAccess": "CO - DAP- SYM: E,Z - FID- AT- ECDSA: Z - FID- AT- ECDSA- PUB: Z - FID- ECDH- ECC: Z - FID- ECDH- ECC- PUB: Z - FID- KG-AS- ECDSA: Z - FID- KG-AS- ECDSA- PUB: Z - FID- KG-RK- ECDSA: Z - FID- PIN- KEY: Z - FID- RK- HMAC- NONCE: Z",
"secFunImpl": "GP Secur e Chann el Messa ge Authe nticati on"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- FID- SC- ENC- AES: Z - FID- SEED: Z - FID- SHARE D- SECRET : Z - FID- TOKEN- NONCE- V2: Z - FID- UV-PIN: Z - MOC- OCC: Z - OPACIT Y- SCONFI RMATIO N: Z - OPACIT Y-SENC: Z - OPACIT Y- SMAC: Z - OPACIT Y- SRMAC: Z - OS- DRBG- EI: Z - OS- DRBG- KEY: Z - OS-",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "DRBG- S: Z - OS- DRBG- V: Z - PIV- AKM- ECC: Z - PIV- AKM- RSA: Z - PIV- AS-ECC: Z - PIV- AS-ECC- PUB: Z - PIV- AS-RSA: Z - PIV- AS-RSA- PUB: Z - PIV- AUTH- AES: Z - PIV- AUTH- ECC: Z - PIV- AUTH- ECC- PUB: Z - PIV- AUTH- RSA: Z - PIV- AUTH- RSA- PUB: Z - PIV- AUTH- CH-AES: Z - PIV- AUTH-",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "CH- ECC: Z - PIV- AUTH- CH-RSA: Z - PIV- KS-ECC: Z - PIV- KS-RSA: Z - PIV- PC: Z - PIV- PIN: Z - PIV- PUK: Z - PIV- SM- ECC: Z - PIV- SM- ECC- PUB: Z - SD- KDEK: Z - SD- KENC: Z - SD- KMAC: Z - SD- SENC: E,Z - SD- SMAC: E,Z",
"secFunImpl": ""
},
{
"description": "Put Keys",
"indicator": "IND _1",
"inputs": "Com mand param eters (data object s, SSPs)",
"name": "Manage keys (Platform service)",
"outputs": "return Status Word",
"rolesSspAccess": "CO - DAP- SYM: W - OS- MKDK: W - PIV- AUTH- AES: W",
"secFunImpl": "Encry ption - Decry ption GP Secur e Chann el"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- PIV- AUTH- CH-AES: W - SD- MDAP- KENC: W - SD- MDAP- KMAC: W - SD- KDEK: E,W - SD- KENC: W - SD- KMAC: W - SD- MDAP- KDEK: W - SD- SENC: E - SD- SMAC: E",
"secFunImpl": ""
},
{
"description": "Read module configu ration or status informa tion (privile ged data objects ).",
"indicator": "IND _1",
"inputs": "Tags and modul e inform ation",
"name": "Module Info (Auth) (Platform service)",
"outputs": "modul e config uratio n status inform ation, return Status Word",
"rolesSspAccess": "CO - SD- SENC: E - SD- SMAC: E",
"secFunImpl": "GP Secur e Chann el Messa ge Authe nticati on"
},
{
"description": "Read unprivil eged data",
"indicator": "IND _1",
"inputs": "data",
"name": "Module Info (Platform service)",
"outputs": "return Status Word",
"rolesSspAccess": "Unauthe nticated",
"secFunImpl": ""
},
{
"description": "objects, e.g., module configu ration or status informa tion, includin g version informa tion..",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "",
"secFunImpl": ""
},
{
"description": "Power cycle or reset the Module . Include s Integrit y Self- Test, periodi c self- test counter set-up and self- test flag is reset",
"indicator": "IND _1",
"inputs": "none",
"name": "Module Reset (Platform service)",
"outputs": "ATR (Answ er To Reset)",
"rolesSspAccess": "Unauthe nticated - SD- SENC: Z - SD- SMAC: Z - OS- DRBG- EI: Z,G,E - OS- DRBG- S: Z,G,E - OS- DRBG- KEY: Z,G,E - OS- DRBG- V: Z,G,E - FID- ECDH- ECC: Z - FID- HMAC- NONCE: Z - FID- SHARE D- SECRET : Z - FID-",
"secFunImpl": "DRBG Entrop y Sourc e"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "TOKEN- NONCE- V2: Z - OPACIT Y- SCONFI RMATIO N: Z - OPACIT Y-SENC: Z - OPACIT Y- SMAC: Z - OPACIT Y- SRMAC: Z",
"secFunImpl": ""
},
{
"description": "Establi sh OPACI TY- ZKM secure messa ging",
"indicator": "IND _1",
"inputs": "data",
"name": "OPACITY Secure Message (PIV Service)",
"outputs": "contro l byte + nonce + crypto gram + cert return Status Word",
"rolesSspAccess": "Unauthe nticated - OPACIT Y- SCONFI RMATIO N: G,E,Z - OPACIT Y-SENC: G,E - OPACIT Y- SMAC: G,E - OPACIT Y- SRMAC: G,E - OPACIT",
"secFunImpl": "Messa ge Authe nticati on Opacit y Secur e Chann el Secur e Hash CKG Symm etric Encry ption - Decry ption"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Y-Z: G,E,Z - OS- DRBG- EI: E - OS- DRBG- KEY: G,E - OS- DRBG- S: E - OS- DRBG- V: G,E - PIV- SM- ECC- PUB: R - ROE- PUB: W,E",
"secFunImpl": ""
},
{
"description": "Perfor ms a memor y clean up",
"indicator": "IND _1",
"inputs": "N/A",
"name": "PIV Admin Garbage collector command (PIV Service)",
"outputs": "return Status Word",
"rolesSspAccess": "CO - SD- SENC: E - SD- SMAC: E",
"secFunImpl": "GP Secur e Chann el"
},
{
"description": "Retriev es the data content of - Data Object Control Param eter (DOCP ) of SE, PIN, Key or data object, Applet person",
"indicator": "IND _1",
"inputs": "object name",
"name": "PIV Admin Get data (Prop) (PIV Service)",
"outputs": "Object data conte nt, return Status Word",
"rolesSspAccess": "Unauthe nticated",
"secFunImpl": ""
},
{
"description": "alizatio n data",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "",
"secFunImpl": ""
},
{
"description": "Retriev es the last error encoun ter regardi ng the pin policy verificat ion",
"indicator": "IND _1",
"inputs": "N/A",
"name": "PIV Admin Get pin last error code (PIV Service)",
"outputs": "last error code, return Status Word",
"rolesSspAccess": "Unauthe nticated",
"secFunImpl": ""
},
{
"description": "Unlock a pin or change its value without any knowle dge of the current value",
"indicator": "IND _1",
"inputs": "PIN Refer ence new PIN",
"name": "PIV Admin Manage PIN (PIV Service)",
"outputs": "return Status Word",
"rolesSspAccess": "CO - OS- MKDK: E - PIV- PC: W,E - PIV- PIN: W,E - PIV- PUK: W,E - PIV- AUTH- CH-AES: E",
"secFunImpl": "Encry ption - Decry ption GP Secur e Chann el"
},
{
"description": "Clear the data model content , keepin g the data object header but deletin g the value of Sensiti ve",
"indicator": "IND _1",
"inputs": "object data, Admin keyID",
"name": "PIV Admin Reinit command (PIV Service)",
"outputs": "return Status Word",
"rolesSspAccess": "CO - PIV- AKM- ECC: Z - PIV- AKM- ECC- PUB: Z - PIV- AKM- RSA: Z - PIV- AKM- RSA- PUB: Z - PIV- AS-ECC: Z",
"secFunImpl": "GP Secur e Chann el"
},
{
"description": "Securit y Param eters and PIV Objects",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- PIV- AS-ECC- PUB: Z - PIV- AS-RSA: Z - PIV- AS-RSA- PUB: Z - PIV- AUTH- AES: W - PIV- AUTH- ECC: Z - PIV- AUTH- CH-AES: Z - PIV- AUTH- CH- ECC: Z - PIV- AUTH- CH- ECC- PUB: Z - PIV- AUTH- CH-RSA: Z - PIV- AUTH- CH- RSA- PUB: Z - PIV- KS-ECC: Z - PIV- KS-ECC- PUB: Z - PIV- KS-RSA: Z",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- PIV- KS-RSA- PUB: Z - PIV- SM- ECC: Z - PIV- SM- ECC- PUB: Z - SD- SENC: E - SD- SMAC: E - PIV- PIN: Z",
"secFunImpl": ""
},
{
"description": "Select admin applet",
"indicator": "IND _1",
"inputs": "datas such as a DF an EF by its file ID, path or name",
"name": "PIV Admin Select (PIV Service)",
"outputs": "return Status Word",
"rolesSspAccess": "Unauthe nticated",
"secFunImpl": ""
},
{
"description": "Perfor ms, externa l authent ication, or mutual authent ication.",
"indicator": "IND _1",
"inputs": "Rand om, crypto gram, algorit hm refere nce, key refere nce, data",
"name": "PIV Administrator Authentication (PIV Service)",
"outputs": "Crypto gram, nonce , return Status Word",
"rolesSspAccess": "CAA - OS- DRBG- EI: G,E - OS- DRBG- KEY: G,E - OS- DRBG- S: G,E - OS- DRBG- V: G,E - PIV- AUTH- AES: E - PIV- AUTH-",
"secFunImpl": "DRBG Encry ption - Decry ption"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "CH-AES: E",
"secFunImpl": ""
},
{
"description": "Authent ication by an externa l system, or authent icates the card holder to an externa l entity",
"indicator": "IND _1",
"inputs": "Data to sign",
"name": "PIV Authentication (PIV Service)",
"outputs": "Signat ure, return Status Word",
"rolesSspAccess": "CH - PIV- AS-ECC: E - PIV- AUTH- AES: E - PIV- AUTH- CH-AES: E - PIV- AUTH- CH- ECC: E - PIV- AUTH- CH-RSA: E Unauthe nticated - PIV- AS-ECC: E - PIV- AUTH- ECC: E - PIV- AUTH- RSA: E - PIV- AUTH- CH-AES: E - PIV- AUTH- CH- ECC: E - PIV- AUTH- CH-RSA: E",
"secFunImpl": "Digital Signat ure Gener ation ECC Digital Signat ure Gener ation RSA Encry ption - Decry ption"
},
{
"description": "Descript ion",
"indicator": "Indi cat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Output s",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Securit y Functi"
},
{
"description": "Chang es the value of a PIN. (Note: User Auth is always done within the comma nd itself by providi ng previou s PIN) Secure Messa ging is enforce d for this comma nd.",
"indicator": "IND _1",
"inputs": "PIN Refer ence, Curre nt PIN, new PIN",
"name": "PIV Change Reference Data (CRD) (PIV Service)",
"outputs": "return Status Word",
"rolesSspAccess": "CH - OPACIT Y-SENC: E - OPACIT Y- SMAC: E - OPACIT Y- SRMAC: E - OS- MKDK: E - PIV- PC: W,E,Z - PIV- PIN: W,E,Z - PIV- PUK: W,E,Z CHII - OPACIT Y-SENC: E - OPACIT Y- SMAC: E - OPACIT Y- SRMAC: E - OS- MKDK: E - PIV- PC: W,E,Z - PIV- PIN:",
"secFunImpl": "ons Encry ption - Decry ption Opacit y Secur e Chann el Messa ge Authe nticati on"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "W,E,Z CHPC - OPACIT Y-SENC: E - OPACIT Y- SMAC: E - OPACIT Y- SRMAC: E - PIV- PC: W,E,Z - PIV- PIN: W,E,Z - PIV- PUK:",
"secFunImpl": ""
},
{
"description": "Digital signatu re mode pin always",
"indicator": "IND _1",
"inputs": "off card hash data",
"name": "PIV digital signature (PIV Service)",
"outputs": "Signat ure, return Status Word",
"rolesSspAccess": "W,E,Z CH - PIV- AS-ECC: E - PIV- AS-RSA: E - PIV- AUTH- CH- ECC: E - PIV- AUTH- CH-RSA: E CHOCC - PIV- AS-ECC: E - PIV- AS-RSA: E",
"secFunImpl": "Digital Signat ure Gener ation ECC Digital Signat ure Gener ation RSA"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- PIV- AUTH- CH- ECC: E - PIV- AUTH- CH-RSA: E",
"secFunImpl": ""
},
{
"description": "Genera tes an RSA or EC Asymm etric Key Pair",
"indicator": "IND _1",
"inputs": "key refere nce, algorit hm, data",
"name": "PIV Generate asymmetric key pair (PIV Service)",
"outputs": "PSP key value, return Status Word",
"rolesSspAccess": "CAA - OS- DRBG- EI: E - OS- DRBG- KEY: G,E - OS- DRBG- S: E - OS- DRBG- V: G,E - PIV- AKM- ECC: G - PIV- AKM- ECC- PUB: G,R - PIV- AKM- RSA: G - PIV- AKM- RSA- PUB: G,R - PIV- AS-ECC- PUB: G - PIV- AS-RSA: G - PIV- AS-RSA-",
"secFunImpl": "Gener ate Key Pair EC Gener ate Key Pair RSA"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "PUB: G,R - PIV- AUTH- ECC: G - PIV- AUTH- ECC- PUB: G,R - PIV- AUTH- RSA: G - PIV- AUTH- RSA- PUB: G,R - PIV- AUTH- CH- ECC: G,E - PIV- AUTH- CH- ECC- PUB: G - PIV- AUTH- CH-RSA: G - PIV- AUTH- CH- RSA- PUB: G,R - PIV- SM- ECC: G - PIV- SM- ECC- PUB: G,R",
"secFunImpl": ""
},
{
"description": "Retriev es the data content of the single data object whose tag is given in the data field.",
"indicator": "IND _1",
"inputs": "object name",
"name": "PIV Get data (PIV Service)",
"outputs": "Object data conte nt, return Status Word",
"rolesSspAccess": "CH - MOC- OCC: E - PIV- AKM- ECC- PUB: R - PIV- AKM- RSA- PUB: R - PIV- AS-RSA- PUB: R - PIV- AUTH- ECC- PUB: R - PIV- AUTH- RSA- PUB: R - PIV- AUTH- CH- ECC- PUB: R - PIV- AUTH- CH- RSA- PUB: R - PIV- KS-ECC- PUB: R - PIV- KS-RSA- PUB: R - PIV- PIN: E CHOCC - MOC- OCC: E - PIV- PIN: E CHPC",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- MOC- OCC: E - PIV- PIN: E Unauthe nticated - MOC- OCC: E - PIV- AUTH- CH- RSA- PUB: R - PIV- PIN: E",
"secFunImpl": ""
},
{
"description": "Used with the key manag ement key (\u00279D\u0027) and the retired key manag ement keys (\u002782\u0027 - \u002795\u0027) to realize key establis hment schem es specifie d in SP 800-78 (ECDH and RSA)",
"indicator": "IND _1",
"inputs": "Wrap ped data to unwra p",
"name": "PIV KTS (PIV Service)",
"outputs": "Unwra pped data, return status",
"rolesSspAccess": "CH - ECDH_R KEY: W,E,Z - PIV- AKM- ECC: E - PIV- AKM- RSA: E - PIV- KS-ECC: E - PIV- KS-RSA: E - PIV- SYM- KEY: R,W,Z - PIV-Z: R,G,Z",
"secFunImpl": "Key Agree ment IFC- Encry pt"
},
{
"description": "Create s, update s or",
"indicator": "IND _1",
"inputs": "object data",
"name": "PIV Put data (PIV Service)",
"outputs": "return Status Word",
"rolesSspAccess": "CAA - MOC- OCC: W,Z",
"secFunImpl": ""
},
{
"description": "deletes an object value in the data model.",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- PIV- AKM- ECC: W,Z - PIV- AKM- ECC- PUB: W,Z - PIV- AKM- RSA: W,Z - PIV- AKM- RSA- PUB: W,Z - PIV- AS-ECC: W,Z - PIV- AS-ECC- PUB: W,Z - PIV- AS-RSA: W,Z - PIV- AS-RSA- PUB: W,Z - PIV- AUTH- ECC: W,Z - PIV- AUTH- ECC- PUB: W,Z - PIV- AUTH- RSA: W,Z - PIV-",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "AUTH- RSA- PUB: W,Z - PIV- AUTH- CH-AES: W,Z - PIV- AUTH- CH- ECC: W,Z - PIV- AUTH- CH- ECC- PUB: W,Z - PIV- AUTH- CH-RSA: W,Z - PIV- AUTH- CH- RSA- PUB: W,Z - PIV- KS-ECC: W,Z - PIV- KS-ECC- PUB: W,Z - PIV- KS-RSA: W,Z - PIV- KS-RSA- PUB: W,Z - PIV- SM- ECC:",
"secFunImpl": ""
},
{
"description": "Descript ion",
"indicator": "Indi cat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Output s",
"rolesSspAccess": "SSP Access W,Z - PIV- SM- ECC- PUB: W,Z",
"secFunImpl": "Securit y Functi ons"
},
{
"description": "Unbloc ks and change s the value of a PIN Secure Messa ging is enforce d for this comma nd.",
"indicator": "IND _1",
"inputs": "\"Rese t retry count er\" refere nce data",
"name": "PIV Reset Retry Counter (RRC) (PIV Service)",
"outputs": "return Status Word",
"rolesSspAccess": "- PIV- PIN: Z CHII - OS- MKDK: E - PIV- AUTH- CH-AES: E - PIV- PIN: W - PIV- PUK: E",
"secFunImpl": "Encry ption - Decry ption"
},
{
"description": "Selects a DF or an EF by its file ID, path or name (in the case of DFs).",
"indicator": "IND _1",
"inputs": "Data such as a DF, an EF by its file ID, path or name",
"name": "PIV Select (PIV Service)",
"outputs": "return Status Word",
"rolesSspAccess": "CAA CH CHII CHOCC CHPC Unauthe nticated",
"secFunImpl": ""
},
{
"description": "Authent icates the user (CHOC C) to the card by present ing the MOC- OCC templat",
"indicator": "IND _1",
"inputs": "finger print refere nce",
"name": "PIV Verify (MOC-OCC) (PIV Service)",
"outputs": "return Status Word",
"rolesSspAccess": "CHOCC - MOC- OCC: E",
"secFunImpl": ""
},
{
"description": "e (aka Finger Print or Minutia e). The User Authent icated status is granted with a succes sful On Card Compa rison.",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "",
"secFunImpl": ""
},
{
"description": "Authent icates the user (CH) to the card by present ing the User PIN. The User Authent icated status is granted with a succes sful PIN verificat ion.",
"indicator": "IND _1",
"inputs": "Pin refere nce",
"name": "PIV Verify (PIN) (PIV Service)",
"outputs": "return Status Word",
"rolesSspAccess": "CH - OS- MKDK: E - PIV- PIN: E CHPC - OS- MKDK: E - PIV- PC: E",
"secFunImpl": "Encry ption - Decry ption"
},
{
"description": "Resets specific cryptog raphic flag to",
"indicator": "IND _1",
"inputs": "data",
"name": "Request for autotest (Platform service)",
"outputs": "return Status Word",
"rolesSspAccess": "Unauthe nticated",
"secFunImpl": ""
},
{
"description": "request autotes t Establi sh and use a secure commu nication s channe l",
"indicator": "IND _1",
"inputs": "rando m, diversi ficatio n data",
"name": "Secure Channel (Platform service)",
"outputs": "authe nticati on data, return Status Word",
"rolesSspAccess": "CO - OS- DRBG- EI: E - OS- DRBG- KEY: G,E - OS- DRBG- S: E - OS- DRBG- V: G,E - SD- MDAP- KENC: E - SD- MDAP- KMAC: E - SD- KDEK: E - SD- KENC: E - SD- KMAC: E - SD- MDAP- KDEK: E - SD- SENC: G,E,Z - SD- SMAC: G,E,Z",
"secFunImpl": "DRBG Encry ption - Decry ption GP Secur e Chann el KDF Messa ge Authe nticati on CKG Symm etric"
},
{
"description": "Retriev e protoco l version implem ented by the",
"indicator": "IND _1",
"inputs": "none",
"name": "U2F_Get Version (FIDO service)",
"outputs": "Versio n return Status Word",
"rolesSspAccess": "Unauthe nticated",
"secFunImpl": ""
},
{
"description": "authent icator",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "",
"secFunImpl": ""
},
{
"description": "Selects the authent icator on the current channe l",
"indicator": "IND _1",
"inputs": "None",
"name": "Authenticator Select (FIDO service)",
"outputs": "return Status Word",
"rolesSspAccess": "Unauthe nticated",
"secFunImpl": ""
},
{
"description": "PutDat a StoreD ata platfor m comma nd",
"indicator": "IND _1",
"inputs": "Tags and modul e inform ation",
"name": "Manage Content (data) (Platform Service)",
"outputs": "return Status Word",
"rolesSspAccess": "CO - SD- SENC: E - SD- SMAC: E",
"secFunImpl": "GP Secur e Chann el"
},
{
"description": "Zeroize and Delete all the MOC- OCC templat es.",
"indicator": "IND _1",
"inputs": "None",
"name": "PIV Admin MOC-OCC template (PIV Service)",
"outputs": "return Status Word",
"rolesSspAccess": "CO - MOC- OCC: Z - SD- SENC: E - SD- SMAC: E",
"secFunImpl": "GP Secur e Chann el"
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [
{
"description": "In accordance to SP 800-63B this Authenticator type is described as Single- Factor Cryptographic Software (Section 5.1.6)This method is performed when the EXTERNAL AUTHENTICATE command is invoked after successful execution of the INITIALIZE UPDATE command. This method is used to authenticate the CO role.",
"mechanism": "GP Secure Channel",
"name": "Secure Channel Protocol authentication method",
"perMinute": "The module enforces a maximum count of 15 consecutive failed authentication attempts. After 15 consecutive unsuccessful attempts, the secure channel authentication is permanently blocked.",
"strength": "The strength of Global Platform mutual authentication relies on AES key length, and the probability that a random attempt at authentication will succeed is: (1/2^128) for AES 16-byte- long keys, (1/2^192) for AES 24-byte- long keys, (1/2^256) for AES 32-byte- long keys."
},
{
"description": "In accordance to SP 800-63B, this Authenticator type is described as Memorized Secrets (Section 5.1.1).This authentication method compares an encrypted PIN value sent to the Module to the stored encrypted PIN values. If the two values are equal, the Card Holder is authenticated. This method is used to authenticate the CH role.",
"mechanism": "Encryption - Decryption",
"name": "Secret Value authentication method (PIN)",
"perMinute": "Based on a maximum count of 5 for consecutive failed service authentication attempts, the probability that a random attempt will succeed over a one-minute period is lower than 5/10^8.",
"strength": "The probability that a random attempt at authentication will succeed is (1/10^8)."
},
{
"description": "In accordance to SP 800-63B, this Authenticator type is described as",
"mechanism": "Encryption - Decryption",
"name": "Secret Value authentication method (PC)",
"perMinute": "The probability that a random attempt will succeed over a",
"strength": "The probability that a random attempt at authentication"
},
{
"description": "Memorized Secrets (Section 5.1.1).this authentication method compares an encrypted Pairing Code value sent to the Module to the stored encrypted Pairing Code value. If the two values are equal, the Card Holder is authenticated. This method is used to authenticate the CHPC role.",
"mechanism": "",
"name": "",
"perMinute": "one-minute period is (59/10^8).",
"strength": "will succeed is (1/10^8)."
},
{
"description": "In accordance to SP 800-63B, this Authenticator type is described as Memorized Secrets (Section 5.1.1).This authentication method compares an encrypted PUK value sent to the Module to the stored encrypted PUK value if the two values are equal, the Card Holder II is authenticated. This method is used to authenticate the CHII role.",
"mechanism": "Encryption - Decryption",
"name": "Secret Value authentication method (PUK)",
"perMinute": "Based on a maximum count of 15 for consecutive failed service authentication attempts, the probability that a random attempt will succeed over a one-minute period is lower than (15/256^8).",
"strength": "The probability that a random attempt at authentication will succeed is lower than (1/256^8)."
},
{
"description": "In accordance to SP 800-63B, this Authenticator type is described as Single- Factor Cryptographic Software (Section 5.1.6).The Module uses the PIV-AUTH- AES to authenticate the CAA role.",
"mechanism": "Encryption - Decryption",
"name": "PIV Symmetric Cryptographic Authentication method",
"perMinute": "Based on the maximum count value of the failed authentication blocking mechanism, the probability that a random attempt will succeed over a one-minute period is (255/2^128) for AES 16-byte- long keys, (255/2^192) for",
"strength": "128/192/256 bits. The probability that a random attempt at authentication will succeed is 1/2^128 (for 128-bit length)."
},
{
"description": "",
"mechanism": "",
"name": "",
"perMinute": "AES 24-byte- long keys, (255/2^256), for AES 32-byte- long keys.",
"strength": ""
},
{
"description": "In accordance to SP 800-63B, this Authenticator type is described as Memorized Secrets (Section 5.1.1).This authentication method runs an OnCardComparison (OCC) of a candidate fingerprint template as defined by [FIPS 2012]. This method is used to authenticate the CHOCC role.",
"mechanism": "Memorized secret for on-card comparison",
"name": "Secret Value authentication method",
"perMinute": "Based on a maximum count of 5 for consecutive failed service authentication attempts, the probability that a random attempt will succeed over a one-minute period is lower than 5/10^4.",
"strength": "The probability that a random attempt at authentication will succeed is 1/10^4."
},
{
"description": "In accordance to SP 800-63B, this Authenticator type is described as Memorized Secrets (Section 5.1.1).This authentication method compares a PIN value sent to the Module to the stored FID-UV-PIN. If the two values are equal, the operator is authenticated. This method is used to authenticate the FUSR role.",
"mechanism": "Encryption - Decryption SHA",
"name": "FIDO User Authentication",
"perMinute": "Based on a maximum count of 8 for consecutive failed service authentication attempts, the probability that a random attempt will succeed over a one-minute period is 8/2^48.",
"strength": "The probability that a random attempt at authentication will succeed is lower than 1/2^48."
}
],
"found": true,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "SP 800-90B APT",
"condition": "N/A",
"details": "TRNG error",
"indicator": "IND_2",
"testMethod": "Fault- Detection test",
"testProps": "Statistic error event",
"type": "CAST"
},
{
"algorithmOrTest": "AES ECB Decrypt",
"condition": "COND_1",
"details": "Decrypt",
"indicator": "Bit 18 of flag set to 1",
"testMethod": "KAT",
"testProps": "Decrypt KAT using an AES 128-bit key in ECB mode.",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG",
"condition": "COND_1",
"details": "none",
"indicator": "Bit 3 of flag set to 1",
"testMethod": "KAT",
"testProps": "Gets a random value with specific nonce (48 bytes) and entropy (128 bytes) and compares the",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "",
"indicator": "",
"testMethod": "",
"testProps": "generated random value with the value stored in ROM. Performs DRBG Instantiate and DRBG Generate per SP 800-90Ar1 Section 11.3 including health test .",
"type": ""
},
{
"algorithmOrTest": "ECDSA KeyGen",
"condition": "COND_2",
"details": "Sign, verify",
"indicator": "IND_3",
"testMethod": "PCT",
"testProps": "Sign a fixed pattern and verify with the public key in order to validate the key pair",
"type": "PCT"
},
{
"algorithmOrTest": "ECDSA Signature Generation",
"condition": "COND_1",
"details": "Sign",
"indicator": "Bit 30 of flag set to 1",
"testMethod": "KAT",
"testProps": "ECDSA signature generation using an ECC P-224 key",
"type": "CAST"
},
{
"algorithmOrTest": "Firmware Load",
"condition": "COND_3",
"details": "Signature verification with AES CMAC",
"indicator": "IND_4",
"testMethod": "Signature",
"testProps": "Signature verification with AES CMAC (256 bits key)",
"type": "SW/FW Load"
},
{
"algorithmOrTest": "HMAC- SHA2-256",
"condition": "COND_1",
"details": "HMAC",
"indicator": "Bit 10 of flag set to 1",
"testMethod": "KAT",
"testProps": "Compute HMAC with key 16 bytes message 24 bytes",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-ECC Sp800- 56Ar3 OnePassDH C2",
"condition": "COND_1",
"details": "AES 128, ECDSA (Curve P- 256) with SHA2-256",
"indicator": "Bit 6 of flag set to 1",
"testMethod": "KAT",
"testProps": "Performs OnePassDH algorithm relying on Crypto Suite2",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-ECC Sp800- 56Ar3 OnePassDH C7",
"condition": "COND_1",
"details": "(AES 256, ECDSA (Curve P- 384) with SHA2-384)",
"indicator": "Bit 7 of flag set to 1",
"testMethod": "KAT",
"testProps": "Performs OnePassDH algorithm relying on Crypto Suite 7",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-ECC- SSC",
"condition": "COND_1",
"details": "KAS-ECC- SSC Sp800- 56Ar3 (ECDH P224)",
"indicator": "Bit 29 of flag set to 1",
"testMethod": "KAT",
"testProps": "Generate standalone shared secret (SP800- 56Ar3)",
"type": "CAST"
},
{
"algorithmOrTest": "KDA HKDF",
"condition": "COND_1",
"details": "Key derivation",
"indicator": "Bit 7 of flag set to 1",
"testMethod": "KAT",
"testProps": "Performs a Key derivation (RFC5869) and verifies result",
"type": "CAST"
},
{
"algorithmOrTest": "KDA OneStep SP800- 56Cr2",
"condition": "COND_1",
"details": "Key derivation",
"indicator": "Bit 2 of flag set to 1",
"testMethod": "KAT",
"testProps": "Performs a Key derivation and verifies result.",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SP 800-108r1 Encrypt/Sign",
"condition": "COND_1",
"details": "Encrypt Sign",
"indicator": "Bit 18 of flag set to 1",
"testMethod": "KAT",
"testProps": "Generates AES- CMAC message performs a KDF AES-CMAC KAT using an AES 128- byte key and 32- byte derivation data",
"type": "CAST"
},
{
"algorithmOrTest": "IFC-Encrypt",
"condition": "COND_1",
"details": "Decrypt",
"indicator": "Bit 26 of flag set to 1",
"testMethod": "KAT",
"testProps": "Performs an RSA decrypt using an RSA 2048-bit public key implementation",
"type": "CAST"
},
{
"algorithmOrTest": "RSA Key Generation",
"condition": "COND_2",
"details": "Signature Generation and Verification",
"indicator": "IND_3",
"testMethod": "PCT",
"testProps": "Performs Signature Generation and Signature Verification using the key pair",
"type": "PCT"
},
{
"algorithmOrTest": "RSA Signature Generation (CRT)",
"condition": "COND_1",
"details": "RSA Signature generation",
"indicator": "Bit 28 of flag set to 1",
"testMethod": "KAT",
"testProps": "Performs an RSA PKCS#1 v1.5 signature generation using an RSA 2048-bit private CRT key implementation",
"type": "CAST"
},
{
"algorithmOrTest": "RSA Signature Generation (STD)",
"condition": "COND_1",
"details": "RSA SigGen STD, RSA encrypt",
"indicator": "Bit 27 of flag set to 1",
"testMethod": "KAT",
"testProps": "Performs an RSA PKCS#1 v1.5 signature generation using an RSA 2048-bit private STD key implementation",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-256",
"condition": "COND_1",
"details": "Hash",
"indicator": "Bit 22 of flag set to 1",
"testMethod": "KAT",
"testProps": "SHA2-256: hashes a 24-bytes message",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-512",
"condition": "COND_1",
"details": "Hash",
"indicator": "Bit 23of flag set to 1",
"testMethod": "KAT",
"testProps": "SHA2-512: hashes a 24-bytes message",
"type": "CAST"
},
{
"algorithmOrTest": "SP 800-90B RCT",
"condition": "N/A",
"details": "TRNG error",
"indicator": "IND_2",
"testMethod": "Fault- Detection test",
"testProps": "Entropy error event",
"type": "CAST"
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "Fault Detected",
"description": "The module Resource Manager has shut down. It no longer responds to the command, service",
"indicator": "No answer from module",
"name": "Card is killed",
"recoveryMethod": "N/A"
},
{
"conditions": "Fault Detected",
"description": "The module Resource Manager has shut down",
"indicator": "Error log is stored",
"name": "Card is Mute",
"recoveryMethod": "Reset card"
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [
{
"inspectFreq": "On receipt of module following transport. Before each module use",
"inspectGuidance": "In the event of any observed damage, photograph the card and contact Thales to confirm whether observed anomalies are to be expected or are confirmed signs of potential tampering",
"mechanism": "Single-Chip Packaging"
}
],
"found": true,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [],
"found": false,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [],
"found": false,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "Supply voltage: Used to supply power to the module in contact mode; The module starts when interface is powered -as specified in ISO17816 -3 ( part 5.2.1).",
"logicalInterface": "Power",
"physicalPort": "VCC"
},
{
"data": "Reset signal: If a signal is sent on this interface on contact mode, the module will reboot (active low) as specified in ISO17816 -3.",
"logicalInterface": "Control Input",
"physicalPort": "RST"
},
{
"data": "Clock signal: The interface is used by an external device (ex: smartcard reader) to provide a clock signal to the IC in contact mode as specified in ISO17816 -3.",
"logicalInterface": "Control Input",
"physicalPort": "CLK"
},
{
"data": "Ground",
"logicalInterface": "Power",
"physicalPort": "GND"
},
{
"data": "Commands and responses, protocol and control data. The interface is used to communicate with an external entity (ex: SmartCard reader) in contact mode as specified in ISO17816 -3.",
"logicalInterface": "Data Input Data Output Control Input",
"physicalPort": "I/O"
},
{
"data": "",
"logicalInterface": "Status Output",
"physicalPort": ""
},
{
"data": "Supply, clock signal, commands and responses, protocol and control data This interface is used to communicate with an external entity (ex: smartcard reader) in contactless mode; It is also used to set the internal clock and to supply power to the module as specified in ISO14443 -2",
"logicalInterface": "Data Input Data Output Control Input Status Output Power",
"physicalPort": "LA"
},
{
"data": "Supply, clock signal, commands and responses, protocol and control data This interface is used to communicate with an external entity (ex: smartcard reader) in contactless mode; It is also used to set the internal clock and to supply power to the module as specified in ISO14443 -2",
"logicalInterface": "Data Input Data Output Control Input Status Output Power",
"physicalPort": "LB"
},
{
"data": "",
"logicalInterface": "Range",
"physicalPort": "Conditions"
},
{
"data": "",
"logicalInterface": "1.8V, 3 V and 5.5 V DC",
"physicalPort": "Voltage"
},
{
"data": "",
"logicalInterface": "1MHz to 10MHz",
"physicalPort": "Frequency2"
},
{
"data": "",
"logicalInterface": "Range",
"physicalPort": "Conditions"
},
{
"data": "",
"logicalInterface": "106 Kbits/s, 212 Kbits/s, 424 Kbits/s, 848 Kbits/s",
"physicalPort": "Supported bit rate"
},
{
"data": "",
"logicalInterface": "Between 1.5 A/m and 7.5 A/m rms",
"physicalPort": "Operating field"
},
{
"data": "",
"logicalInterface": "13.56 MHz +- 7kHz",
"physicalPort": "Frequency"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "Secure Channel Protocol authentication method",
"name": "CO",
"operatorType": "Cryptographic Officer",
"type": "Identity"
},
{
"authMethodList": "PIV Symmetric Cryptographic Authentication method",
"name": "CAA",
"operatorType": "User",
"type": "Identity"
},
{
"authMethodList": "Secret Value authentication method (PIN)",
"name": "CH",
"operatorType": "User",
"type": "Identity"
},
{
"authMethodList": "Secret Value authentication method (PUK)",
"name": "CHII",
"operatorType": "User",
"type": "Identity"
},
{
"authMethodList": "Secret Value authentication method (PC)",
"name": "CHPC",
"operatorType": "User",
"type": "Identity"
},
{
"authMethodList": "Secret Value authentication method",
"name": "CHOCC",
"operatorType": "User",
"type": "Identity"
},
{
"authMethodList": "FIDO User Authentication",
"name": "FUSR",
"operatorType": "User",
"type": "Identity"
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "2",
"section": "1",
"title": "General"
},
{
"level": "2",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "2",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "3",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "3",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "N/A",
"section": "6",
"title": "Operational environment"
},
{
"level": "3",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "2",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "2",
"section": "10",
"title": "Self-tests"
},
{
"level": "3",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "N/A",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "2",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "Integrity Test",
"details": "Comparison with known value",
"indicator": "Bit 32 of flag set to 1",
"testMethod": "EDC (16-bit CRC)",
"testProps": "N/A",
"type": "SW/FW Integrity"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "FLAS H",
"distribution": "Manual",
"entry": "Electro nic",
"format": "Plaintex t",
"name": "Change Reference Data (CRD)",
"sfiAlgo": "",
"source": "Enter ed"
},
{
"dest": "FLAS H",
"distribution": "Manual",
"entry": "Electro nic",
"format": "Encrypt ed",
"name": "CTAP2_ClientPIN_ChangePin",
"sfiAlgo": "FIDO KTS",
"source": "Enter ed"
},
{
"dest": "Host",
"distribution": "Manual",
"entry": "Electro nic",
"format": "Plaintex t",
"name": "CTAP2_ClientPIN_GetKeyAgre ement",
"sfiAlgo": "",
"source": "FLAS H"
},
{
"dest": "FLAS H",
"distribution": "Manual",
"entry": "Electro nic",
"format": "Plaintex t",
"name": "CTAP2_ClientPIN_SetPin",
"sfiAlgo": "",
"source": "Enter ed"
},
{
"dest": "FLAS H",
"distribution": "Manual",
"entry": "Electro nic",
"format": "Encrypt ed",
"name": "CTAP2_ClientPIN_GetPinToke n CTAP2_ClientPin_GetPinUvAu thToken UsingPinWithPermissions input",
"sfiAlgo": "FIDO KTS",
"source": "Enter ed"
},
{
"dest": "Host",
"distribution": "Automat ed",
"entry": "Electro nic",
"format": "Encrypt ed",
"name": "CTAP2_ClientPIN_GetPinToke n CTAP2_ClientPin_GetPinUvAu thToken UsingPinWithPermissions output",
"sfiAlgo": "Encryption - Decryption",
"source": "FLAS H"
},
{
"dest": "FLAS H",
"distribution": "Manual",
"entry": "Electro nic",
"format": "Encrypt ed",
"name": "CTAP2_GetAssertion CTAP2_GetNextAssertion input",
"sfiAlgo": "FIDO Authenticat ion",
"source": "Enter ed"
},
{
"dest": "Host",
"distribution": "Manual",
"entry": "Electro nic",
"format": "Encrypt ed",
"name": "CTAP2_MakeCredential output",
"sfiAlgo": "FIDO Registratio n",
"source": "FLAS H"
},
{
"dest": "RAM",
"distribution": "Manual",
"entry": "Electro nic",
"format": "Plaintex t",
"name": "OPACITY Secure Message input",
"sfiAlgo": "",
"source": "Enter ed"
},
{
"dest": "Outp ut",
"distribution": "Manual",
"entry": "Electro nic",
"format": "Plaintex t",
"name": "OPACITY Secure Message output",
"sfiAlgo": "",
"source": "FLAS H"
},
{
"dest": "FLAS H",
"distribution": "Manual",
"entry": "Electro nic",
"format": "Encrypt ed",
"name": "PIV Admin Manage PIN",
"sfiAlgo": "Encryption - Decryption",
"source": "Enter ed"
},
{
"dest": "FLAS H",
"distribution": "Manual",
"entry": "Electro nic",
"format": "Plaintex t",
"name": "PIV Admin Reinit command",
"sfiAlgo": "",
"source": "Enter ed"
},
{
"dest": "Outp ut",
"distribution": "Manual",
"entry": "Electro nic",
"format": "Plaintex t",
"name": "PIV Generate Asymmetric KeyPair",
"sfiAlgo": "",
"source": "FLAS H"
},
{
"dest": "Outp ut",
"distribution": "Manual",
"entry": "Electro nic",
"format": "Plaintex t",
"name": "PIV Get Data",
"sfiAlgo": "",
"source": "FLAS H"
},
{
"dest": "RAM",
"distribution": "Manual",
"entry": "Electro nic",
"format": "Encrypt ed",
"name": "PIV KTS input",
"sfiAlgo": "IFC- Encrypt",
"source": "Enter ed"
},
{
"dest": "Outp ut",
"distribution": "Manual",
"entry": "Electro nic",
"format": "Plaintex t",
"name": "PIV KTS output",
"sfiAlgo": "",
"source": "RAM"
},
{
"dest": "FLAS H",
"distribution": "Manual",
"entry": "Electro nic",
"format": "Plaintex t",
"name": "PIV Put Data",
"sfiAlgo": "",
"source": "Enter ed"
},
{
"dest": "FLAS H",
"distribution": "Manual",
"entry": "Electro nic",
"format": "Encrypt ed",
"name": "PutKey command protected",
"sfiAlgo": "Encryption - Decryption",
"source": "Enter ed"
},
{
"dest": "FLAS H",
"distribution": "Manual",
"entry": "Electro nic",
"format": "Plaintex t",
"name": "Reset Retry Counter (RRC)",
"sfiAlgo": "",
"source": "Enter ed"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "Deselection of the current applet",
"method": "Applet deselection",
"operatorId": "Yes",
"rationale": "Overwrit e with zero values"
},
{
"description": "Using Authenticator_Reset service",
"method": "Authenticator_Re set",
"operatorId": "Yes",
"rationale": "Overwrit e with zero values"
},
{
"description": "When the Secure Channel (Platform service) service or the Opacity Secure Message (Platform service) service is terminated, the SSPs linked to the service are erased by overwriting them with zero values.",
"method": "Closing secure channel",
"operatorId": "Yes",
"rationale": "Overwrit e with zero values"
},
{
"description": "Using FIDO DeleteCredential service. CTAP2_CredentialManagement_DeleteCredential CTAP2_CredentialManagementPreview_DeleteCre dential",
"method": "FIDO DeleteCredential",
"operatorId": "Yes",
"rationale": "Overwrit e with zero values"
},
{
"description": "Using the Lifecycle, the module is set to TERMINATED state, through the Set Status command, the SSPs are destroyed by overwriting with zero values",
"method": "Module entering TERMINATED state",
"operatorId": "Yes",
"rationale": "Overwrit e with zero values"
},
{
"description": "Using PIV Admin MOC-OCC template (PIV Service) to zeroize and delete all MOC-OCC templates.",
"method": "PIV Admin MOC- OCC template",
"operatorId": "Yes",
"rationale": "Overwrit e with zero values"
},
{
"description": "Clear the data model content, keeping the data object header but deleting the value of Sensitive Security Parameters and PIV Objects",
"method": "PIV Admin Reinit command",
"operatorId": "Yes",
"rationale": "Overwrit e with zero values"
},
{
"description": "Using PIV Change Reference Data (CRD) service",
"method": "PIV Change Reference Data (CRD)",
"operatorId": "Yes",
"rationale": "Overwrit e with zero values"
},
{
"description": "Using PIV Put Data service in clear mode",
"method": "PIV PUT Data Mode Clear",
"operatorId": "Yes (CO only)",
"rationale": "Overwrit e with zero values"
},
{
"description": "Using the Module Reset service, the CM is able to destroy the SSPs by overwriting with zero values (in RAM memory).",
"method": "Power-cycling the module",
"operatorId": "Yes",
"rationale": "Overwrit e with zero values"
},
{
"description": "Using the Manage Content service of the CO, the CM is able to destroy the SSPs of the applet, through the Delete command (uninstall method).",
"method": "Uninstallation of applet",
"operatorId": "Yes",
"rationale": "Overwrit e with zero values"
},
{
"description": "Clear immediately after use",
"method": "Zeroise after use",
"operatorId": "No",
"rationale": "Overwrit e with zero values"
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "Electronic non-volatile memory storage",
"name": "FLASH",
"persistance": "Static"
},
{
"description": "Random Access Memory",
"name": "RAM",
"persistance": "Dynamic"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [
{
"features": "Java Card 3.1.0 GlobalPlatform (GP) 2.3.1 Contact with protocol communication T=0 and T=1",
"fwVersion": "IDCore 230- BUILD6.11 with Firmware: IDCore 3230-BUILD6.11; IDPrimePIV 4.0 Applet (version 4.0.0) MoC Server applet (version 1.1) FIDO 2.1 Applet (version 2.1.0.B)",
"hwVersion": "SLC37GDA512 Mask number: G322",
"modelPartNum": "COB Module",
"processors": "Infineon SLC37GDA512"
},
{
"features": "Java Card 3.1.0 GlobalPlatform (GP) 2.3.1 Contact with protocol communication T=0 and T=1",
"fwVersion": "IDCore 230- BUILD6.11 with Firmware: IDCore 3230-BUILD6.11; IDPrimePIV 4.0 Applet (version 4.0.0) MoC Server applet (version 1.1) FIDO 2.1 Applet (version 2.1.0.B)",
"hwVersion": "SLC37GDA512 Mask number: G322",
"modelPartNum": "PICO RLV Module / A3138921",
"processors": "Infineon SLC37GDA512"
},
{
"features": "Java Card 3.1.0 GlobalPlatform (GP) 2.3.1 Contact with protocol communication T=0 and T=1 Contactless with protocol communication T=CL",
"fwVersion": "Firmware: IDCore 3230-BUILD6.11; IDPrimePIV 4.0 Applet (version 4.0.0) MoC Server applet (version 1.1) FIDO 2.1 Applet (version 2.1.0.B)",
"hwVersion": "SLC37GDA512 Mask number: G322",
"modelPartNum": "World Combi RLT module / A2848344",
"processors": "Infineon SLC37GDA512"
},
{
"features": "Java Card 3.1.0 GlobalPlatform (GP) 2.3.1 Contact with protocol communication T=0 and T=1",
"fwVersion": "IDCore 230- BUILD6.11 with Firmware: IDCore 3230-BUILD6.11; IDPrimePIV 4.0 Applet (version 4.0.0) MoC Server applet (version 1.1) FIDO 2.1 Applet (version 2.1.0.B)",
"hwVersion": "SLC37GDA512 Mask number: G322",
"modelPartNum": "World RLT module / A3103037",
"processors": "Infineon SLC37GDA512"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [
{
"algoPropList": "Key Type: Asymmetric and Symmetric",
"implName": "N/A",
"name": "CKG",
"reference": "SP800-133r2 Section 4, Example 1"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECC": {
"ECC": 32
},
"ECDH": {
"ECDH": 9
},
"ECDSA": {
"ECDSA": 24
}
}
},
"certification_process": {},
"cipher_mode": {
"CBC": {
"CBC": 4
},
"CTR": {
"CTR": 2
},
"ECB": {
"ECB": 3
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {},
"crypto_protocol": {},
"crypto_scheme": {
"KA": {
"Key Agreement": 6
},
"MAC": {
"MAC": 12
}
},
"device_model": {},
"ecc_curve": {
"NIST": {
"P-224": 2,
"P-256": 48,
"P-384": 42
}
},
"eval_facility": {},
"fips_cert_id": {
"Cert": {
"#2": 3
}
},
"fips_certlike": {
"Certlike": {
"AES 128": 1,
"AES 256": 1,
"AES CBC 256": 1,
"AES CMAC (256": 1,
"AES- 128/192/ 256": 4,
"AES- 128/192/256": 1,
"AES-128/192/256": 1,
"AES-256": 1,
"AES192": 1,
"HMAC SHA2": 1,
"HMAC-SHA256": 2,
"PKCS#1": 2,
"RSA PKCS#1": 2,
"SHA2": 1,
"SHA2 256": 2,
"SHA2 512": 1,
"SHA2- (224": 1,
"SHA2- 224": 1,
"SHA2- 256": 2,
"SHA2- 384": 2,
"SHA2- 512": 1,
"SHA2-224": 5,
"SHA2-256": 10,
"SHA2-384": 7,
"SHA2-512": 9
}
},
"fips_security_level": {
"Level": {
"Level 2": 4,
"level 3": 1
}
},
"hash_function": {
"SHA": {
"SHA2": {
"SHA2": 4
}
}
},
"ic_data_group": {},
"javacard_api_const": {},
"javacard_packages": {},
"javacard_version": {
"JavaCard": {
"Java Card 3.1.0": 4
}
},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 32
},
"RNG": {
"RBG": 2
},
"TRNG": {
"TRNG": 2
}
},
"side_channel_analysis": {},
"standard_id": {
"FIPS": {
"FIPS 140-3": 11,
"FIPS 1403": 2,
"FIPS 180-4": 1,
"FIPS 186-5": 6,
"FIPS 198-1": 1,
"FIPS 2012": 1,
"FIPS186-5": 13
},
"ISO": {
"ISO/IEC 14443": 2,
"ISO/IEC 7816": 2
},
"NIST": {
"NIST SP 800-90B": 1,
"SP 800-108": 1,
"SP 800-38A": 1,
"SP 800-38B": 1,
"SP 800-38F": 3,
"SP 800-56A": 2,
"SP 800-56B": 1,
"SP 800-56C": 2,
"SP 800-57": 1,
"SP 800-63B": 7,
"SP 800-78": 2,
"SP 800-90A": 1,
"SP 800-90B": 8
},
"PKCS": {
"PKCS#1": 2
},
"RFC": {
"RFC5869": 2
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 44,
"AES-": 6,
"AES-256": 1,
"AES192": 1
},
"CAST": {
"CAST": 48
}
},
"constructions": {
"MAC": {
"CMAC": 7,
"HMAC": 24,
"KMAC": 2
}
}
},
"tee_name": {
"AMD": {
"PSP": 18
},
"IBM": {
"SE": 1,
"SSC": 2
}
},
"tls_cipher_suite": {},
"vendor": {
"Infineon": {
"Infineon": 8
},
"Thales": {
"Thales": 10
}
},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"SHA2-384A2877",
"ECDSA SigGen (FIPS186-5)A2877",
"SHA2-224A2877",
"AES-CMACA2877",
"KAS-ECC Sp800-56Ar3A2877",
"KDF SP800-108A2877",
"KTS-IFCA2877",
"SHA2-256A2877",
"RSA KeyGen (FIPS186-5)A2877",
"AES-CBCA2877",
"Counter DRBGA2877",
"SHA2-512A2877",
"RSA SigGen (FIPS186-5)A2877",
"HMAC-SHA2-256A2877",
"KAS-ECC-SSC Sp800-56Ar3A2877",
"KDA HKDF SP800-56Cr2A2877",
"KDA OneStep SP800-56Cr2A2877",
"AES-ECBA2877",
"ECDSA KeyGen (FIPS186-5)A2877"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A2877"
]
},
"policy_metadata": {
"/CreationDate": "D:20260916085040-04\u002700\u0027",
"/Creator": "Microsoft\u00ae Word for Microsoft 365",
"/ModDate": "D:20260916085040-04\u002700\u0027",
"/Producer": "Microsoft\u00ae Word for Microsoft 365",
"pdf_file_size_bytes": 1319900,
"pdf_hyperlinks": {
"_type": "Set",
"elements": [
"https://supportportal.thalesgroup.com/"
]
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 107
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "5b523b35ee1c5322e77de5c95ca7ebc59363231d8600ae4aee7a39d0bb3e8108",
"source_hash": "e707e78064ed679467c4e975c7a72f6d04f03213754953ba1cf49fca56aed1ba",
"txt_hash": "244683df8880f468cdd610976dc25d1612884f8dfe7b4e58fbde52e06660ec0e"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "None",
"certificate_pdf_url": null,
"date_sunset": "2031-09-27",
"description": "The IDPrime PIV 4.0 FIDO on IDCore3230 Platform is a single-chip \"contact\" or \"contact and contactless\" (aka as \"Dual\") module implementing the Global Platform operational environment, with Card Manager, PIV, PIV Admin, MoC Server (for Match-on-Card) and FIDO Applets.",
"embodiment": "SingleChip",
"exceptions": [
"Roles, services, and authentication: Level 3",
"Software/Firmware security: Level 3",
"Operational environment: N/A",
"Physical security: Level 3",
"Non-invasive security: N/A",
"Life-cycle assurance: Level 3",
"Mitigation of other attacks: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 2,
"mentioned_certs": {},
"module_name": "IDPrime PIV 4.0 FIDO on IDCore3230 Platform",
"module_type": "Hardware",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-09-28",
"lab": "Leidos Accredited Testing \u0026 Evaluation (AT\u0026E) Lab",
"validation_type": "Initial"
}
],
"vendor": "Thales",
"vendor_url": "http://cpl.thalesgroup.com"
}
}