{"_type": "sec_certs.sample.fips.FIPSCertificate", "dgst": "6220b303a7d895e4", "cert_id": 5532, "web_data": {"_type": "sec_certs.sample.fips.FIPSCertificate.WebData", "module_name": "IDPrime PIV 4.0 FIDO on IDCore3230 Platform", "validation_history": [{"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry", "date": "2026-09-28", "validation_type": "Initial", "lab": "Leidos Accredited Testing & Evaluation (AT&E) Lab"}], "vendor_url": "http://cpl.thalesgroup.com", "vendor": "Thales", "certificate_pdf_url": null, "module_type": "Hardware", "standard": "FIPS 140-3", "status": "active", "level": 2, "caveat": "None", "exceptions": ["Roles, services, and authentication: Level 3", "Software/Firmware security: Level 3", "Operational environment: N/A", "Physical security: Level 3", "Non-invasive security: N/A", "Life-cycle assurance: Level 3", "Mitigation of other attacks: N/A"], "embodiment": "SingleChip", "description": "The IDPrime PIV 4.0 FIDO on IDCore3230 Platform is a single-chip \"contact\" or \"contact and contactless\" (aka as \"Dual\") module implementing the Global Platform operational environment, with Card Manager, PIV, PIV Admin, MoC Server (for Match-on-Card) and FIDO Applets.", "tested_conf": null, "hw_versions": null, "fw_versions": null, "sw_versions": null, "mentioned_certs": {}, "historical_reason": null, "date_sunset": "2031-09-27", "revoked_reason": null, "revoked_link": null}, "pdf_data": {"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData", "keywords": {"fips_cert_id": {"Cert": {"#2": 3}}, "fips_security_level": {"Level": {"Level 2": 4, "level 3": 1}}, "fips_certlike": {"Certlike": {"HMAC-SHA256": 2, "HMAC SHA2": 1, "SHA2-224": 5, "SHA2-256": 10, "SHA2-384": 7, "SHA2-512": 9, "SHA2- 256": 2, "SHA2": 1, "SHA2- 224": 1, "SHA2- 384": 2, "SHA2- 512": 1, "SHA2- (224": 1, "SHA2 256": 2, "SHA2 512": 1, "RSA PKCS#1": 2, "AES-256": 1, "AES192": 1, "AES CBC 256": 1, "AES- 128/192/256": 1, "AES-128/192/256": 1, "AES- 128/192/ 256": 4, "AES CMAC (256": 1, "AES 128": 1, "AES 256": 1, "PKCS#1": 2}}, "vendor": {"Infineon": {"Infineon": 8}, "Thales": {"Thales": 10}}, "eval_facility": {}, "symmetric_crypto": {"AES_competition": {"AES": {"AES-256": 1, "AES192": 1, "AES": 44, "AES-": 6}, "CAST": {"CAST": 48}}, "constructions": {"MAC": {"HMAC": 24, "KMAC": 2, "CMAC": 7}}}, "asymmetric_crypto": {"ECC": {"ECDH": {"ECDH": 9}, "ECDSA": {"ECDSA": 24}, "ECC": {"ECC": 32}}}, "pq_crypto": {}, "hash_function": {"SHA": {"SHA2": {"SHA2": 4}}}, "crypto_scheme": {"MAC": {"MAC": 12}, "KA": {"Key Agreement": 6}}, "crypto_protocol": {}, "randomness": {"TRNG": {"TRNG": 2}, "PRNG": {"DRBG": 32}, "RNG": {"RBG": 2}}, "cipher_mode": {"ECB": {"ECB": 3}, "CBC": {"CBC": 4}, "CTR": {"CTR": 2}}, "ecc_curve": {"NIST": {"P-256": 48, "P-384": 42, "P-224": 2}}, "crypto_engine": {}, "tls_cipher_suite": {}, "crypto_library": {}, "vulnerability": {}, "side_channel_analysis": {}, "device_model": {}, "tee_name": {"AMD": {"PSP": 18}, "IBM": {"SSC": 2, "SE": 1}}, "os_name": {}, "cplc_data": {}, "ic_data_group": {}, "standard_id": {"FIPS": {"FIPS 140-3": 11, "FIPS 1403": 2, "FIPS186-5": 13, "FIPS 186-5": 6, "FIPS 198-1": 1, "FIPS 180-4": 1, "FIPS 2012": 1}, "NIST": {"SP 800-38A": 1, "SP 800-38B": 1, "SP 800-90A": 1, "SP 800-56A": 2, "SP 800-56C": 2, "SP 800-108": 1, "SP 800-56B": 1, "NIST SP 800-90B": 1, "SP 800-38F": 3, "SP 800-63B": 7, "SP 800-78": 2, "SP 800-57": 1, "SP 800-90B": 8}, "PKCS": {"PKCS#1": 2}, "RFC": {"RFC5869": 2}, "ISO": {"ISO/IEC 7816": 2, "ISO/IEC 14443": 2}}, "javacard_version": {"JavaCard": {"Java Card 3.1.0": 4}}, "javacard_api_const": {}, "javacard_packages": {}, "certification_process": {}}, "policy_metadata": {"pdf_file_size_bytes": 1319900, "pdf_is_encrypted": false, "pdf_number_of_pages": 107, "/Producer": "Microsoft\u00ae Word for Microsoft 365", "/Creator": "Microsoft\u00ae Word for Microsoft 365", "/CreationDate": "D:20260916085040-04'00'", "/ModDate": "D:20260916085040-04'00'", "pdf_hyperlinks": {"_type": "Set", "elements": ["https://supportportal.thalesgroup.com/"]}}, "module_algorithms": {"_type": "Set", "elements": ["SHA2-384A2877", "ECDSA SigGen (FIPS186-5)A2877", "SHA2-224A2877", "AES-CMACA2877", "KAS-ECC Sp800-56Ar3A2877", "KDF SP800-108A2877", "KTS-IFCA2877", "SHA2-256A2877", "RSA KeyGen (FIPS186-5)A2877", "AES-CBCA2877", "Counter DRBGA2877", "SHA2-512A2877", "RSA SigGen (FIPS186-5)A2877", "HMAC-SHA2-256A2877", "KAS-ECC-SSC Sp800-56Ar3A2877", "KDA HKDF SP800-56Cr2A2877", "KDA OneStep SP800-56Cr2A2877", "AES-ECBA2877", "ECDSA KeyGen (FIPS186-5)A2877"]}, "policy_algorithms": {"_type": "Set", "elements": ["#A2877"]}, "is_br1_format": true, "br1_deviations": 0, "br1_tables": {"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables", "security_levels": {"section": 1, "subsection": 2, "found": true, "entries": [{"section": "1", "title": "General", "level": "2"}, {"section": "2", "title": "Cryptographic module specification", "level": "2"}, {"section": "3", "title": "Cryptographic module interfaces", "level": "2"}, {"section": "4", "title": "Roles, services, and authentication", "level": "3"}, {"section": "5", "title": "Software/Firmware security", "level": "3"}, {"section": "6", "title": "Operational environment", "level": "N/A"}, {"section": "7", "title": "Physical security", "level": "3"}, {"section": "8", "title": "Non-invasive security", "level": "N/A"}, {"section": "9", "title": "Sensitive security parameter management", "level": "2"}, {"section": "10", "title": "Self-tests", "level": "2"}, {"section": "11", "title": "Life-cycle assurance", "level": "3"}, {"section": "12", "title": "Mitigation of other attacks", "level": "N/A"}, {"section": "", "title": "Overall Level", "level": "2"}]}, "tested_module_id_hw": {"section": 2, "subsection": 2, "found": true, "entries": [{"modelPartNum": "COB Module", "hwVersion": "SLC37GDA512 Mask number: G322", "fwVersion": "IDCore 230- BUILD6.11 with Firmware: IDCore 3230-BUILD6.11; IDPrimePIV 4.0 Applet (version 4.0.0) MoC Server applet (version 1.1) FIDO 2.1 Applet (version 2.1.0.B)", "processors": "Infineon SLC37GDA512", "features": "Java Card 3.1.0 GlobalPlatform (GP) 2.3.1 Contact with protocol communication T=0 and T=1"}, {"modelPartNum": "PICO RLV Module / A3138921", "hwVersion": "SLC37GDA512 Mask number: G322", "fwVersion": "IDCore 230- BUILD6.11 with Firmware: IDCore 3230-BUILD6.11; IDPrimePIV 4.0 Applet (version 4.0.0) MoC Server applet (version 1.1) FIDO 2.1 Applet (version 2.1.0.B)", "processors": "Infineon SLC37GDA512", "features": "Java Card 3.1.0 GlobalPlatform (GP) 2.3.1 Contact with protocol communication T=0 and T=1"}, {"modelPartNum": "World Combi RLT module / A2848344", "hwVersion": "SLC37GDA512 Mask number: G322", "fwVersion": "Firmware: IDCore 3230-BUILD6.11; IDPrimePIV 4.0 Applet (version 4.0.0) MoC Server applet (version 1.1) FIDO 2.1 Applet (version 2.1.0.B)", "processors": "Infineon SLC37GDA512", "features": "Java Card 3.1.0 GlobalPlatform (GP) 2.3.1 Contact with protocol communication T=0 and T=1 Contactless with protocol communication T=CL"}, {"modelPartNum": "World RLT module / A3103037", "hwVersion": "SLC37GDA512 Mask number: G322", "fwVersion": "IDCore 230- BUILD6.11 with Firmware: IDCore 3230-BUILD6.11; IDPrimePIV 4.0 Applet (version 4.0.0) MoC Server applet (version 1.1) FIDO 2.1 Applet (version 2.1.0.B)", "processors": "Infineon SLC37GDA512", "features": "Java Card 3.1.0 GlobalPlatform (GP) 2.3.1 Contact with protocol communication T=0 and T=1"}]}, "tested_module_id_sw_fw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "tested_module_id_hw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "tested_op_env_sw_fw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "vendor_affirmed_op_env_sw_fw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "modes_of_operation": {"section": 2, "subsection": 4, "found": false, "entries": []}, "approved_algorithms": {"section": 2, "subsection": 5, "found": true, "entries": [{"algorithm": "AES-CBC, AES-ECB", "cavpCertName": "A2877", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256", "reference": "SP 800-38A"}, {"algorithm": "AES-CMAC", "cavpCertName": "A2877", "properties": "Direction - Generation, Verification Key Length - 128, 192, 256 MAC Length - MAC Length: 128 Message Length - Message Length: 128-256 Increment 8", "reference": "SP 800-38B"}, {"algorithm": "Counter DRBG", "cavpCertName": "A2877", "properties": "Prediction Resistance - No Supports Reseed - No Mode - AES-256 Derivation Function Enabled - Yes Additional Input - Additional Input: 0 Entropy Input - Entropy Input: 1024 Nonce - Nonce: 384 Personalization String Length - Personalization String Length: 0 Returned Bits - 128", "reference": "SP 800-90A Rev. 1"}, {"algorithm": "ECDSA KeyGen (FIPS186-5)", "cavpCertName": "A2877", "properties": "Curve - P-256, P-384 Secret Generation Mode - extra bits", "reference": "FIPS 186-5"}, {"algorithm": "ECDSA SigGen (FIPS186-5)", "cavpCertName": "A2877", "properties": "Curve - P-256, P-384 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512", "reference": "FIPS 186-5"}, {"algorithm": "HMAC-SHA2-256", "cavpCertName": "A2877", "properties": "MAC - MAC: 256 Key Length - Key Length: 128, 256", "reference": "FIPS 198-1"}, {"algorithm": "KAS-ECC Sp800- 56Ar3", "cavpCertName": "A2877", "properties": "Domain Parameter Generation Methods - P- 256, P-384 Function - Partial Validation iutId - 123456ABCD Scheme - onePassDh - KAS Role - Responder KDF Methods - oneStepKdf - Auxiliary Function Methods - Auxiliary Function Name - SHA2-384 Fixed Info Pattern - algorithmId||l||uPartyInfo||vPartyInfo Fixed Info Encoding - Concatenation Key Confirmation Methods - Key Confirmation Directions - Key Confirmation Roles - Key Confirmation MAC Methods - CMAC - Key Length - 256 MAC Length - 128 Key Length - 1024", "reference": "SP 800-56A Rev. 3"}, {"algorithm": "KAS-ECC-SSC Sp800-56Ar3", "cavpCertName": "A2877", "properties": "Domain Parameter Generation Methods - P- 256, P-384 Scheme - ephemeralUnified - KAS Role - initiator, responder", "reference": "SP 800-56A Rev. 3"}, {"algorithm": "KDA HKDF SP800- 56Cr2", "cavpCertName": "A2877", "properties": "Fixed Info Pattern - uPartyInfo||vPartyInfo Fixed Info Encoding - concatenation Derived Key Length - 512 Shared Secret Length - Shared Secret Length: 256 HMAC Algorithm - SHA2-256 Perform Multiple Expansion Tests - No", "reference": "SP 800-56C Rev. 2"}, {"algorithm": "KDA OneStep SP800-56Cr2", "cavpCertName": "A2877", "properties": "Auxiliary Function Methods - Auxiliary Function Name - SHA2-256 Fixed Info Pattern - uPartyInfo||vPartyInfo Fixed Info Encoding - concatenation Derived Key Length - 256 Shared Secret Length - Shared Secret Length: 256", "reference": "SP 800-56C Rev. 2"}, {"algorithm": "KDF SP800-108", "cavpCertName": "A2877", "properties": "KDF Mode - Counter MAC Mode - CMAC-AES128, CMAC- AES192, CMAC-AES256 Supported Lengths - Supported Lengths: 128-256 Increment 64 Fixed Data Order - In the Middle of Fixed Data Counter Length - 8 Supports Empty IV - No Requires Empty IV - No Custom Key In Length - 0", "reference": "SP 800-108 Rev. 1"}, {"algorithm": "KTS-IFC", "cavpCertName": "A2877", "properties": "IUT ID - CAFECAFE Modulo - 2048, 3072, 4096 Key Generation Methods - rsakpg1-crt Fixed Public Exponent - 010001 Scheme - KTS-OAEP-basic - KAS Role - responder Key Transport Method - Hash Algorithms - SHA2-224, SHA2-256, SHA2-384, SHA2-512 Supports Null Associated Data - Yes Associated Data Encoding - concatenation Key Length - 512", "reference": "SP 800-56B Rev. 2"}, {"algorithm": "RSA KeyGen (FIPS186-5)", "cavpCertName": "A2877", "properties": "Key Generation Mode - probable Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512 Modulo - 2048, 3072, 4096", "reference": "FIPS 186-5"}, {"algorithm": "", "cavpCertName": "", "properties": "p mod 8 - 0 Primality Tests - 2pow100 q mod 8 - 0 Fixed Public Exponent - 010001 Info Generated By Server - No Private Key Format - crt, standard Public Exponent Mode - fixed", "reference": ""}, {"algorithm": "RSA SigGen (FIPS186-5)", "cavpCertName": "A2877", "properties": "Hash Pair - Hash Algorithm - SHA2-224 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss Mask Function - MGF1", "reference": "FIPS 186-5"}, {"algorithm": "SHA2-224, SHA2- 256, SHA2-384, SHA2-512", "cavpCertName": "A2877", "properties": "Message Length - Message Length: 8-65536 Increment 8 Function - SHA2", "reference": "FIPS 180-4"}]}, "vendor_affirmed_algos": {"section": 2, "subsection": 5, "found": true, "entries": [{"name": "CKG", "algoPropList": "Key Type: Asymmetric and Symmetric", "implName": "N/A", "reference": "SP800-133r2 Section 4, Example 1"}]}, "non_approved_allowed_algos": {"section": 2, "subsection": 5, "found": false, "entries": []}, "non_approved_allowed_NSC": {"section": 2, "subsection": 5, "found": false, "entries": []}, "non_approved_not_allowed": {"section": 2, "subsection": 5, "found": false, "entries": []}, "ports_interfaces": {"section": 3, "subsection": 1, "found": true, "entries": [{"physicalPort": "VCC", "logicalInterface": "Power", "data": "Supply voltage: Used to supply power to the module in contact mode; The module starts when interface is powered -as specified in ISO17816 -3 ( part 5.2.1)."}, {"physicalPort": "RST", "logicalInterface": "Control Input", "data": "Reset signal: If a signal is sent on this interface on contact mode, the module will reboot (active low) as specified in ISO17816 -3."}, {"physicalPort": "CLK", "logicalInterface": "Control Input", "data": "Clock signal: The interface is used by an external device (ex: smartcard reader) to provide a clock signal to the IC in contact mode as specified in ISO17816 -3."}, {"physicalPort": "GND", "logicalInterface": "Power", "data": "Ground"}, {"physicalPort": "I/O", "logicalInterface": "Data Input Data Output Control Input", "data": "Commands and responses, protocol and control data. The interface is used to communicate with an external entity (ex: SmartCard reader) in contact mode as specified in ISO17816 -3."}, {"physicalPort": "", "logicalInterface": "Status Output", "data": ""}, {"physicalPort": "LA", "logicalInterface": "Data Input Data Output Control Input Status Output Power", "data": "Supply, clock signal, commands and responses, protocol and control data This interface is used to communicate with an external entity (ex: smartcard reader) in contactless mode; It is also used to set the internal clock and to supply power to the module as specified in ISO14443 -2"}, {"physicalPort": "LB", "logicalInterface": "Data Input Data Output Control Input Status Output Power", "data": "Supply, clock signal, commands and responses, protocol and control data This interface is used to communicate with an external entity (ex: smartcard reader) in contactless mode; It is also used to set the internal clock and to supply power to the module as specified in ISO14443 -2"}, {"physicalPort": "Conditions", "logicalInterface": "Range", "data": ""}, {"physicalPort": "Voltage", "logicalInterface": "1.8V, 3 V and 5.5 V DC", "data": ""}, {"physicalPort": "Frequency2", "logicalInterface": "1MHz to 10MHz", "data": ""}, {"physicalPort": "Conditions", "logicalInterface": "Range", "data": ""}, {"physicalPort": "Supported bit rate", "logicalInterface": "106 Kbits/s, 212 Kbits/s, 424 Kbits/s, 848 Kbits/s", "data": ""}, {"physicalPort": "Operating field", "logicalInterface": "Between 1.5 A/m and 7.5 A/m rms", "data": ""}, {"physicalPort": "Frequency", "logicalInterface": "13.56 MHz +- 7kHz", "data": ""}]}, "authentication_methods": {"section": 4, "subsection": 1, "found": true, "entries": [{"name": "Secure Channel Protocol authentication method", "description": "In accordance to SP 800-63B this Authenticator type is described as Single- Factor Cryptographic Software (Section 5.1.6)This method is performed when the EXTERNAL AUTHENTICATE command is invoked after successful execution of the INITIALIZE UPDATE command. This method is used to authenticate the CO role.", "mechanism": "GP Secure Channel", "strength": "The strength of Global Platform mutual authentication relies on AES key length, and the probability that a random attempt at authentication will succeed is: (1/2^128) for AES 16-byte- long keys, (1/2^192) for AES 24-byte- long keys, (1/2^256) for AES 32-byte- long keys.", "perMinute": "The module enforces a maximum count of 15 consecutive failed authentication attempts. After 15 consecutive unsuccessful attempts, the secure channel authentication is permanently blocked."}, {"name": "Secret Value authentication method (PIN)", "description": "In accordance to SP 800-63B, this Authenticator type is described as Memorized Secrets (Section 5.1.1).This authentication method compares an encrypted PIN value sent to the Module to the stored encrypted PIN values. If the two values are equal, the Card Holder is authenticated. This method is used to authenticate the CH role.", "mechanism": "Encryption - Decryption", "strength": "The probability that a random attempt at authentication will succeed is (1/10^8).", "perMinute": "Based on a maximum count of 5 for consecutive failed service authentication attempts, the probability that a random attempt will succeed over a one-minute period is lower than 5/10^8."}, {"name": "Secret Value authentication method (PC)", "description": "In accordance to SP 800-63B, this Authenticator type is described as", "mechanism": "Encryption - Decryption", "strength": "The probability that a random attempt at authentication", "perMinute": "The probability that a random attempt will succeed over a"}, {"name": "", "description": "Memorized Secrets (Section 5.1.1).this authentication method compares an encrypted Pairing Code value sent to the Module to the stored encrypted Pairing Code value. If the two values are equal, the Card Holder is authenticated. This method is used to authenticate the CHPC role.", "mechanism": "", "strength": "will succeed is (1/10^8).", "perMinute": "one-minute period is (59/10^8)."}, {"name": "Secret Value authentication method (PUK)", "description": "In accordance to SP 800-63B, this Authenticator type is described as Memorized Secrets (Section 5.1.1).This authentication method compares an encrypted PUK value sent to the Module to the stored encrypted PUK value if the two values are equal, the Card Holder II is authenticated. This method is used to authenticate the CHII role.", "mechanism": "Encryption - Decryption", "strength": "The probability that a random attempt at authentication will succeed is lower than (1/256^8).", "perMinute": "Based on a maximum count of 15 for consecutive failed service authentication attempts, the probability that a random attempt will succeed over a one-minute period is lower than (15/256^8)."}, {"name": "PIV Symmetric Cryptographic Authentication method", "description": "In accordance to SP 800-63B, this Authenticator type is described as Single- Factor Cryptographic Software (Section 5.1.6).The Module uses the PIV-AUTH- AES to authenticate the CAA role.", "mechanism": "Encryption - Decryption", "strength": "128/192/256 bits. The probability that a random attempt at authentication will succeed is 1/2^128 (for 128-bit length).", "perMinute": "Based on the maximum count value of the failed authentication blocking mechanism, the probability that a random attempt will succeed over a one-minute period is (255/2^128) for AES 16-byte- long keys, (255/2^192) for"}, {"name": "", "description": "", "mechanism": "", "strength": "", "perMinute": "AES 24-byte- long keys, (255/2^256), for AES 32-byte- long keys."}, {"name": "Secret Value authentication method", "description": "In accordance to SP 800-63B, this Authenticator type is described as Memorized Secrets (Section 5.1.1).This authentication method runs an OnCardComparison (OCC) of a candidate fingerprint template as defined by [FIPS 2012]. This method is used to authenticate the CHOCC role.", "mechanism": "Memorized secret for on-card comparison", "strength": "The probability that a random attempt at authentication will succeed is 1/10^4.", "perMinute": "Based on a maximum count of 5 for consecutive failed service authentication attempts, the probability that a random attempt will succeed over a one-minute period is lower than 5/10^4."}, {"name": "FIDO User Authentication", "description": "In accordance to SP 800-63B, this Authenticator type is described as Memorized Secrets (Section 5.1.1).This authentication method compares a PIN value sent to the Module to the stored FID-UV-PIN. If the two values are equal, the operator is authenticated. This method is used to authenticate the FUSR role.", "mechanism": "Encryption - Decryption SHA", "strength": "The probability that a random attempt at authentication will succeed is lower than 1/2^48.", "perMinute": "Based on a maximum count of 8 for consecutive failed service authentication attempts, the probability that a random attempt will succeed over a one-minute period is 8/2^48."}]}, "roles": {"section": 4, "subsection": 2, "found": true, "entries": [{"name": "CO", "type": "Identity", "operatorType": "Cryptographic Officer", "authMethodList": "Secure Channel Protocol authentication method"}, {"name": "CAA", "type": "Identity", "operatorType": "User", "authMethodList": "PIV Symmetric Cryptographic Authentication method"}, {"name": "CH", "type": "Identity", "operatorType": "User", "authMethodList": "Secret Value authentication method (PIN)"}, {"name": "CHII", "type": "Identity", "operatorType": "User", "authMethodList": "Secret Value authentication method (PUK)"}, {"name": "CHPC", "type": "Identity", "operatorType": "User", "authMethodList": "Secret Value authentication method (PC)"}, {"name": "CHOCC", "type": "Identity", "operatorType": "User", "authMethodList": "Secret Value authentication method"}, {"name": "FUSR", "type": "Identity", "operatorType": "User", "authMethodList": "FIDO User Authentication"}]}, "approved_services": {"section": 4, "subsection": 3, "found": true, "entries": [{"name": "Authenticator_Reset (FIDO Service)", "description": "Reset the", "indicator": "IND _1", "inputs": "none", "outputs": "none", "secFunImpl": "CKG Symm", "rolesSspAccess": "Unauthe nticated"}, {"name": "", "description": "applet, renderi ng all credent ials created useless", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "etric KDA HKDF Key Agree ment HMAC", "rolesSspAccess": "- FID- ECDH- ECC: E - FID- KG-AS- ECDSA- PUB: Z - FID- KG-RK- ECDSA: Z - FID- PIN- KEY: G - FID- RK- HMAC- NONCE: Z - FID- SC- AUTH- HMAC: G - FID- SC- ENC- AES: G - FID- SEED: Z - FID- SHARE D- SECRET : E,G - FID- SHARE D- SECRET -INTER: E,G,Z - OS- DRBG- EI: E - OS- DRBG-"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "KEY: G,E - OS- DRBG- S: E - OS- DRBG- V: G,E"}, {"name": "Context - Select an applet or manage logical channels. (Platform service)", "description": "Select an applet or manag e logical channe ls.", "indicator": "IND _1", "inputs": "data", "outputs": "return Status Word", "secFunImpl": "", "rolesSspAccess": "Unauthe nticated - FID- PIN- KEY: Z - FID- SHARE D- SECRET : Z - SD- SENC: Z - SD- SMAC: Z"}, {"name": "CTAP2_ClientPIN _GetPinToken CTAP2_ClientPin _ GetPinUvAuthTokenUsingPinWithPer missions (FIDO service)", "description": "Retriev e the authent ication nonce of the applicat ion", "indicator": "IND _1", "inputs": "CTAP data includi ng encry pted pin", "outputs": "ctap data, status word", "secFunImpl": "Key Agree ment CKG Symm etric KDA HKDF Encry ption - Decry ption", "rolesSspAccess": "FUSR - FID- ECDH- ECC: E - FID- PIN- KEY: G,E - FID- PLAT- ECDH- PUB: W,E,Z - FID- SHARE D- SECRET : E,G - FID- TOKEN- NONCE- V2: G,R - OS- DRBG-"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "EI: E - OS- DRBG- KEY: G,E - OS- DRBG- S: E - OS- DRBG- V: G,E"}, {"name": "CTAP2_ClientPIN_ChangePin (FIDO service)", "description": "Update the pin of the applicat ion", "indicator": "IND _1", "inputs": "CTAP data includi ng encry pted pin", "outputs": "status word", "secFunImpl": "HMAC KDA HKDF Key Agree ment Encry ption - Decry ption Secur e Hash Gener ate Key Pair EC", "rolesSspAccess": "FUSR - FID- ECDH- ECC: E,G - FID- ECDH- ECC- PUB: G - FID- PIN- KEY: G,E - FID- PLAT- ECDH- PUB: W,E,Z - FID- SHARE D- SECRET : G,E - FID- SHARE D- SECRET -INTER: G,E,Z - FID- UV-PIN: W,E - FID- UV-PIN- Hash: G"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "- OS- MKDK: E"}, {"name": "CTAP2_ClientPIN_GetKeyAgreement (FIDO service)", "description": "Return the number transie nt ECDH public key of the applicat ion", "indicator": "IND _1", "inputs": "CTAP data", "outputs": "ctap data, status word", "secFunImpl": "", "rolesSspAccess": "Unauthe nticated - FID- ECDH- ECC- PUB: R"}, {"name": "CTAP2_ClientPIN_GetRetries (FIDO service)", "description": "Return the number of remaini ng attempt for the PIN", "indicator": "IND _1", "inputs": "CTAP data", "outputs": "ctap data, status word", "secFunImpl": "", "rolesSspAccess": "Unauthe nticated"}, {"name": "CTAP2_ClientPIN_SetPin (FIDO service)", "description": "Set the pin of the applicat ion", "indicator": "IND _1", "inputs": "CTAP data includi ng encry pted pin", "outputs": "status word", "secFunImpl": "Gener ate Key Pair EC KDA HKDF Secur e Hash Encry ption - Decry ption HMAC Key Agree ment", "rolesSspAccess": "Unauthe nticated - FID- ECDH- ECC: E,G - FID- ECDH- ECC- PUB: G - FID- PIN- KEY: G,E - FID- PLAT- ECDH- PUB: W,E,Z - FID- SHARE D- SECRET : G,E"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "- FID- SHARE D- SECRET -INTER: G,E,Z - FID- UV-PIN: W,E - FID- UV-PIN- Hash: G - OS- MKDK: E"}, {"name": "CTAP2_Config _SettingAMinimumPINLength (FIDO service)", "description": "Used to set a minimu m PIN Length", "indicator": "IND _1", "inputs": "CTAP data", "outputs": "status word", "secFunImpl": "HMAC", "rolesSspAccess": "FUSR - FID- TOKEN- NONCE- V2: E"}, {"name": "CTAP2_Config _ToggleAlwaysRequireUserVerificatio n (FIDO service)", "description": "Used to enforce User Verifific ation", "indicator": "IND _1", "inputs": "CTAP data", "outputs": "status word", "secFunImpl": "HMAC", "rolesSspAccess": "FUSR - FID- TOKEN- NONCE- V2: E"}, {"name": "CTAP2_ControlEnd (FIDO service)", "description": "Deactiv ate the applet, until the applet is explicitl y selecte d again", "indicator": "IND _1", "inputs": "none", "outputs": "status word", "secFunImpl": "None", "rolesSspAccess": "Unauthe nticated"}, {"name": "CTAP2_CredentialManagement_Enu maratingCredentialsForAnRP_Begin _EnumaratingCredentialsForAnRP_Ne xt (FIDO service)", "description": "Used for enumer ation of Creden tials for a RP present on the", "indicator": "IND _1", "inputs": "CTAP data", "outputs": "ctap data, status word", "secFunImpl": "HMAC", "rolesSspAccess": "FUSR - FID- TOKEN- NONCE- V2: E"}, {"name": "Name", "description": "Descript ion authent", "indicator": "Indi cat or", "inputs": "Inputs", "outputs": "Output s", "secFunImpl": "Securit y Functi ons", "rolesSspAccess": "SSP Access"}, {"name": "CTAP2_CredentialManagement_Enu maratingRPs_Begin_EnumaratingRPs _Next (FIDO service)", "description": "icator Used for enumer ation of RPs present on the authent", "indicator": "IND _1", "inputs": "CTAP data", "outputs": "ctap data, status word", "secFunImpl": "HMAC", "rolesSspAccess": "FUSR - FID- TOKEN- NONCE- V2: E"}, {"name": "CTAP2_CredentialManagement_Getti ngCredentialsMetadata (FIDO service)", "description": "icator Used to get credent ials metada ta", "indicator": "IND _1", "inputs": "CTAP data", "outputs": "ctap data, status word", "secFunImpl": "HMAC", "rolesSspAccess": "FUSR - FID- TOKEN- NONCE- V2: E"}, {"name": "CTAP2_CredentialManagement_Delet eCredential (FIDO service)", "description": "Used to delete a credent ial", "indicator": "IND _1", "inputs": "CTAP data", "outputs": "status word", "secFunImpl": "HMAC", "rolesSspAccess": "FUSR - FID- KG-RK- ECDSA: Z - FID- KG-RK- ECDSA- PUB: Z - FID- RK- HMAC- NONCE: Z - FID- TOKEN- NONCE- V2: E"}, {"name": "CTAP2_CredentialManagement _UpdatingUserInformation (FIDO service)", "description": "Used to update user informa tion associa ted to a credent ial", "indicator": "IND _1", "inputs": "CTAP data", "outputs": "status word", "secFunImpl": "HMAC", "rolesSspAccess": "FUSR - FID- TOKEN- NONCE- V2: E"}, {"name": "CTAP2_GetAssertion CTAP2_GetNextAssertion (FIDO service)", "description": "initiate a CTAP2 token authent ication", "indicator": "IND _1", "inputs": "CTAP data", "outputs": "ctap data, status word", "secFunImpl": "CKG Symm etric Digital Signat ure Gener ation ECC Encry ption - Decry ption FIDO Authe nticati on FIDO KTS FIDO Regist ration HMAC KDA HKDF", "rolesSspAccess": "FUSR - FID- HMAC- NONCE: E,G - FID- KG-AS- ECDSA: E - FID- KG-RK- ECDSA: E - FID- RK- HMAC- NONCE: E - FID- SC- AUTH- HMAC: E - FID- SC- ENC- AES: E - FID- SEED: E,W - FID- TOKEN- NONCE- V2: E"}, {"name": "CTAP2_GetInfo (FIDO service)", "description": "Retriev e the authent icator informa tion", "indicator": "IND _1", "inputs": "none", "outputs": "getInf o data return Status Word", "secFunImpl": "", "rolesSspAccess": "Unauthe nticated"}, {"name": "CTAP2_MakeCredential (FIDO service)", "description": "Genera tes a new key pair for token", "indicator": "IND _1", "inputs": "ctap data", "outputs": "ctap data, status word", "secFunImpl": "FIDO KTS FIDO Regist ration", "rolesSspAccess": "FUSR - FID- AT- ECDSA: E - FID-"}, {"name": "", "description": "registra tion", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "AT- ECDSA- PUB: R - FID- HMAC- NONCE: G - FID- KG-AS- ECDSA: G - FID- KG-AS- ECDSA- PUB: G,R - FID- KG-RK- ECDSA: G - FID- KG-RK- ECDSA- PUB: G - FID- RK- HMAC- NONCE: G - FID- SC- AUTH- HMAC: E - FID- SC- ENC- AES: E - FID- SEED: G,R - FID- TOKEN- NONCE- V2: E"}, {"name": "FIDO GetData (Applet Info) (FIDO service)", "description": "Retriev e the authent icator informa tion", "indicator": "IND _1", "inputs": "none", "outputs": "return Status Word / info data", "secFunImpl": "", "rolesSspAccess": "Unauthe nticated"}, {"name": "FIDO Select (FIDO service)", "description": "allows the platfor m to let a user select a certain authent icator", "indicator": "IND _1", "inputs": "datas such as a DF an EF by its file ID, path or name", "outputs": "return Status Word", "secFunImpl": "None", "rolesSspAccess": "CO Unauthe nticated"}, {"name": "Get Approved mode parameters (Platform service)", "description": "Get informa tion of the approv ed mode of operati on", "indicator": "IND _1", "inputs": "none", "outputs": "data return Status Word", "secFunImpl": "", "rolesSspAccess": "Unauthe nticated"}, {"name": "Lifecycle (Platform service)", "description": "Modify the card or applet life cycle status. May be employ ed to perform zeroiza tion.", "indicator": "IND _1", "inputs": "Set / Get Status : life cycle state to updat e/ empty", "outputs": "return Status Word / life cycle state and packa ge list", "secFunImpl": "None", "rolesSspAccess": "CO - FID- HMAC- NONCE: Z - DAP- SYM: Z - FID- AT- ECDSA: Z - FID- AT- ECDSA- PUB: Z - FID- ECDH- ECC: Z - FID- ECDH-"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "ECC- PUB: Z - FID- KG-AS- ECDSA: Z - FID- KG-AS- ECDSA- PUB: Z - FID- KG-RK- ECDSA: Z - FID- PIN- KEY: Z - FID- RK- HMAC- NONCE: Z - FID- SEED: Z - FID- SHARE D- SECRET : Z - FID- TOKEN- NONCE- V2: Z - FID- UV-PIN: Z - MOC- OCC: Z - OPACIT Y- SCONFI RMATIO N: Z - OPACIT"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "Y-SENC: Z - OPACIT Y- SMAC: Z - OPACIT Y- SRMAC: Z - OS- DRBG- EI: Z - OS- DRBG- KEY: Z - OS- DRBG- S: Z - OS- DRBG- V: Z - PIV- AKM- ECC: Z - PIV- AKM- RSA: Z - PIV- AS-ECC: Z - PIV- AS-ECC- PUB: Z - PIV- AS-RSA: Z - PIV- AS-RSA- PUB: Z - PIV- AUTH- AES: Z - PIV- AUTH-"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "ECC: Z - PIV- AUTH- ECC- PUB: Z - PIV- AUTH- RSA: Z - PIV- AUTH- RSA- PUB: Z - PIV- AUTH- CH-AES: Z - PIV- AUTH- CH- ECC: Z - PIV- AUTH- CH-RSA: Z - PIV- KS-ECC: Z - PIV- KS-RSA: Z - PIV- PC: Z - PIV- PIN: Z - PIV- PUK: Z - PIV- SM- ECC: Z - PIV- SM- ECC- PUB: Z - SD- KDEK: Z - SD-"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "KENC: Z - SD- KMAC: Z - SD- SENC: Z - SD- SMAC: Z"}, {"name": "Manage Content (Platform service)", "description": "Load, install, and delete applicat ion packag es", "indicator": "IND _1", "inputs": "Applic ations and associ ated data", "outputs": "return Status Word", "secFunImpl": "GP Secur e Chann el Messa ge Authe nticati on", "rolesSspAccess": "CO - DAP- SYM: E,Z - FID- AT- ECDSA: Z - FID- AT- ECDSA- PUB: Z - FID- ECDH- ECC: Z - FID- ECDH- ECC- PUB: Z - FID- KG-AS- ECDSA: Z - FID- KG-AS- ECDSA- PUB: Z - FID- KG-RK- ECDSA: Z - FID- PIN- KEY: Z - FID- RK- HMAC- NONCE: Z"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "- FID- SC- ENC- AES: Z - FID- SEED: Z - FID- SHARE D- SECRET : Z - FID- TOKEN- NONCE- V2: Z - FID- UV-PIN: Z - MOC- OCC: Z - OPACIT Y- SCONFI RMATIO N: Z - OPACIT Y-SENC: Z - OPACIT Y- SMAC: Z - OPACIT Y- SRMAC: Z - OS- DRBG- EI: Z - OS- DRBG- KEY: Z - OS-"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "DRBG- S: Z - OS- DRBG- V: Z - PIV- AKM- ECC: Z - PIV- AKM- RSA: Z - PIV- AS-ECC: Z - PIV- AS-ECC- PUB: Z - PIV- AS-RSA: Z - PIV- AS-RSA- PUB: Z - PIV- AUTH- AES: Z - PIV- AUTH- ECC: Z - PIV- AUTH- ECC- PUB: Z - PIV- AUTH- RSA: Z - PIV- AUTH- RSA- PUB: Z - PIV- AUTH- CH-AES: Z - PIV- AUTH-"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "CH- ECC: Z - PIV- AUTH- CH-RSA: Z - PIV- KS-ECC: Z - PIV- KS-RSA: Z - PIV- PC: Z - PIV- PIN: Z - PIV- PUK: Z - PIV- SM- ECC: Z - PIV- SM- ECC- PUB: Z - SD- KDEK: Z - SD- KENC: Z - SD- KMAC: Z - SD- SENC: E,Z - SD- SMAC: E,Z"}, {"name": "Manage keys (Platform service)", "description": "Put Keys", "indicator": "IND _1", "inputs": "Com mand param eters (data object s, SSPs)", "outputs": "return Status Word", "secFunImpl": "Encry ption - Decry ption GP Secur e Chann el", "rolesSspAccess": "CO - DAP- SYM: W - OS- MKDK: W - PIV- AUTH- AES: W"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "- PIV- AUTH- CH-AES: W - SD- MDAP- KENC: W - SD- MDAP- KMAC: W - SD- KDEK: E,W - SD- KENC: W - SD- KMAC: W - SD- MDAP- KDEK: W - SD- SENC: E - SD- SMAC: E"}, {"name": "Module Info (Auth) (Platform service)", "description": "Read module configu ration or status informa tion (privile ged data objects ).", "indicator": "IND _1", "inputs": "Tags and modul e inform ation", "outputs": "modul e config uratio n status inform ation, return Status Word", "secFunImpl": "GP Secur e Chann el Messa ge Authe nticati on", "rolesSspAccess": "CO - SD- SENC: E - SD- SMAC: E"}, {"name": "Module Info (Platform service)", "description": "Read unprivil eged data", "indicator": "IND _1", "inputs": "data", "outputs": "return Status Word", "secFunImpl": "", "rolesSspAccess": "Unauthe nticated"}, {"name": "", "description": "objects, e.g., module configu ration or status informa tion, includin g version informa tion..", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": ""}, {"name": "Module Reset (Platform service)", "description": "Power cycle or reset the Module . Include s Integrit y Self- Test, periodi c self- test counter set-up and self- test flag is reset", "indicator": "IND _1", "inputs": "none", "outputs": "ATR (Answ er To Reset)", "secFunImpl": "DRBG Entrop y Sourc e", "rolesSspAccess": "Unauthe nticated - SD- SENC: Z - SD- SMAC: Z - OS- DRBG- EI: Z,G,E - OS- DRBG- S: Z,G,E - OS- DRBG- KEY: Z,G,E - OS- DRBG- V: Z,G,E - FID- ECDH- ECC: Z - FID- HMAC- NONCE: Z - FID- SHARE D- SECRET : Z - FID-"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "TOKEN- NONCE- V2: Z - OPACIT Y- SCONFI RMATIO N: Z - OPACIT Y-SENC: Z - OPACIT Y- SMAC: Z - OPACIT Y- SRMAC: Z"}, {"name": "OPACITY Secure Message (PIV Service)", "description": "Establi sh OPACI TY- ZKM secure messa ging", "indicator": "IND _1", "inputs": "data", "outputs": "contro l byte + nonce + crypto gram + cert return Status Word", "secFunImpl": "Messa ge Authe nticati on Opacit y Secur e Chann el Secur e Hash CKG Symm etric Encry ption - Decry ption", "rolesSspAccess": "Unauthe nticated - OPACIT Y- SCONFI RMATIO N: G,E,Z - OPACIT Y-SENC: G,E - OPACIT Y- SMAC: G,E - OPACIT Y- SRMAC: G,E - OPACIT"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "Y-Z: G,E,Z - OS- DRBG- EI: E - OS- DRBG- KEY: G,E - OS- DRBG- S: E - OS- DRBG- V: G,E - PIV- SM- ECC- PUB: R - ROE- PUB: W,E"}, {"name": "PIV Admin Garbage collector command (PIV Service)", "description": "Perfor ms a memor y clean up", "indicator": "IND _1", "inputs": "N/A", "outputs": "return Status Word", "secFunImpl": "GP Secur e Chann el", "rolesSspAccess": "CO - SD- SENC: E - SD- SMAC: E"}, {"name": "PIV Admin Get data (Prop) (PIV Service)", "description": "Retriev es the data content of - Data Object Control Param eter (DOCP ) of SE, PIN, Key or data object, Applet person", "indicator": "IND _1", "inputs": "object name", "outputs": "Object data conte nt, return Status Word", "secFunImpl": "", "rolesSspAccess": "Unauthe nticated"}, {"name": "", "description": "alizatio n data", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": ""}, {"name": "PIV Admin Get pin last error code (PIV Service)", "description": "Retriev es the last error encoun ter regardi ng the pin policy verificat ion", "indicator": "IND _1", "inputs": "N/A", "outputs": "last error code, return Status Word", "secFunImpl": "", "rolesSspAccess": "Unauthe nticated"}, {"name": "PIV Admin Manage PIN (PIV Service)", "description": "Unlock a pin or change its value without any knowle dge of the current value", "indicator": "IND _1", "inputs": "PIN Refer ence new PIN", "outputs": "return Status Word", "secFunImpl": "Encry ption - Decry ption GP Secur e Chann el", "rolesSspAccess": "CO - OS- MKDK: E - PIV- PC: W,E - PIV- PIN: W,E - PIV- PUK: W,E - PIV- AUTH- CH-AES: E"}, {"name": "PIV Admin Reinit command (PIV Service)", "description": "Clear the data model content , keepin g the data object header but deletin g the value of Sensiti ve", "indicator": "IND _1", "inputs": "object data, Admin keyID", "outputs": "return Status Word", "secFunImpl": "GP Secur e Chann el", "rolesSspAccess": "CO - PIV- AKM- ECC: Z - PIV- AKM- ECC- PUB: Z - PIV- AKM- RSA: Z - PIV- AKM- RSA- PUB: Z - PIV- AS-ECC: Z"}, {"name": "", "description": "Securit y Param eters and PIV Objects", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "- PIV- AS-ECC- PUB: Z - PIV- AS-RSA: Z - PIV- AS-RSA- PUB: Z - PIV- AUTH- AES: W - PIV- AUTH- ECC: Z - PIV- AUTH- CH-AES: Z - PIV- AUTH- CH- ECC: Z - PIV- AUTH- CH- ECC- PUB: Z - PIV- AUTH- CH-RSA: Z - PIV- AUTH- CH- RSA- PUB: Z - PIV- KS-ECC: Z - PIV- KS-ECC- PUB: Z - PIV- KS-RSA: Z"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "- PIV- KS-RSA- PUB: Z - PIV- SM- ECC: Z - PIV- SM- ECC- PUB: Z - SD- SENC: E - SD- SMAC: E - PIV- PIN: Z"}, {"name": "PIV Admin Select (PIV Service)", "description": "Select admin applet", "indicator": "IND _1", "inputs": "datas such as a DF an EF by its file ID, path or name", "outputs": "return Status Word", "secFunImpl": "", "rolesSspAccess": "Unauthe nticated"}, {"name": "PIV Administrator Authentication (PIV Service)", "description": "Perfor ms, externa l authent ication, or mutual authent ication.", "indicator": "IND _1", "inputs": "Rand om, crypto gram, algorit hm refere nce, key refere nce, data", "outputs": "Crypto gram, nonce , return Status Word", "secFunImpl": "DRBG Encry ption - Decry ption", "rolesSspAccess": "CAA - OS- DRBG- EI: G,E - OS- DRBG- KEY: G,E - OS- DRBG- S: G,E - OS- DRBG- V: G,E - PIV- AUTH- AES: E - PIV- AUTH-"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "CH-AES: E"}, {"name": "PIV Authentication (PIV Service)", "description": "Authent ication by an externa l system, or authent icates the card holder to an externa l entity", "indicator": "IND _1", "inputs": "Data to sign", "outputs": "Signat ure, return Status Word", "secFunImpl": "Digital Signat ure Gener ation ECC Digital Signat ure Gener ation RSA Encry ption - Decry ption", "rolesSspAccess": "CH - PIV- AS-ECC: E - PIV- AUTH- AES: E - PIV- AUTH- CH-AES: E - PIV- AUTH- CH- ECC: E - PIV- AUTH- CH-RSA: E Unauthe nticated - PIV- AS-ECC: E - PIV- AUTH- ECC: E - PIV- AUTH- RSA: E - PIV- AUTH- CH-AES: E - PIV- AUTH- CH- ECC: E - PIV- AUTH- CH-RSA: E"}, {"name": "Name", "description": "Descript ion", "indicator": "Indi cat or", "inputs": "Inputs", "outputs": "Output s", "secFunImpl": "Securit y Functi", "rolesSspAccess": "SSP Access"}, {"name": "PIV Change Reference Data (CRD) (PIV Service)", "description": "Chang es the value of a PIN. (Note: User Auth is always done within the comma nd itself by providi ng previou s PIN) Secure Messa ging is enforce d for this comma nd.", "indicator": "IND _1", "inputs": "PIN Refer ence, Curre nt PIN, new PIN", "outputs": "return Status Word", "secFunImpl": "ons Encry ption - Decry ption Opacit y Secur e Chann el Messa ge Authe nticati on", "rolesSspAccess": "CH - OPACIT Y-SENC: E - OPACIT Y- SMAC: E - OPACIT Y- SRMAC: E - OS- MKDK: E - PIV- PC: W,E,Z - PIV- PIN: W,E,Z - PIV- PUK: W,E,Z CHII - OPACIT Y-SENC: E - OPACIT Y- SMAC: E - OPACIT Y- SRMAC: E - OS- MKDK: E - PIV- PC: W,E,Z - PIV- PIN:"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "W,E,Z CHPC - OPACIT Y-SENC: E - OPACIT Y- SMAC: E - OPACIT Y- SRMAC: E - PIV- PC: W,E,Z - PIV- PIN: W,E,Z - PIV- PUK:"}, {"name": "PIV digital signature (PIV Service)", "description": "Digital signatu re mode pin always", "indicator": "IND _1", "inputs": "off card hash data", "outputs": "Signat ure, return Status Word", "secFunImpl": "Digital Signat ure Gener ation ECC Digital Signat ure Gener ation RSA", "rolesSspAccess": "W,E,Z CH - PIV- AS-ECC: E - PIV- AS-RSA: E - PIV- AUTH- CH- ECC: E - PIV- AUTH- CH-RSA: E CHOCC - PIV- AS-ECC: E - PIV- AS-RSA: E"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "- PIV- AUTH- CH- ECC: E - PIV- AUTH- CH-RSA: E"}, {"name": "PIV Generate asymmetric key pair (PIV Service)", "description": "Genera tes an RSA or EC Asymm etric Key Pair", "indicator": "IND _1", "inputs": "key refere nce, algorit hm, data", "outputs": "PSP key value, return Status Word", "secFunImpl": "Gener ate Key Pair EC Gener ate Key Pair RSA", "rolesSspAccess": "CAA - OS- DRBG- EI: E - OS- DRBG- KEY: G,E - OS- DRBG- S: E - OS- DRBG- V: G,E - PIV- AKM- ECC: G - PIV- AKM- ECC- PUB: G,R - PIV- AKM- RSA: G - PIV- AKM- RSA- PUB: G,R - PIV- AS-ECC- PUB: G - PIV- AS-RSA: G - PIV- AS-RSA-"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "PUB: G,R - PIV- AUTH- ECC: G - PIV- AUTH- ECC- PUB: G,R - PIV- AUTH- RSA: G - PIV- AUTH- RSA- PUB: G,R - PIV- AUTH- CH- ECC: G,E - PIV- AUTH- CH- ECC- PUB: G - PIV- AUTH- CH-RSA: G - PIV- AUTH- CH- RSA- PUB: G,R - PIV- SM- ECC: G - PIV- SM- ECC- PUB: G,R"}, {"name": "PIV Get data (PIV Service)", "description": "Retriev es the data content of the single data object whose tag is given in the data field.", "indicator": "IND _1", "inputs": "object name", "outputs": "Object data conte nt, return Status Word", "secFunImpl": "", "rolesSspAccess": "CH - MOC- OCC: E - PIV- AKM- ECC- PUB: R - PIV- AKM- RSA- PUB: R - PIV- AS-RSA- PUB: R - PIV- AUTH- ECC- PUB: R - PIV- AUTH- RSA- PUB: R - PIV- AUTH- CH- ECC- PUB: R - PIV- AUTH- CH- RSA- PUB: R - PIV- KS-ECC- PUB: R - PIV- KS-RSA- PUB: R - PIV- PIN: E CHOCC - MOC- OCC: E - PIV- PIN: E CHPC"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "- MOC- OCC: E - PIV- PIN: E Unauthe nticated - MOC- OCC: E - PIV- AUTH- CH- RSA- PUB: R - PIV- PIN: E"}, {"name": "PIV KTS (PIV Service)", "description": "Used with the key manag ement key ('9D') and the retired key manag ement keys ('82' - '95') to realize key establis hment schem es specifie d in SP 800-78 (ECDH and RSA)", "indicator": "IND _1", "inputs": "Wrap ped data to unwra p", "outputs": "Unwra pped data, return status", "secFunImpl": "Key Agree ment IFC- Encry pt", "rolesSspAccess": "CH - ECDH_R KEY: W,E,Z - PIV- AKM- ECC: E - PIV- AKM- RSA: E - PIV- KS-ECC: E - PIV- KS-RSA: E - PIV- SYM- KEY: R,W,Z - PIV-Z: R,G,Z"}, {"name": "PIV Put data (PIV Service)", "description": "Create s, update s or", "indicator": "IND _1", "inputs": "object data", "outputs": "return Status Word", "secFunImpl": "", "rolesSspAccess": "CAA - MOC- OCC: W,Z"}, {"name": "", "description": "deletes an object value in the data model.", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "- PIV- AKM- ECC: W,Z - PIV- AKM- ECC- PUB: W,Z - PIV- AKM- RSA: W,Z - PIV- AKM- RSA- PUB: W,Z - PIV- AS-ECC: W,Z - PIV- AS-ECC- PUB: W,Z - PIV- AS-RSA: W,Z - PIV- AS-RSA- PUB: W,Z - PIV- AUTH- ECC: W,Z - PIV- AUTH- ECC- PUB: W,Z - PIV- AUTH- RSA: W,Z - PIV-"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "AUTH- RSA- PUB: W,Z - PIV- AUTH- CH-AES: W,Z - PIV- AUTH- CH- ECC: W,Z - PIV- AUTH- CH- ECC- PUB: W,Z - PIV- AUTH- CH-RSA: W,Z - PIV- AUTH- CH- RSA- PUB: W,Z - PIV- KS-ECC: W,Z - PIV- KS-ECC- PUB: W,Z - PIV- KS-RSA: W,Z - PIV- KS-RSA- PUB: W,Z - PIV- SM- ECC:"}, {"name": "Name", "description": "Descript ion", "indicator": "Indi cat or", "inputs": "Inputs", "outputs": "Output s", "secFunImpl": "Securit y Functi ons", "rolesSspAccess": "SSP Access W,Z - PIV- SM- ECC- PUB: W,Z"}, {"name": "PIV Reset Retry Counter (RRC) (PIV Service)", "description": "Unbloc ks and change s the value of a PIN Secure Messa ging is enforce d for this comma nd.", "indicator": "IND _1", "inputs": "\"Rese t retry count er\" refere nce data", "outputs": "return Status Word", "secFunImpl": "Encry ption - Decry ption", "rolesSspAccess": "- PIV- PIN: Z CHII - OS- MKDK: E - PIV- AUTH- CH-AES: E - PIV- PIN: W - PIV- PUK: E"}, {"name": "PIV Select (PIV Service)", "description": "Selects a DF or an EF by its file ID, path or name (in the case of DFs).", "indicator": "IND _1", "inputs": "Data such as a DF, an EF by its file ID, path or name", "outputs": "return Status Word", "secFunImpl": "", "rolesSspAccess": "CAA CH CHII CHOCC CHPC Unauthe nticated"}, {"name": "PIV Verify (MOC-OCC) (PIV Service)", "description": "Authent icates the user (CHOC C) to the card by present ing the MOC- OCC templat", "indicator": "IND _1", "inputs": "finger print refere nce", "outputs": "return Status Word", "secFunImpl": "", "rolesSspAccess": "CHOCC - MOC- OCC: E"}, {"name": "", "description": "e (aka Finger Print or Minutia e). The User Authent icated status is granted with a succes sful On Card Compa rison.", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": ""}, {"name": "PIV Verify (PIN) (PIV Service)", "description": "Authent icates the user (CH) to the card by present ing the User PIN. The User Authent icated status is granted with a succes sful PIN verificat ion.", "indicator": "IND _1", "inputs": "Pin refere nce", "outputs": "return Status Word", "secFunImpl": "Encry ption - Decry ption", "rolesSspAccess": "CH - OS- MKDK: E - PIV- PIN: E CHPC - OS- MKDK: E - PIV- PC: E"}, {"name": "Request for autotest (Platform service)", "description": "Resets specific cryptog raphic flag to", "indicator": "IND _1", "inputs": "data", "outputs": "return Status Word", "secFunImpl": "", "rolesSspAccess": "Unauthe nticated"}, {"name": "Secure Channel (Platform service)", "description": "request autotes t Establi sh and use a secure commu nication s channe l", "indicator": "IND _1", "inputs": "rando m, diversi ficatio n data", "outputs": "authe nticati on data, return Status Word", "secFunImpl": "DRBG Encry ption - Decry ption GP Secur e Chann el KDF Messa ge Authe nticati on CKG Symm etric", "rolesSspAccess": "CO - OS- DRBG- EI: E - OS- DRBG- KEY: G,E - OS- DRBG- S: E - OS- DRBG- V: G,E - SD- MDAP- KENC: E - SD- MDAP- KMAC: E - SD- KDEK: E - SD- KENC: E - SD- KMAC: E - SD- MDAP- KDEK: E - SD- SENC: G,E,Z - SD- SMAC: G,E,Z"}, {"name": "U2F_Get Version (FIDO service)", "description": "Retriev e protoco l version implem ented by the", "indicator": "IND _1", "inputs": "none", "outputs": "Versio n return Status Word", "secFunImpl": "", "rolesSspAccess": "Unauthe nticated"}, {"name": "", "description": "authent icator", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": ""}, {"name": "Authenticator Select (FIDO service)", "description": "Selects the authent icator on the current channe l", "indicator": "IND _1", "inputs": "None", "outputs": "return Status Word", "secFunImpl": "", "rolesSspAccess": "Unauthe nticated"}, {"name": "Manage Content (data) (Platform Service)", "description": "PutDat a StoreD ata platfor m comma nd", "indicator": "IND _1", "inputs": "Tags and modul e inform ation", "outputs": "return Status Word", "secFunImpl": "GP Secur e Chann el", "rolesSspAccess": "CO - SD- SENC: E - SD- SMAC: E"}, {"name": "PIV Admin MOC-OCC template (PIV Service)", "description": "Zeroize and Delete all the MOC- OCC templat es.", "indicator": "IND _1", "inputs": "None", "outputs": "return Status Word", "secFunImpl": "GP Secur e Chann el", "rolesSspAccess": "CO - MOC- OCC: Z - SD- SENC: E - SD- SMAC: E"}]}, "non_approved_services": {"section": 4, "subsection": 4, "found": false, "entries": []}, "mechanisms_actions": {"section": 7, "subsection": 1, "found": true, "entries": [{"mechanism": "Single-Chip Packaging", "inspectFreq": "On receipt of module following transport. Before each module use", "inspectGuidance": "In the event of any observed damage, photograph the card and contact Thales to confirm whether observed anomalies are to be expected or are confirmed signs of potential tampering"}]}, "storage_areas": {"section": 9, "subsection": 1, "found": true, "entries": [{"name": "FLASH", "description": "Electronic non-volatile memory storage", "persistance": "Static"}, {"name": "RAM", "description": "Random Access Memory", "persistance": "Dynamic"}]}, "ssp_io_methods": {"section": 9, "subsection": 2, "found": true, "entries": [{"name": "Change Reference Data (CRD)", "source": "Enter ed", "dest": "FLAS H", "format": "Plaintex t", "distribution": "Manual", "entry": "Electro nic", "sfiAlgo": ""}, {"name": "CTAP2_ClientPIN_ChangePin", "source": "Enter ed", "dest": "FLAS H", "format": "Encrypt ed", "distribution": "Manual", "entry": "Electro nic", "sfiAlgo": "FIDO KTS"}, {"name": "CTAP2_ClientPIN_GetKeyAgre ement", "source": "FLAS H", "dest": "Host", "format": "Plaintex t", "distribution": "Manual", "entry": "Electro nic", "sfiAlgo": ""}, {"name": "CTAP2_ClientPIN_SetPin", "source": "Enter ed", "dest": "FLAS H", "format": "Plaintex t", "distribution": "Manual", "entry": "Electro nic", "sfiAlgo": ""}, {"name": "CTAP2_ClientPIN_GetPinToke n CTAP2_ClientPin_GetPinUvAu thToken UsingPinWithPermissions input", "source": "Enter ed", "dest": "FLAS H", "format": "Encrypt ed", "distribution": "Manual", "entry": "Electro nic", "sfiAlgo": "FIDO KTS"}, {"name": "CTAP2_ClientPIN_GetPinToke n CTAP2_ClientPin_GetPinUvAu thToken UsingPinWithPermissions output", "source": "FLAS H", "dest": "Host", "format": "Encrypt ed", "distribution": "Automat ed", "entry": "Electro nic", "sfiAlgo": "Encryption - Decryption"}, {"name": "CTAP2_GetAssertion CTAP2_GetNextAssertion input", "source": "Enter ed", "dest": "FLAS H", "format": "Encrypt ed", "distribution": "Manual", "entry": "Electro nic", "sfiAlgo": "FIDO Authenticat ion"}, {"name": "CTAP2_MakeCredential output", "source": "FLAS H", "dest": "Host", "format": "Encrypt ed", "distribution": "Manual", "entry": "Electro nic", "sfiAlgo": "FIDO Registratio n"}, {"name": "OPACITY Secure Message input", "source": "Enter ed", "dest": "RAM", "format": "Plaintex t", "distribution": "Manual", "entry": "Electro nic", "sfiAlgo": ""}, {"name": "OPACITY Secure Message output", "source": "FLAS H", "dest": "Outp ut", "format": "Plaintex t", "distribution": "Manual", "entry": "Electro nic", "sfiAlgo": ""}, {"name": "PIV Admin Manage PIN", "source": "Enter ed", "dest": "FLAS H", "format": "Encrypt ed", "distribution": "Manual", "entry": "Electro nic", "sfiAlgo": "Encryption - Decryption"}, {"name": "PIV Admin Reinit command", "source": "Enter ed", "dest": "FLAS H", "format": "Plaintex t", "distribution": "Manual", "entry": "Electro nic", "sfiAlgo": ""}, {"name": "PIV Generate Asymmetric KeyPair", "source": "FLAS H", "dest": "Outp ut", "format": "Plaintex t", "distribution": "Manual", "entry": "Electro nic", "sfiAlgo": ""}, {"name": "PIV Get Data", "source": "FLAS H", "dest": "Outp ut", "format": "Plaintex t", "distribution": "Manual", "entry": "Electro nic", "sfiAlgo": ""}, {"name": "PIV KTS input", "source": "Enter ed", "dest": "RAM", "format": "Encrypt ed", "distribution": "Manual", "entry": "Electro nic", "sfiAlgo": "IFC- Encrypt"}, {"name": "PIV KTS output", "source": "RAM", "dest": "Outp ut", "format": "Plaintex t", "distribution": "Manual", "entry": "Electro nic", "sfiAlgo": ""}, {"name": "PIV Put Data", "source": "Enter ed", "dest": "FLAS H", "format": "Plaintex t", "distribution": "Manual", "entry": "Electro nic", "sfiAlgo": ""}, {"name": "PutKey command protected", "source": "Enter ed", "dest": "FLAS H", "format": "Encrypt ed", "distribution": "Manual", "entry": "Electro nic", "sfiAlgo": "Encryption - Decryption"}, {"name": "Reset Retry Counter (RRC)", "source": "Enter ed", "dest": "FLAS H", "format": "Plaintex t", "distribution": "Manual", "entry": "Electro nic", "sfiAlgo": ""}]}, "ssp_zeroization_methods": {"section": 9, "subsection": 3, "found": true, "entries": [{"method": "Applet deselection", "description": "Deselection of the current applet", "rationale": "Overwrit e with zero values", "operatorId": "Yes"}, {"method": "Authenticator_Re set", "description": "Using Authenticator_Reset service", "rationale": "Overwrit e with zero values", "operatorId": "Yes"}, {"method": "Closing secure channel", "description": "When the Secure Channel (Platform service) service or the Opacity Secure Message (Platform service) service is terminated, the SSPs linked to the service are erased by overwriting them with zero values.", "rationale": "Overwrit e with zero values", "operatorId": "Yes"}, {"method": "FIDO DeleteCredential", "description": "Using FIDO DeleteCredential service. CTAP2_CredentialManagement_DeleteCredential CTAP2_CredentialManagementPreview_DeleteCre dential", "rationale": "Overwrit e with zero values", "operatorId": "Yes"}, {"method": "Module entering TERMINATED state", "description": "Using the Lifecycle, the module is set to TERMINATED state, through the Set Status command, the SSPs are destroyed by overwriting with zero values", "rationale": "Overwrit e with zero values", "operatorId": "Yes"}, {"method": "PIV Admin MOC- OCC template", "description": "Using PIV Admin MOC-OCC template (PIV Service) to zeroize and delete all MOC-OCC templates.", "rationale": "Overwrit e with zero values", "operatorId": "Yes"}, {"method": "PIV Admin Reinit command", "description": "Clear the data model content, keeping the data object header but deleting the value of Sensitive Security Parameters and PIV Objects", "rationale": "Overwrit e with zero values", "operatorId": "Yes"}, {"method": "PIV Change Reference Data (CRD)", "description": "Using PIV Change Reference Data (CRD) service", "rationale": "Overwrit e with zero values", "operatorId": "Yes"}, {"method": "PIV PUT Data Mode Clear", "description": "Using PIV Put Data service in clear mode", "rationale": "Overwrit e with zero values", "operatorId": "Yes (CO only)"}, {"method": "Power-cycling the module", "description": "Using the Module Reset service, the CM is able to destroy the SSPs by overwriting with zero values (in RAM memory).", "rationale": "Overwrit e with zero values", "operatorId": "Yes"}, {"method": "Uninstallation of applet", "description": "Using the Manage Content service of the CO, the CM is able to destroy the SSPs of the applet, through the Delete command (uninstall method).", "rationale": "Overwrit e with zero values", "operatorId": "Yes"}, {"method": "Zeroise after use", "description": "Clear immediately after use", "rationale": "Overwrit e with zero values", "operatorId": "No"}]}, "self_tests": {"section": 10, "subsection": 1, "found": true, "entries": [{"algorithmOrTest": "Integrity Test", "testProps": "N/A", "testMethod": "EDC (16-bit CRC)", "type": "SW/FW Integrity", "indicator": "Bit 32 of flag set to 1", "details": "Comparison with known value"}]}, "cond_self_tests": {"section": 10, "subsection": 2, "found": true, "entries": [{"algorithmOrTest": "SP 800-90B APT", "testProps": "Statistic error event", "testMethod": "Fault- Detection test", "type": "CAST", "indicator": "IND_2", "details": "TRNG error", "condition": "N/A"}, {"algorithmOrTest": "AES ECB Decrypt", "testProps": "Decrypt KAT using an AES 128-bit key in ECB mode.", "testMethod": "KAT", "type": "CAST", "indicator": "Bit 18 of flag set to 1", "details": "Decrypt", "condition": "COND_1"}, {"algorithmOrTest": "Counter DRBG", "testProps": "Gets a random value with specific nonce (48 bytes) and entropy (128 bytes) and compares the", "testMethod": "KAT", "type": "CAST", "indicator": "Bit 3 of flag set to 1", "details": "none", "condition": "COND_1"}, {"algorithmOrTest": "", "testProps": "generated random value with the value stored in ROM. Performs DRBG Instantiate and DRBG Generate per SP 800-90Ar1 Section 11.3 including health test .", "testMethod": "", "type": "", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "ECDSA KeyGen", "testProps": "Sign a fixed pattern and verify with the public key in order to validate the key pair", "testMethod": "PCT", "type": "PCT", "indicator": "IND_3", "details": "Sign, verify", "condition": "COND_2"}, {"algorithmOrTest": "ECDSA Signature Generation", "testProps": "ECDSA signature generation using an ECC P-224 key", "testMethod": "KAT", "type": "CAST", "indicator": "Bit 30 of flag set to 1", "details": "Sign", "condition": "COND_1"}, {"algorithmOrTest": "Firmware Load", "testProps": "Signature verification with AES CMAC (256 bits key)", "testMethod": "Signature", "type": "SW/FW Load", "indicator": "IND_4", "details": "Signature verification with AES CMAC", "condition": "COND_3"}, {"algorithmOrTest": "HMAC- SHA2-256", "testProps": "Compute HMAC with key 16 bytes message 24 bytes", "testMethod": "KAT", "type": "CAST", "indicator": "Bit 10 of flag set to 1", "details": "HMAC", "condition": "COND_1"}, {"algorithmOrTest": "KAS-ECC Sp800- 56Ar3 OnePassDH C2", "testProps": "Performs OnePassDH algorithm relying on Crypto Suite2", "testMethod": "KAT", "type": "CAST", "indicator": "Bit 6 of flag set to 1", "details": "AES 128, ECDSA (Curve P- 256) with SHA2-256", "condition": "COND_1"}, {"algorithmOrTest": "KAS-ECC Sp800- 56Ar3 OnePassDH C7", "testProps": "Performs OnePassDH algorithm relying on Crypto Suite 7", "testMethod": "KAT", "type": "CAST", "indicator": "Bit 7 of flag set to 1", "details": "(AES 256, ECDSA (Curve P- 384) with SHA2-384)", "condition": "COND_1"}, {"algorithmOrTest": "KAS-ECC- SSC", "testProps": "Generate standalone shared secret (SP800- 56Ar3)", "testMethod": "KAT", "type": "CAST", "indicator": "Bit 29 of flag set to 1", "details": "KAS-ECC- SSC Sp800- 56Ar3 (ECDH P224)", "condition": "COND_1"}, {"algorithmOrTest": "KDA HKDF", "testProps": "Performs a Key derivation (RFC5869) and verifies result", "testMethod": "KAT", "type": "CAST", "indicator": "Bit 7 of flag set to 1", "details": "Key derivation", "condition": "COND_1"}, {"algorithmOrTest": "KDA OneStep SP800- 56Cr2", "testProps": "Performs a Key derivation and verifies result.", "testMethod": "KAT", "type": "CAST", "indicator": "Bit 2 of flag set to 1", "details": "Key derivation", "condition": "COND_1"}, {"algorithmOrTest": "KDF SP 800-108r1 Encrypt/Sign", "testProps": "Generates AES- CMAC message performs a KDF AES-CMAC KAT using an AES 128- byte key and 32- byte derivation data", "testMethod": "KAT", "type": "CAST", "indicator": "Bit 18 of flag set to 1", "details": "Encrypt Sign", "condition": "COND_1"}, {"algorithmOrTest": "IFC-Encrypt", "testProps": "Performs an RSA decrypt using an RSA 2048-bit public key implementation", "testMethod": "KAT", "type": "CAST", "indicator": "Bit 26 of flag set to 1", "details": "Decrypt", "condition": "COND_1"}, {"algorithmOrTest": "RSA Key Generation", "testProps": "Performs Signature Generation and Signature Verification using the key pair", "testMethod": "PCT", "type": "PCT", "indicator": "IND_3", "details": "Signature Generation and Verification", "condition": "COND_2"}, {"algorithmOrTest": "RSA Signature Generation (CRT)", "testProps": "Performs an RSA PKCS#1 v1.5 signature generation using an RSA 2048-bit private CRT key implementation", "testMethod": "KAT", "type": "CAST", "indicator": "Bit 28 of flag set to 1", "details": "RSA Signature generation", "condition": "COND_1"}, {"algorithmOrTest": "RSA Signature Generation (STD)", "testProps": "Performs an RSA PKCS#1 v1.5 signature generation using an RSA 2048-bit private STD key implementation", "testMethod": "KAT", "type": "CAST", "indicator": "Bit 27 of flag set to 1", "details": "RSA SigGen STD, RSA encrypt", "condition": "COND_1"}, {"algorithmOrTest": "SHA2-256", "testProps": "SHA2-256: hashes a 24-bytes message", "testMethod": "KAT", "type": "CAST", "indicator": "Bit 22 of flag set to 1", "details": "Hash", "condition": "COND_1"}, {"algorithmOrTest": "SHA2-512", "testProps": "SHA2-512: hashes a 24-bytes message", "testMethod": "KAT", "type": "CAST", "indicator": "Bit 23of flag set to 1", "details": "Hash", "condition": "COND_1"}, {"algorithmOrTest": "SP 800-90B RCT", "testProps": "Entropy error event", "testMethod": "Fault- Detection test", "type": "CAST", "indicator": "IND_2", "details": "TRNG error", "condition": "N/A"}]}, "error_states": {"section": 10, "subsection": 4, "found": true, "entries": [{"name": "Card is killed", "description": "The module Resource Manager has shut down. It no longer responds to the command, service", "conditions": "Fault Detected", "recoveryMethod": "N/A", "indicator": "No answer from module"}, {"name": "Card is Mute", "description": "The module Resource Manager has shut down", "conditions": "Fault Detected", "recoveryMethod": "Reset card", "indicator": "Error log is stored"}]}}}, "heuristics": {"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics", "algorithms": {"_type": "Set", "elements": ["SHA2-384A2877", "ECDSA SigGen (FIPS186-5)A2877", "SHA2-224A2877", "KAS-ECC Sp800-56Ar3A2877", "AES-CMACA2877", "KDF SP800-108A2877", "KTS-IFCA2877", "SHA2-256A2877", "RSA KeyGen (FIPS186-5)A2877", "AES-CBCA2877", "Counter DRBGA2877", "SHA2-512A2877", "#A2877", "RSA SigGen (FIPS186-5)A2877", "HMAC-SHA2-256A2877", "KAS-ECC-SSC Sp800-56Ar3A2877", "KDA HKDF SP800-56Cr2A2877", "KDA OneStep SP800-56Cr2A2877", "AES-ECBA2877", "ECDSA KeyGen (FIPS186-5)A2877"]}, "extracted_versions": {"_type": "Set", "elements": ["4.0"]}, "cpe_matches": null, "verified_cpe_matches": null, "related_cves": null, "policy_prunned_references": {"_type": "Set", "elements": []}, "module_prunned_references": {"_type": "Set", "elements": []}, "policy_processed_references": {"_type": "sec_certs.sample.certificate.References", "directly_referenced_by": null, "indirectly_referenced_by": null, "directly_referencing": null, "indirectly_referencing": null}, "module_processed_references": {"_type": "sec_certs.sample.certificate.References", "directly_referenced_by": null, "indirectly_referenced_by": null, "directly_referencing": null, "indirectly_referencing": null}, "direct_transitive_cves": null, "indirect_transitive_cves": null}, "state": {"_type": "sec_certs.sample.fips.InternalState", "module": {"_type": "sec_certs.sample.document_state.DocumentState", "download_ok": true, "convert_ok": true, "extract_ok": true, "source_hash": null, "txt_hash": null, "json_hash": null}, "policy": {"_type": "sec_certs.sample.document_state.DocumentState", "download_ok": true, "convert_ok": true, "extract_ok": true, "source_hash": "e707e78064ed679467c4e975c7a72f6d04f03213754953ba1cf49fca56aed1ba", "txt_hash": "244683df8880f468cdd610976dc25d1612884f8dfe7b4e58fbde52e06660ec0e", "json_hash": "5b523b35ee1c5322e77de5c95ca7ebc59363231d8600ae4aee7a39d0bb3e8108"}}}