Updated guidelines for testing PIV card apps and middleware are released
Connecting state and local government leaders
The revised version of this NIST special publication reflects changes made to specifications for the government’s Personal Identity Verification access and identity card.
The guidelines for compliance testing of Personal Identity Verification (PIV) applications and middleware have been revised by the National Institute of Standards and Technology (NIST) to reflect changes that have been made in the specifications for PIV cards and access control systems.
Special Publication SP 800-85A-1, titled “PIV Card Application and Middleware Interface Test Guidelines,” has been finalized after a public comment period. The revisions include additional tests that are necessary to confirm some of the optional features added to the PIV Data Model and Card Interface as well as the PIV middleware.
Homeland Security Presidential Directive 12 mandated a common, interoperable, electronic ID card for government employees and contractors. The card is supposed to be used for both IT and physical access control. Standards for this PIV card system are defined in Federal Information Processing Standard (FIPS) 201, and technical specifications and implementation guidance are provided in a series of NIST special publications, including SP 800-73-2, titled “Interfaces for Personal Identity Verification.” This specifies the PIV data model, command interface, client application programming interface and references to transitional interface specifications for the government’s interoperable PIV cards.
The latest revision of SP 800-73 was released in September. It is published in four separate volumes that replace the previous single document, published in 2006. The four-volumes can be downloaded separately or in a single zipped file.
SP 800-85A-1 provides “test requirements and test assertions that could be used to validate the compliance/conformance of two PIV components—PIV middleware and PIV card application with the specifications in NIST SP 800-73-2,” the document says. “Because NIST SP 800-73-2 specifications were developed for meeting interoperability goals of FIPS 201, the conformance tests in this document provide the assurance that the set of PIV middleware and PIV card applications that have passed these tests are interoperable. This in turn facilitates marketing and procurement of FIPS 201-conformant products that meet the goals of HSPD-12.”
The middleware is software that acts as an interface between a PIV client application, which the card must access, and software on the card. The middleware contains a client application programming interface and generates appropriate commands for communicating with the card application. The card application resides on the PIV card, and implements the commands of the PIV card command interface and provides access to objects of the PIV data model. A card reader and driver link the PIV Card with the middleware.
The newly revised publication contains guidelines for conformance testing for three classes of specifications contained in NIST SP 800-73-2:
- End-Point Data Objects and End-Point Data Types and their Representations.
- End-Point PIV Card Application Card Command Interface.
- End-Point Client-Application Programming Interface.
The primary changes in this revision include:
- Tests for retrieving and parsing the newly added optional Discovery Object through the Contact and Contactless interfaces in the PIV card.
- Test for populating the newly added Discovery Object on the PIV card.
- Tests for verifying the correct behavior of “Card Activation” command and “PIN."
- Management” commands in the context of the PIN Usage Value specified in the Discovery Object.
- Tests for verifying that the access control behavior of the card is in conformance with the PIN Usage Value in the Discovery Object.
NEXT STORY: Argonne uses RFID to monitor nuclear shipments