Module nist_piv

An APDU transform which handles commands for the NIST PIV applet (defined in SP 800-73-4).

Behaviours: apdu_transform.

Description

An APDU transform which handles commands for the NIST PIV applet (defined in SP 800-73-4).

Data Types

admin_auth_cmd()

admin_auth_cmd() = {admin_auth, sym_algo(), binary()}

admin_auth_reply()

admin_auth_reply() = ok | {error, term()}

algo()

algo() = sym_algo() | asym_algo() | asym_hashoncard_algo() | sm_algo()

PIV algorithm IDs

asym_algo()

asym_algo() = rsa1024 | rsa2048 | eccp256 | eccp384

Asymmetric (public/private) key algorithms.

asym_hashoncard_algo()

asym_hashoncard_algo() = eccp256_sha1 | eccp256_sha256 | eccp384_sha1 | eccp384_sha256 | eccp384_sha384

Algorithms used by the hash-on-card extension (PIVApplet)

attempts()

attempts() = integer()

Count of remaining attempts at an authentication method.

auth_method()

auth_method() = piv_pin | global_pin | {occ, primary | secondary} | piv_puk | pairing_code

Authentication methods.

cert()

cert() = #'OTPCertificate'{}

change_pin_cmd()

change_pin_cmd() = {change_pin, auth_method(), Old::pin(), New::pin()}

change_pin_reply()

change_pin_reply() = verify_reply()

chuid()

chuid() = #{fascn => binary(), org_id => binary(), duns => binary(), guid => guid(), expiry => binary(), chuuid => binary(), signature => binary()}

Decoded information from the CHUID (card holder UID) file.

cmd()

cmd() = select_cmd() | read_chuid_cmd() | read_discov_cmd() | read_keyhist_cmd() | read_cert_cmd() | verify_cmd() | sign_cmd() | ecdh_cmd() | admin_auth_cmd() | generate_cmd() | write_cert_cmd() | change_pin_cmd() | reset_pin_cmd() | yk_ver_cmd() | yk_serial_cmd() | yk_set_mgmt_cmd() | yk_generate_cmd() | yk_metadata_cmd()

discov()

discov() = #{auth_methods => [auth_method()], primary_auth => auth_method(), vci => boolean(), pairing_code_for_vci => boolean()}

Decoded information from the PIV Discovery Object.

ecdh_cmd()

ecdh_cmd() = {ecdh, slot(), algo(), #'ECPoint'{}}

ecdh_reply()

ecdh_reply() = {ok, binary()} | {error, term()}

fixed_len_data()

fixed_len_data() = binary()

Fixed length auth data, already padded if necessary.

generate_cmd()

generate_cmd() = {generate, slot(), algo()}

generate_reply()

generate_reply() = {ok, pubkey()} | {error, term()}

guid()

guid() = binary()

GUID in raw binary form (16 bytes).

keyhist()

keyhist() = #{on_card_certs => integer(), off_card_certs => integer(), uri => binary()}

Decoded information from the PIV Key History Object.

numeric_slot()

numeric_slot() = integer()

Slot number, e.g. 16#9A

obj_tag()

obj_tag() = cardcap | chuid | secobj | keyhist | printinfo | fingerprints | security | facial_image | iris_images | sm_cert_signer | pairing_code | bio_group_tpl | discov | {cert, symbolic_slot()} | {cert, numeric_slot()} | binary()

A PIV object tag, which can be used to obtain its contents.

pin()

pin() = binary()

ASCII numeric chars, length 6-8.

pubkey()

pubkey() = #'RSAPublicKey'{} | {#'ECPoint'{}, {namedCurve, crypto:ec_named_curve()}}

read_cert_cmd()

read_cert_cmd() = {read_cert, slot()}

read_cert_reply()

read_cert_reply() = {ok, cert()} | {error, term()}

read_chuid_cmd()

read_chuid_cmd() = read_chuid

read_chuid_reply()

read_chuid_reply() = {ok, chuid()} | {error, term()}

read_discov_cmd()

read_discov_cmd() = read_discov

read_discov_reply()

read_discov_reply() = {ok, discov()} | {error, term()}

read_keyhist_cmd()

read_keyhist_cmd() = read_keyhist

read_keyhist_reply()

read_keyhist_reply() = {ok, keyhist()} | {error, term()}

reply()

reply() = select_reply() | read_chuid_reply() | read_discov_reply() | read_keyhist_reply() | read_cert_reply() | verify_reply() | sign_reply() | ecdh_reply() | admin_auth_reply() | generate_reply() | write_cert_reply() | change_pin_reply() | reset_pin_reply() | yk_ver_reply() | yk_serial_reply() | yk_set_mgmt_reply() | yk_generate_reply() | yk_metadata_reply()

reset_pin_cmd()

reset_pin_cmd() = {reset_pin, PUK::pin(), NewPIN::pin()}

reset_pin_reply()

reset_pin_reply() = verify_reply()

rts()

rts() = #{version => integer(), uri => binary(), app_label => binary(), algorithms => [algo()]}

Decoded information from a response-to-select (RTS).

select_cmd()

select_cmd() = select

select_reply()

select_reply() = {ok, rts()} | {error, term()}

sign_cmd()

sign_cmd() = {sign, slot(), algo(), binary()}

sign_reply()

sign_reply() = {ok, binary()} | {error, term()}

slot()

slot() = symbolic_slot() | numeric_slot()

PIV key reference / slot identifier.

sm_algo()

sm_algo() = cs2 | cs7

Algorithms used for secure messaging.

sym_algo()

sym_algo() = des3_ecb | aes128_ecb | aes192_ecb | aes256_ecb

Symmetric key algorithms. Note that des3_ecb is 3-key Triple DES.

symbolic_slot()

symbolic_slot() = piv_auth | piv_sign | piv_card_auth | piv_key_mgmt | {retired, integer()}

Slot symbolic identifier

verify_cmd()

verify_cmd() = {verify, auth_method(), fixed_len_data()} | {verify_pin, auth_method(), pin()} | {clear, auth_method()}

verify_reply()

verify_reply() = ok | {error, bad_auth, attempts()} | {error, term()}

write_cert_cmd()

write_cert_cmd() = {write_cert, slot(), cert()}

write_cert_reply()

write_cert_reply() = ok | {error, term()}

yk_generate_cmd()

yk_generate_cmd() = {generate, slot(), algo(), yk_pin_policy(), yk_touch_policy()}

yk_generate_reply()

yk_generate_reply() = generate_reply()

yk_metadata()

yk_metadata() = yk_metadata_asym() | yk_metadata_sym() | yk_metadata_pin()

yk_metadata_asym()

yk_metadata_asym() = #{algo => algo(), pin_policy => yk_pin_policy(), touch_policy => yk_touch_policy(), origin => imported | generated, public_key => pubkey()}

yk_metadata_cmd()

yk_metadata_cmd() = {yk_get_metadata, slot() | auth_method()}

yk_metadata_pin()

yk_metadata_pin() = #{default => boolean(), retries => {Max::integer(), Remaining::integer()}}

yk_metadata_reply()

yk_metadata_reply() = {ok, yk_metadata()} | {error, term()}

yk_metadata_sym()

yk_metadata_sym() = #{algo => algo(), pin_policy => yk_pin_policy(), touch_policy => yk_touch_policy(), default => boolean()}

yk_pin_policy()

yk_pin_policy() = default | never | once | always

yk_serial_cmd()

yk_serial_cmd() = yk_get_serial

yk_serial_reply()

yk_serial_reply() = {ok, integer()} | {error, term()}

yk_set_mgmt_cmd()

yk_set_mgmt_cmd() = {yk_set_mgmt, sym_algo(), binary(), yk_touch_policy()}

yk_set_mgmt_reply()

yk_set_mgmt_reply() = ok | {error, term()}

yk_touch_policy()

yk_touch_policy() = default | never | always | cached

yk_ver_cmd()

yk_ver_cmd() = yk_get_version

yk_ver_reply()

yk_ver_reply() = {ok, yk_version()} | {error, term()}

yk_version()

yk_version() = {Major::integer(), Minor::integer(), Patch::integer()}

Function Index

algo_for_key/1

Function Details

algo_for_key/1

algo_for_key(X1::pubkey()) -> algo()


Generated by EDoc