NIST Special Publication 800-85B PIV Data Model Test Guidelines

July 2006

U.S. Department of Commerce

National Institute of Standards and Technology

.

I N F O R M A T I O N S E C U R I T Y

U.S. Department of Commerce

National Institute of Standards and Technology

William A. Jeffrey, Director

Computer Security Division

Information Technology Laboratory

National Institute of Standards and Technology

Gaithersburg, MD, 20899-8930

Carlos M. Gutierrez, Secretary

Ramaswamy Chandramouli

Ketan Mehta

Pius A. Uzamere II

David Simon

Nabil Ghadiali

Andrew P. Founds 

NIST Special Publication 800-85B PIV Data Model Test Guidelines

July 2006

U.S. Department of Commerce

National Institute of Standards and Technology

.

I N F O R M A T I O N S E C U R I T Y

U.S. Department of Commerce

National Institute of Standards and Technology

William A. Jeffrey, Director

Computer Security Division

Information Technology Laboratory

National Institute of Standards and Technology

Gaithersburg, MD, 20899-8930

Carlos M. Gutierrez, Secretary

Ramaswamy Chandramouli

Ketan Mehta

Pius A. Uzamere II

David Simon

Nabil Ghadiali

Andrew P. Founds 
Special Publication 800-85B PIV Data Model Testing Specification

REPORTS ON COMPUTER SYSTEMS TECHNOLOGY

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology 

(NIST) promotes the U.S. economy and public welfare by providing technical leadership for the 

Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, 

proof of concept implementations, and technical analyses to advance the development and productive 

use of information technology. ITL’s responsibilities include the development of management, 

administrative, technical, and physical standards and guidelines for the cost-effective security and 

privacy of non-national security-related information in Federal information systems. This special 

publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information system

security, and its collaborative activities with industry, government, and academic organizations. 

National Institute of Standards and Technology Special Publication 800-85B, 164 pages 

(July 2006) 

 Page ii
Special Publication 800-85B PIV Data Model Testing Specification

Acknowledgements 

The authors wish to thank their colleagues who reviewed drafts of this document and contributed to its 

development. The authors also gratefully acknowledge and appreciate the many contributions from the 

public and private sectors whose thoughtful and constructive contribution improved the quality and 

usefulness of this publication. 

 Page iii
Special Publication 800-85B PIV Data Model Testing Specification

Executive Summary

Homeland Security Presidential Directive 12 (HSPD-12) called for a new standard to be adopted 

governing the use of common identity credentials for physical and logical access to Federal 

government locations and systems. The Personal Identity Verification (PIV) standard for Federal 

Employees and Contractors, Federal Information Processing Standard 201 (FIPS201), was developed to 

establish government-wide identity credentials. Credentials are issued to individuals whose true 

identity has been verified and whose need for the credential has been established and authorized by 

proper authorities. 

FIPS201 describes a variety of data model components as a part of the PIV logical credentials. Such 

components include biometric elements in the form of fingerprint information and facial imagery and 

security elements such as electronic keys, certificates, and signatures. FIPS201 incorporates by 

reference NIST Special Publication 800-73 (SP80073), which specifies elements related to the PIV 

card interface, NIST Special Publication 800-76 (SP80076), which specifies the biometric 

requirements, and NIST Special Publication 800-78 (SP80078) which specifies acceptable cryptographic 

algorithms and key sizes for PIV systems. 

A robust testing framework and guidance to provide assurance that a particular component or system is 

compliant with FIPS201 and supporting standards should exist to build the necessary PIV infrastructure 

to support common unified processes and systems for government-wide use. NIST developed test 

guidance in two parts. The first part addresses test requirements for interface to the PIV card and are 

provided in SP80085A. The second part provides test requirements for the PIV data model and is 

provided in this document. This document specifies the derived test requirements, and the detailed test 

assertions and conformance tests for testing the PIV data model. 

 Page iv
Special Publication 800-85B PIV Data Model Testing Specification

Table of Contents

1. Introduction ............................................................................................................1

1.1 Authority ..........................................................................................................1

1.2 Purpose and Scope.........................................................................................1

1.3 Audience and Assumptions .............................................................................2

2. Conformance Test Overview.................................................................................3

2.1 Test Architecture .............................................................................................3

2.2 Test Methodology............................................................................................4

2.3 Test Set-up......................................................................................................5

2.4 Test Areas .......................................................................................................5

2.4.1 BER-TLV Format Conformance............................................................5

2.4.2 Digital Signature Blocks Conformance .................................................5

2.4.3 Biometric Data Objects Conformance...................................................6

2.4.4 Certificate Profile Conformance............................................................6

3. Test Methodology...................................................................................................7

3.1 Derived Test Requirements.............................................................................7

3.2 Test Assertions................................................................................................7

4. BER-TLV DTRs .......................................................................................................9

4.1 BER-TLV Testing.............................................................................................9

4.2 Card Capability Container (CCC) ....................................................................9

4.3 Card Holder Unique Identifier (CHUID) ...........................................................9

4.4 Biometric Fingerprint .....................................................................................10

4.5 Biometric Facial.............................................................................................10

4.6 Security Object ..............................................................................................10

5. Biometric Data ......................................................................................................11

5.1 Common Header for PIV Biometric Data.......................................................11

5.2 Fingerprint Template for Storage on PIV Card ..............................................13

5.3 Facial Image Stored on PIV Card..................................................................16

6. Signed Data Elements..........................................................................................18

6.1 Card Holder Unique Identifier........................................................................18

6.1.1 Asymmetric Signature Conformance ..................................................18

6.1.2 Certificate that signs the CHUID.........................................................20

 Page v
Special Publication 800-85B PIV Data Model Testing Specification

6.2 Biometric Fingerprint .....................................................................................21

6.2.1 Asymmetric Signature Conformance ..................................................21

6.2.2 Certificate that signs the biometric fingerpint ......................................24

6.3 Biometric Facial Image..................................................................................24

6.3.1 Asymmetric Signature Conformance ..................................................24

6.3.2 Certificate that signs the biometric facial image..................................27

6.4 Security Object ..............................................................................................27

6.4.1 Data Integrity Check ...........................................................................27

6.4.2 Asymmetric Signature Conformance ..................................................28

6.4.3 Certificate that signs the Security Object ............................................29

7. Asymmetric Key Pairs..........................................................................................30

7.1 PIV Authentication Key..................................................................................30

7.1.1 Certificate Profile Conformance..........................................................30

7.1.2 Key Pair and Certificate Conformance................................................32

7.2 Digital Signature Key.....................................................................................33

7.2.1 Certificate Profile Conformance..........................................................33

7.2.2 Key Pair and Certificate Conformance................................................34

7.3 Key Management Key ...................................................................................35

7.3.1 Certificate Profile Conformance..........................................................35

7.3.2 Key Pair and Certificate Conformance................................................36

7.4 Card Authentication Key................................................................................37

7.4.1 Certificate Profile Conformance..........................................................37

7.4.2 Key Pair and Certificate Conformance................................................39

8. BER-TLV Test Assertions....................................................................................40

8.1 “Card Capabilities Container” Data Object ....................................................40

8.2 “Card Holder Unique Identifier” Data Object..................................................41

8.3 “X.509 Certificate for PIV Authentication” Data Object ..................................42

8.4 “Card Holder Fingerprints” Data Object.........................................................42

8.5 “Printed Information” Data Object..................................................................43

8.6 “Card Holder Facial Image” Data Object .......................................................43

8.7 “X.509 Certificate for Digital Signature” Data Object .....................................44

8.8 “X.509 Certificate for Key Management” Data Object....................................45

8.9 “X.509 Certificate for Card Authentication” Data Object ................................45

 Page vi
Special Publication 800-85B PIV Data Model Testing Specification

8.10 “Security Object” Data Object........................................................................46

9. Biometric Data Object Test Assertions ..............................................................48

9.1 CBEFF Patron Format for Fingerprint Template............................................48

9.1.1 CBEFF Structure for Fingerprint Template .........................................48

9.1.2 CBEFF Header for Fingerprint Template ............................................48

9.2 CBEFF Patron Format for Facial Image ........................................................57

9.2.1 CBEFF Structure for Facial Image......................................................57

9.2.2 CBEFF Header for Facial Image.........................................................57

9.3 Fingerprint Template .....................................................................................66

9.3.1 General Record Header Conformance ...............................................66

9.3.2 View Header Conformance.................................................................67

9.3.3 Fingerprint Minutiae Data ...................................................................68

9.4 Facial Image on PIV Card .............................................................................70

9.4.1 Facial Image Header Conformance....................................................70

9.4.2 Facial Image Data Conformance ........................................................70

10. Signed Data Elements Test Assertions..............................................................72

10.1 Card Holder Unique Identifier (CHUID) .........................................................72

10.1.1 Signature Block Contents ...................................................................72

10.1.2 Embedded Certificate .........................................................................80

10.2 Fingerprint Biometric .....................................................................................82

10.2.1 Signature Block Contents ...................................................................82

10.2.2 Embedded Certificate .........................................................................92

10.3 Facial Image Biometric ..................................................................................94

10.3.1 Signature Block Contents ...................................................................94

10.3.2 Embedded Certificate .......................................................................105

10.4 Security Object ............................................................................................107

10.4.1 Data Integrity ....................................................................................107

10.4.2 Signature Block Contents .................................................................107

11. PKI Certificate Profile Test Assertions.............................................................114

11.1 PIV Authentication Certificate......................................................................114

11.1.1 SP 800-78 Algorithms Conformance ................................................114

11.1.2 Data Integrity Checks .......................................................................116

11.2 Digital Signature Certificate .........................................................................123

 Page vii
Special Publication 800-85B PIV Data Model Testing Specification

11.2.1 SP 800-78 Algorithm Conformance ..................................................123

11.2.2 Data Integrity Checks .......................................................................125

11.3 Key Management Certificate .......................................................................129

11.3.1 SP 800-78 Algorithm Conformance ..................................................129

11.3.2 Data Integrity Checks .......................................................................131

11.4 Card Authentication Certificate (if the Card uses asymmetric key)..............135

11.4.1 SP 800-78 Algorithm Conformance ..................................................135

11.4.2 Data Integrity Checks .......................................................................137

List of Appendices 

Appendix A— DTRs to Test Assertion Mapping..................................................... A-1

A.1 BER-TLV Mapping....................................................................................... A-1

A.2 Biometric Data Mapping .............................................................................. A-2

A.3 CHUID Mapping .......................................................................................... A-4

A.4 Biometric Fingerprint Mapping..................................................................... A-6

A.5 Biometric Facial Image................................................................................ A-7

A.6 Security Object ............................................................................................ A-9

A.7 PIV Authentication Key................................................................................ A-9

A.8 Digital Signature Key................................................................................. A-11

A.9 Key Management Key ............................................................................... A-11

A.10 Card Authentication Key............................................................................ A-12

Appendix B— Bibliography ...................................................................................... B-1

Appendix C— Glossary of Terms and Acronyms................................................... C-1

C.1 Glossary of Terms ....................................................................................... C-1

C.2 Acronyms .................................................................................................... C-1

 Page viii
Special Publication 800-85B PIV Data Model Testing Specification

1. Introduction 

1.1

1.2 

 

Authority

This document has been developed by the National Institute of Standards and Technology (NIST) in 

furtherance of its statutory responsibilities under the Federal Information Security Management Act 

(FISMA) of 2002, Public Law 107-347. 

NIST is responsible for developing standards and guidelines, including minimum requirements, for 

providing adequate information security for all agency operations and assets, but such standards and 

guidelines shall not apply to national security systems. This recommendation is consistent with the 

requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), 

Securing Agency Information Systems, as analyzed in A-130, Appendix IV: Analysis of Key Sections. 

Supplemental information is provided in A-130, Appendix III. 

This recommendation has been prepared for use by Federal agencies. It may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright. Nothing in this 

document should be taken to contradict standards and guidelines made mandatory and binding on 

Federal agencies by the Secretary of Commerce under statutory authority. Nor should this 

recommendation be interpreted as altering or superseding the existing authorities of the Secretary of 

Commerce, Director of OMB, or any other Federal official. 

Purpose and Scope 

The Federal Information Processing Standard 201 (FIPS201) establishes a system for verifying an 

individual employee or contractor’s identity in a reliable, secure, and interoperable manner across the 

Federal government. Credentials are issued to individuals whose true identity has been verified and 

whose need for the credential has been established and authorized by proper authorities. FIPS201 also 

describes a variety of authentication mechanisms, including the use of cryptographic mechanisms and 

biometric data belonging to cardholders. 

In order to build the necessary Personal Identity Verification (PIV) infrastructure to support common 

unified processes and systems for government-wide use, there must be a robust testing framework to 

provide assurance that a particular component or system is compliant with FIPS201 and companion 

specifications. This test guidance document specifies the derived test requirements, detailed test 

assertions, and conformance tests for testing the data elements of the PIV system as per specifications 

laid out in FIPS201, SP80073, SP80076, and SP80078. 

This document does not provide conformance tests for any other software used in the PIV system such 

as the back-end access control software, card issuance software, and specialized service provider 

software. Specifically, this document does not provide test requirements for the PIV card interface, 

FIPS 140-2 validation, key generation and certificate binding, cryptographic algorithms, biometric 

enrollment and verification processes1

, performance of biometric products, and non-PIV aspects of 

external biometric standards and profiles. 

1

 Testing of biometric processing performance using measures such as False Accept Rate (FAR) is described in Section 7 of SP80076. 

 Page 1
Special Publication 800-85B PIV Data Model Testing Specification

This document provides technical guidance on the methodology to be used during testing applicable 

components, but does not provide normative guidance on which entities will execute the tests. Also, 

the test methodologies defined in this document are not designed to test business processes or to verify 

compliance with external applicable standards. For example, this document does not provide test 

guidance to determine how good a user’s Personal Identification Number (PIN) choice is or how 

access rights are granted to employees. 

1.3 Audience and Assumptions 

This document is targeted at vendors and integrators of PIV components, as well as the entities that 

will conduct tests on such components. Readers are assumed to have a working knowledge of FIPS201, 

PIV guidance, and applicable technologies. 

This document will: 

Enable developers of PIV components to develop their modules to be testable for requirements 

specified in FIPS201, SP80073, SP80076, and SP80078. 

Enable developers of PIV components to develop self-tests as part of the development effort. 

Enable testers to develop tests that cover the test suite provided in this document. 

 Page 2
Special Publication 800-85B PIV Data Model Testing Specification

2. Conformance Test Overview

The conformance testing guidelines in this document applies to the testing of a PIV data model. 

The data model requirements are extracted from FIPS201, SP80073, SP80076, and SP80078. This 

overview section provides a high level conformance test architecture for testing the PIV data 

model. The conformance test architecture is confined to the end result of a personalized PIV 

card. In other words, the conformance test approach views the card issuance system as a “black 

box,” meaning that the interface of that system is opaque and its implementation details are not 

relevant to the testing. The PIV data model testing operates under the assumption that the PIV 

card being tested has already been personalized as described in Sections 2.3 and 5.3 of FIPS201. 

The following sections provide the details of data model testing, test architecture, test 

methodology, and test areas. 

2.1 Test Architecture

The conceptual architecture for data model testing is shown in Figure 1. The conformance test in 

this document applies to the area highlighted with dashed lines. SP80085A addresses the writing 

and extracting of data from the card and subsequently, those processes are not addressed in this 

document. 

Figure 1: PIV Conformance Test Architecture 

The PIV data model defines the logical use of the on-card application space including the 

SP80073 required data objects and data elements along with the size and structure of each object.

Card Reader Driver 

Card Reader 

PIV Card Application 

PIV Data Model

PIV Card Command 

Interface 

Test Toolkit Application 

Host 

PC 

Smart Card 

Reader 

PIV CARD

(FIPS201, 

SP80073, 

SP80076, 

SP80078) 

 Page 3
Special Publication 800-85B PIV Data Model Testing Specification

The

Basic E endix A

of SP80

Confor Signature Block to Cryptographic Message Syntax (CMS) Signature format 

rofiles respectively for Card Holder Fingerprint 

frastructure (PKI) Certificates. 

.2 Test Methodology

he data model testing was developed through the following two-step process: 

reate derived test requirements (DTRs) — These are constructed from the data format and 

content requirements in FIPS201, SP80073, SP80076, and SP80078 specifications. 

+ Develop test assertions — These provide the tests that need to be performed to test each 

of the DTRs. The test assertions will include testing of data formats, values in the 

individual fields, relationship among values in multiple fields and validate the 

computations. Also, the test assertions include testing of the optional fields when they 

are present. 

igure 2 depicts the test methodology adopted to provide complete guidance for testing PIV 

conformant products. SP80085A provides the DTRs and test assertions for the interfaces to the 

PIV s he PIV middleware. This document provides DTRs and test assertions for 

Figure 2: PIV Test Methodology

PIV data model test includes the testing of the following aspects of PIV Data: 

ncoding Rules Tag-Length-Value (BER-TLV) Format Conformance as per App

073 for all objects. 

mance of the

for all signed objects. 

Conformance to Common Biometric Exchange Formats Framework (CBEFF) Profile and 

American National Standards Institute (ANSI) International Committee for Information 

Technology Standards (INCITS) 378 and 385 P

and Facial Image objects respectively. 

Conformance to Federal Identity Credentialing Committee (FICC) profiles for all Public Key 

In

2

T

C

F

mart card and t

the identity credentials stored on the PIV card. 

Inputs Process Outputs

FIPS 201

SP 800-73

SP 800-76

SP 800-78

NIST Test Guidan

Derived Test Requirements

&

Test Assertions

ce — SP 800-85A and SP 800-85B

Interface

Testing

Toolkit

Test Results

Data Model 

Testing

Toolkit

Inputs Process Outputs

FIPS 201 Derived Test Requirements

SP 800-73 &

SP 800-76

SP 800-78

NIST Test Guidan

Test Assertions

ce — SP 800-85A and SP 800-85B

Test Results

Interface

Testing

Toolkit

Data Model 

Testing

Toolkit

 Page 4
Special Publication 800-85B PIV Data Model Testing Specification

2.3 

nsmitted to the smart card reader. Examples of such 

compliant with 

T

requirements. Conformance criteria includes correct formatting and, when 

appropriate, context specific content. Additionally, conformance will be based on correct 

computation of content such as digital signatures. The DTRs and test assertions are designed to 

owing three statements are true for the objects: 

Field values are in accordance with the specifications, and 

h as signatures are accurate. 

re Blocks Conformance 

or all signed objects the fields in the signature block shall conform to the CMS syntax specified 

in FIPS201. 

Test Set-up

The test system consists of the following components: 

A test toolkit application software that resides on a personal computer. 

An ISO7816 and Personal Computer / Smart Card (PC/SC) compliant contact-based smart card 

reader. 

A mechanism to input PIN that can be tra

mechanisms are a PIN pad or a keyboard. 

A set of test personalized PIV cards whose applications and interfaces are

SP80073. All personalized biometric information is assumed to be collected and processed by 

template generation and matching implementations that have been tested against minimum

performance qualification criteria established by NIST, OMB, and by Federal agencies, as 

appropriate. 

2.4 est Areas

The test assertions in this document will validate that all PIV data objects conform to their 

respective

validate each PIV data object such that the foll

PIV containers are formatted correctly, 

Data consistency and value computations suc

Again, these requirements are not designed to test business processes or to verify external 

compliance with applicable standards. For further clarification of the document scope, refer to 

Section 1.2, Purpose and Scope. 

2.4.1 BER-TLV Format Conformance 

The tags and lengths in various data objects shall conform to specifications in Appendix A of

SP80073. 

2.4.2 Digital Signatu

F

 Page 5
Special Publication 800-85B PIV Data Model Testing Specification

2.4.3 Biometric Data Objects Conformance 

Holder Fingerprints and Facial Image (if present on the PIV 

card), shall conform to the common CBEFF Header format as well as to ANSI/INCITS 378 and 

ANSI/INCITS 385 profiles respectively. 

ell as the optional Digital Signature, Key 

Management, and Card Authentication (if asymmetric cryptography is used) Certificate shall 

The two biometric objects, Card

2.4.4 Certificate Profile Conformance 

The mandatory PIV Authentication Certificate as w

conform to the certificate profiles as specified in the X.509 Certificate and Certificate 

Revocation List (CRL) Extensions Profile for the Shared Service Providers (SSP) Program

(X509 Extensions). 

 Page 6
Special Publication 800-85B PIV Data Model Testing Specification

3. Test Methodology

3.1 Derived Test Requirements

ed based on the normative specifications in FIPS201 and 

hese specifications cover expected data object representations 

f the following:

— these include conditions 

y

the

nformation is identified by codes starting with ‘VE’ followed by a running sequence. 

Required Test Procedu — these are actions that the tes has to perform in order to satisfy 

ents stated in actual nclu ing the information 

“Required Vend ion s performing 

ome of th not itly for verification 

of information in the associated “Required Vend

implicitly assumed that such inform ovided by the vendor and verified by the tester. 

ocedures ar with owed by a running

sequence that denotes the section in this document where they occur. 

Validation of some DTRs are not ovided in this document. 

hese DTRs require compliance of a component with an external specification or standard such 

as EFTS. No required test procedures are provided for these DTRs, and a note is added to 

indicate that “this assertion is externally tested.” The tester is required to check the vendor 

documentation for claimed compliance with such requirements or confirm the presence of an 

external test/compliance certificate obtained from the test organization, when applicable. 

In some instances, testing of DTRs may not be feasible using the test methodologies described in 

this document. For example, a test tool built on these methods cannot test the procedure by 

which fingerprints are taken at an agency PIV installation. Most of these DTRs, however, can be 

tested by inspection of the system description document. Where this is the case, an adequate 

description is generally required by the VE section of the DTR. Where testing is not feasible, a 

note is added to indicate that “this assertion is not separately tested.” 

3.2 Test Assertions 

Test assertions are statements of behavior, action, or condition that can be measured or tested. 

They provide the procedures to guide the tester in executing and managing the test. They 

DTRs show the type of tests requir

supporting special publications. T

and content. Each DTR consists o

Actual condition statements taken/derived from the specification

for successful command execution for each command as well as exception behaviors explicitl

specified by statements using the words “shall,” “must,” and other normative delimiters in

standard. The condition statements are identified by codes starting with ‘AS’ followed by a 

running sequence. 

Required Vendor Information — these include information that the vendors (could also be

agencies or integrators) are mandated to provide in their documentation. The Required Vendor 

I

res ter 

the requirem condition statements. These i de verify

mandated in the or Information” for the condit as well a

software-based tests. S e required test procedures do

or Information.” In these instances it is 

ation is pr

call explic

The Required Test Pr e identified by codes starting ‘TE’ foll

 covered by the test assertions pr

T

 Page 7
Special Publication 800-85B PIV Data Model Testing Specification

include purpose of the test, starting conditions and prerequisites, success criteria, and post-test 

di le.

The following four sets of test assertions are included in this document — 

BERBiometric data object (Section 9)

 under PIV data model testing and are 

d DTR sections. Overall there is a many-to-many relationship from the 

ns with respect to tests. 

con tions, when applicab

TLV (Section 8) 

Signed data element (Section 10) 

PKI certificate profile (Section 11) 

All the test assertions provided in this document come

based on DTRs in Sections 4, 5, 6, and 7. Specifically, each test assertion makes specific 

references to the relate

test assertions to the DTRs (i.e., one test can map to many DTRs and one DTR can map to many

tests). To narrow the search space for cross references, Table 3-1 presents a cross-referencing 

guide showing the relevant DTR sections and test assertion sectio

Category/Classes of Test DTR Section(s) Test Assertion Section(s) 

(1) BER-TLV Section 4 (Derived from SP80073) Section 8 

(2) Biometric Data Section 5 (Derived from SP80076) Section 9 

(3) Signed Data Elements Section 6 (Derived from FIPS201 Section 10

and SP80078)

(4) PKI Certificate Profile Section 7 (Derived from FIPS201

and SP80078)

Section 11

Table 3-1. Cross-referencing Guide 

 Page 8
Special Publication 800-85B PIV Data Model Testing Specification

4. BER-TLV DTRs 

4.1 BER-TLV Testing 

AS04.01.01: Part 3 conformant cards shall return all the Tag-Length-Value (TLV) 

eleme physical order listed for that container in this data model. 

pecify in its documentation that the information provided 

e

container conforms to SP80073. 

01: The vendor shall specify in its documentation the tags and associated values in 

the CCC container. 

VE04.02.01.02: The vendor shall specify presence of the optional fields. 

f all the elements in CCC 

ginst the vendor provided 

4.3 Card Holder Unique Identifier (CHUID) 

ency Smart Credential Number (FASC-N) shall be consistent with the 

System

(TIG SCEPACS) Option for “System Code || Credential Number” to establish a credential

number space of 9,999,999,999 credentials. 

The Global Unique Identifier (GUID) field must be present, and may include either an 

35 and value is within the next five years. This field shall 

nts of a container in the

VE04.01.01.01: The vendor shall specify in its documentation the format (TLV) and the content

of all the elements in each data container on the card. 

VE04.01.01.02: The vendor shall s

conforms to SP80073. 

TE04.01.01.01: The tester shall validate that the formatting, encoding and the content of all th

elements in each data

4.2 Card Capability Container (CCC) 

AS04.02.01: The CCC shall identify the registered data model number 0x10. 

VE04.02.01.

TE04.02.01.01: The tester shall validate the format and the content o

data container on the card. Data read from the card will be validated a

data. 

TE04.02.01.02: The tester shall validate that the Registered Data Model value is 0x10. 

AS04.03.01: The CHUID on a PIV card shall meet the following requirements: 

The Federal Ag

Technical Implementation Guidance Smart Card Enabled Physical Access Control

issuer assigned IPv6 address or be coded as all zeros. The GUID is included to enable 

future migration away from the FASC-N into a robust numbering scheme for all issued 

credentials.

The Expiration Date is tagged 0x

be 8 bytes in length and shall be encoded as YYYYMMDD.

 Page 9
Special Publication 800-85B PIV Data Model Testing Specification

VE04.03.01.01: The vendor shall specify in its documentation the format (TLV) and the content 

container on the card.

VE04.03.01.02: The vendor shall specify presence of the optional fields. 

TE04 and the content of all the elements in 

CHU

in

BC. 

ents. 

that the length value after the tag is less than 

metric Facial 

e 0xBC within 

the container. 

e length shall not exceed 12,710 bytes. 

ir

ject

the

security object. 

all validate that the message digests for the various data objects 

are identical to the message digest of the data object itself. 

of all the elements in CHUID

.03.01.01: The tester shall validate the format

ID data container on the card.

4.4 Biometric Fingerprint 

AS04.04.01: The fingerprint buffer specify the primary and secondary fingerprints with

Tag value 0x

There are no vendor requirements. 

TE04.04.01.01: The tester shall validate that the fingerprint data follows the tag value 0xBC

within the container. 

AS04.04.02: The fingerprint template length shall not exceed 4,000 bytes. 

There are no vendor requirem

TE04.04.02.01: The tester shall validate 0xBC

4000 bytes. 

4.5 Bio

AS04.05.01: The facial image is preceded with tag value 0xBC. 

VE04.05.01.01: The vendor shall specify if the facial image is stored on the card. 

TE04.05.01.01: The tester shall validate that the facial image follows the tag valu

AS04.05.02: The facial imag

VE04.05.02.01: The vendor shall specify if the facial image is stored on the card in the

documentation. 

TE04.05.02.01: The tester shall validate that the length value is less than 12,710 bytes. 

4.6 Security Ob

AS04.06.01: The message digest produced as a result of a hash function on the contents of 

a data object buffer shall be identical to that data object’s message digest contained in

There are no vendor requirements. 

TE04.06.01.01: The tester sh

present in the security object

 Page 10
Special Publication 800-85B PIV Data Model Testing Specification

5. Biometric Data 

5.1 Common Header for PIV Biometric Data 

apply to both fingerprint template and facial image stored on the 

AS05.01.01: The CBEFF structure must comply with SP80076 Table 7, “Simple CBEFF 

ader must comply with SP80076 Table 8, “Patron Format PIV 

tester shall verify the values are consistent with Table 8 requirements of 

VE05.01.03.01: The vendor shall document the values of the CBEFF header fields. 

AS05.01.05: The biometric data block is digitally signed but not encrypted, and this shall 

ns field 

tion value is b00001101. 

at

Committee on Biometrics.

No requirements for vendor. 

The assertions in this section

PIV card. Facial image is an optional element on the PIV card and must be tested if present. 

Structure.”

VE05.01.01: The vendor shall specify if the optional facial image is stored on the PIV card. 

TE05.01.01.01: The tester shall verify that the CBEFF structure is implemented in accordance 

with Table 7 of SP80076. 

AS05.01.02: The CBEFF he

Specification.” 

No requirements for vendor. 

TE05.01.02.01: The tester shall verify the length of the Patron Format header. 

TE05.01.02.02: The

SP80076. 

AS05.01.03: Multi-byte integers in the CBEFF headers shall be in big-endian byte order. 

TE05.01.03.01: The tester shall compare value provided against the stored data. 

AS05.01.04: The Patron Header Version of the CBEFF Patron Format shall be 0x03. 

No requirements for vendor. 

TE05.01.04.01: The tester shall verify that the Patron Header Version value is 0x03. 

be reflected by setting the value of the Signature Block Header (SBH) security optio

to b00001101. 

No requirements for vendor. 

TE05.01.05.01: The tester shall verify that the SBH security op

AS05.01.06: For fingerprint and facial records, the Biometrick Data Block (BDB) Form

Owner shall be 0x001B denoting M1, the INCITS Technical

 Page 11
Special Publication 800-85B PIV Data Model Testing Specification

TE05.01.06.01: The tester shall verify that the BDB Format Owner field contains 0x001B. 

AS05.01.07: For the mandatory fingerprint template on the PIV card, the BDB Format

Type value shall be 0x0201. For the optional facial image on the PIV card, the BDB 

Format Type value shall be 0x0501. 

No requirements for vendor.

r fingerprint

ntation of "YYYYMMDDhhmmssZ". Each pair of characters (for example, "DD") 

is coded in 8 bits as an unsigned integer where the last byte is the binary representation of 

or.

with the assertion.

AS05.01.09: The Validity Period in the PIV Patron Format (Row 8 in Table 8 of SP80076) 

dates in compliance with the 

mplate and shall be 0x000002 for facial images. The value for other biometric 

en in CBEFF, 5.2.1.5. For modalities not listed there the value 

TE05 c Type field contains 0x000008 for

fingerprint im ages. 

BEFF

e b001xxxxx

Type value is b100xxxxx for

processed fingerprint template and b001xxxxx for facial image. 

TE05.01.07.01: The tester shall verify that the BDB Format Type field is 0x0201 fo

template and 0x0501 for facial image. 

AS05.01.08: The Creation Date in the PIV Patron Format (see Row 7 in Table 8 of SP80076) 

shall be the date of acquisition of the parent sample, encoded in eight bytes using a binary 

represe

the ASCII character Z which is included to indicate that the time is represented in 

Coordinated Universal Time (UTC). The field "hh" shall code a 24 hour clock value. 

No requirements for vend

TE05.01.08.01: The tester shall verify the date field is in compliance

contains two dates. 

No requirements for vendor. 

TE05.01.09.01: The tester shall verify that the headers contain two

assertion. 

AS05.01.10: Biometric Type field within the PIV Patron Format shall be 0x000008 for 

fingerprint te

modalities shall be that giv

shall be 0x00. 

No requirements for vendor. 

.01.10.01: The tester shall verify that the Biometri

ages or templates and 0x000002 for facial im

AS05.01.11: For the mandatory fingerprint template on the PIV card, the CBEFF

Biometric Data Type encoding value shall be b100xxxxx, which corresponds to biometric 

data that has been processed. For the optional facial image on the PIV card, the C

Biometric Data Type encoding value shall b

No requirements for vendor. 

TE05.01.11.01: The tester shall verify that the Biometric Data

 Page 12
Special Publication 800-85B PIV Data Model Testing Specification

AS05.01.12: For all biometric data whether stored on a PIV card or otherwise retained b

agencies the quality value shall be a s

y

igned integer between -2 and 100 per the text of 

pectation that the sample will 

ed

EFF field as -2.

te.

a facial

image. 

eld in the PIV Patron Format contains 18 bytes of which the 

18-K shall be a

erify the Creator field value. 

ype Encoding field in the PIV Patron Format shall contain the 25 

.01: The vendor shall provide the value for FASC-N.

TE05.01.14.01: The tester shall verify the FASC-N value. 

for future use” field in the PIV Patron Format shall contain 

TE05.01.15.01: The tester shall verify the “Reserved for future use” field is 0x00000000. 

Both finger’s template records shall be wrapped in a single CBEFF structure 

e is

constructed in accordance with this assertion. 

elf is tested in later assertions. 

INCITS 358. A value of -2 shall denote that assignment was not supported by the 

implementation; a value of -1 shall indicate that an attempt to compute a quality value

failed. Values from 0 to 100 shall indicate an increased ex

ultimately lead to a successful match. The zero value required by FACESTD shall be cod

in this CB

VE05.01.12.01: The vendor shall provide the quality values for the biometric data. 

TE05.01.12.01: The tester shall verify that the value of Biometric Data Quality is between -2 

and 100 for fingerprint templa

TE05.01.12.02: The tester shall verify that the value of Biometric Data Quality is -2 for

AS05.01.13: The Creator fi

first K <= 17 bytes shall be ASCII characters, and the first of the remaining

null terminator (zero). 

VE05.01.13.01: The vendor shall provide the value of Creator field. 

TE05.01.13.01: The tester shall v

AS05.01.14: The Data T

bytes of the FASC-N component of the CHUID identifier. 

VE05.01.14

AS05.01.15: The “Reserved

0x00000000. 

No requirement for vendor. 

5.2 Fingerprint Template for Storage on PIV Card 

AS05.02.01:

prior to storage on the PIV card. 

VE05.02.01.01: The vendor shall specify in its documentation the CBEFF structur

TE05.02.01.01: The tester shall parse the biometric data container to verify this assertion. 

Note: The CBEFF structure its

 Page 13
Special Publication 800-85B PIV Data Model Testing Specification

AS05.02.02: The fingerprint templates stored on the card are compliant to the MINUSTD

profile specified in SP80076, Table 3. 

late generator 

TE05.02.02.01: The tester shall verify that the resultant template is in compliance with the 

hall be 0x464D5200.

rify that the Format Identifier value is 0x464D5200. 

AS05.02.04: The Version Number of the General Header Record shall be 0x20323000. 

all verify that the Version Number is 0x20323000. 

AS05.02.05: The length of the entire CBEFF wrapped record shall fit within the container 

shall specify the length of the entire container which includes 

TE05.02.05.01: The tester shall verify that the size of the container is within the limits specified 

o fields ("Owner" and "Type") of the CBEFF Product 

1: The vendor shall provide the Owner and Type of CBEFF product identifier. 

bytes shall identify the version number of that supplier's minutiae detection 

algorithm. 

e of the General Record Header shall be 

1000b. 

all verify the Capture Equipment Complaince value is 1000b. 

VE05.02.02.01: The vendor shall specify in its documentation that the temp

generates templates in accordance with MINUSTD. 

assertion. 

AS05.02.03: The Format Identifier of the General Header Record s

No requirements for vendor. 

TE05.02.03.01: The tester shall ve

No requirements for vendor. 

TE05.02.04.01: The tester sh

size limits specified in SP80073. 

VE05.02.05.01: The vendor

CBEFF wrapped record. 

in SP80073. 

AS05.02.06: Both of the tw

Identifier shall be non-zero. 

VE05.02.06.0

TE05.02.06.01: The tester shall verify that the values are present and accurate. 

AS05.02.07: The two most significant bytes of each of the two fields ("Owner" and 

"Type") of the CBEFF Product Identifier shall identify the vendor, and the two least 

significant

VE05.02.07.01: The vendor shall specify the relevant version and vendor codes. 

TE05.02.07.01: The tester shall verify the values specified in the documentation. 

AS05.02.08: The Capture Equipment Complainc

No requirements for vendor 

TE05.02.08.01: The tester sh

 Page 14
Special Publication 800-85B PIV Data Model Testing Specification

AS05.02.09: The Capture Equiement ID of the General Record Header is greater than

zero. 

ize of Scanned Image in X Direction shall be the larger of the 

es. Similarly, the height on Size of Scanned Image in Y 

VE05.02.10.01: The vendor shall report width and height of the images whose fingerprint 

TE05.02.11.01: The tester shall verify the Number of Views value is 2. 

ed Byte of the General Header Record shall be 0. 

AS05 ngle Finger View Record shall be 0. 

No requirements for vendor 

pe of the Single Finger View Record shall be either 0 or 2. 

TE05.02.14.01: The tester shall verify the value is either 0 or 2 and is consistent with vendor 

s externally tested.

AS05.02.16: The Number of Minutiae of Single Finger View Record is between 0 and 128. 

No requirements for vendor. 

VE05.02.09.01: The vendor shall specify the Capture Equipment ID value. 

TE05.02.09.01: The tester shall verify the value is in accordance with vendor reporting. 

AS05.02.10: The width on S

widths of the two input imag

Direction shall be the larger of the heights of the two input images. 

templates are stored on the card. 

TE05.02.10.01: The tester shall verify the larger size of the two is recorded in the fields. 

AS05.02.11: The Number of Views of the General Header Record shall be 2. 

No requirements for vendor 

AS05.02.12: The Reserv

No requirements for vendor 

TE05.02.12.01: The tester shall verify the Reserved Byte value is 0. 

.02.13: The View Number of the Si

TE05.02.13.01: The tester shall verify the View Number value of the Single Finger View 

Record is 0. 

AS05.02.14: The Impression Ty

VE05.02.14.01: The vendor shall specify if the live or non-live scane images were used. 

reporting. 

AS05.02.15: The quality value of captured fingerprint images shall be computed using 

Error! Reference source not found. and reported as Q = 20(6-NFIQ). 

VE05.02.15.01: The vendor shall specify the procedure used to calculate the quality value. 

TE05.02.15.01: This assertion i

 Page 15
Special Publication 800-85B PIV Data Model Testing Specification

TE05.02.16.01: The tester shall verify the Number of Minutiae is between 0 and 128. 

AS05.02.17: Fingerprint templates shall be limited to minutiae of types "ridge ending"

"ridge bifurcation” unless it is n

and

ot possible to reliably distinguish between a ridge ending 

other" shall be assigned and ecoded as

ge. They shall not be recorded with respect to any image 

late creation process. 

VE05.02.18.01: The vendor shall specify in its documentation that the template generator 

for Extended Data Block Length for MINUSTD 

e of Extended Data Block Length is zero.

5.3 Facial Image Stored on PIV Card 

AS05.03.01: All facial images must conform with the requirements in SP80076 Table 6, 

“INCITS 385 Profile for PIV Facial Images.” 

VE05.03.01.01: The vendor shall include documentation of the procedure by which facial 

images are enrolled and retained. 

TE05.03.01.01: The tester shall review the documentation to verify compliance with the 

assertion. 

AS05.03.02: If facial imagery is stored on the PIV card, the length of the entire record 

shall fit within the container size limits specified in SP80073. 

VE05.03.02.01: The vendor shall include documentation of the procedure by which facial 

images are enrolled and retained. 

TE05.03.02.01: The tester shall verify that the size of the record is such that it will be in 

compliance with the assertion. 

and a bifurcation, in which case the category of "

00b. 

No requirements for vendor. 

TE05.02.17.01: The tester shall verify that the Minutiae Type is either 00b, 01b, or 10b.

AS05.02.18: All coordinates and angles for fingerprint minutiae shall be recorded with

respect to the original finger ima

processing sub-image(s) created during the temp

generates templates in accordance with this assertion. 

Note: This assertion is externally tested. 

AS05.02.19: The mandatory value

template shall be zero. 

No requirements for vendor. 

TE05.02.19.01: The tester shall verify that the valu

 Page 16
Special Publication 800-85B PIV Data Model Testing Specification

AS05.03.03: PIV facial images shall conform to the Full Frontal Image Type defined in 

VE05.03.03.01: The vendor shall include documentation of the procedure by which facial 

images are enrolled and retained. 

TE05.03.03.01: This assertion is externally tested. 

AS05.03.04: Facial image data shall be formatted in one of the two compression formats 

t

cumentation of the procedure by which facial 

ned. 

AS05.03.05: Facial images shall be compressed using a compression ratio no higher than 

hall be used with 

ace and 

n 24:1.

Section 8 of FACESTD. 

enumerated in Section 6.2 of FACESTD. Both whole-image and single-region-of-interes

(ROI) compression are permitted. 

VE05.03.04.01: The vendor shall include do

images are enrolled and retai

TE05.03.04.01: This assertion is externally tested. 

15:1. However, when facial images are stored on PIV cards, JPEG 2000 s

ROI compression in which the innermost region shall be centered on the f

compressed at no more tha

VE05.03.05.01: The vendor shall include documentation of the procedure by which facial

images are enrolled and retained. 

TE05.03.05.01: This assertion is externally tested. 

 Page 17
Special Publication 800-85B PIV Data Model Testing Specification

6. Signed Data Elements

6.1 Card Holder Unique Identifier 

6.1.1 Asymmetric Signature Conformance

AS06.01.01: The CHUID buffer shall contain an Asymmetric digital signature of the 

CHUID object, which has been encoded as a Cryptographic Message Syntax external 

and has been formatted correctly as a CMS external signature as defined in RFC 3852. 

digital signature is implemented as a SignedData Type. 

implemented as a SignedData type. 

3.

ion of the SignedData type is version 3. 

e tester shall validate that the digest algorithm is based on the expiration date 

ordance with Table 3-3 of SP80078. 

No requirement for vendor. 

digital signature as defined in RFC 3852. 

No requirement for vendor. 

TE06.01.01.01: The tester shall validate that the CHUID data buffer contains a digital signature 

AS06.01.02: The

No requirement for vendor. 

TE06.01.02.01: The tester shall validate that the CMS external digital signature has been 

AS06.01.03: The value of the version field of the SignedData content type shall be v

No requirement for vendor. 

TE06.01.03.01: The tester shall validate the vers

AS06.01.04: The digestAlgorithms field of the SignedData content type shall be in 

accordance with Table 3-3 of SP80078. 

No requirement for vendor. 

TE06.01.04.01: Th

of the PIV card and is in acc

AS06.01.05: The eContentType of the encapContentInfo shall be id-PIVCHUIDSecurityObject (OID = 2.16.840.1.101.3.6.1). 

No requirement for vendor. 

TE06.01.05.01: The tester shall validate that eContentType of the encapContentInfo asserts the 

id-PIV-CHUIDSecurityObject OID. 

AS06.01.06: The encapContentInfo of the SignedData content type shall omit the eContent

field. 

 Page 18
Special Publication 800-85B PIV Data Model Testing Specification

TE06.01.06.01: The tester shall validate that the eContent field has been omitted from the 

encapContentInfo. 

AS06.01.07: The certificates field shall include only a single X.509 certificate which is u

to verify the signature in the SignerInfo field.

No requirement for vendor. 

sed

all validate that there is a single X.509 certificate in the certificates 

Data.

xists in the SignedData.

for the sid

t signed the CHUID.

TE06.01.10.01: The tester shall validate that the issuerAndSerialNumber choice has been used 

s to the issuer and serialNumber fields found in the 

d the CHUID.

AS06.01.11: The SignerInfo type shall specify a digestAlgorithm in accordance with Table 

all validate that the digest algorithm is based on the expiration date 

AS06.01.12: The signedAttrs of the SignerInfo shall include the MessageDigest (OID = 

ntent 

ent for vendor. 

all validate the presence of a MessageDigest attribute in the signed 

TE06.01.07.01: The tester sh

field that can verify the digital signature in the SignerInfo. 

AS06.01.08: The crls field from the SignedData content type shall be omitted. 

No requirement for vendor. 

TE06.01.08.01: The tester shall validate that the crls field has been omitted from the Signed

AS06.01.09: The SignerInfos in the SignedData content type shall contain only a single 

SignerInfo type. 

No requirement for vendor. 

TE06.01.09.01: The tester shall validate that only a single SignerInfo e

AS06.01.10: The SignerInfo type shall use the issuerAndSerialNumber choice

and this shall correspond to the issuer and serialNumber fields found in the X.509 

certificate for the entity tha

No requirement for vendor. 

for the SignerIdentifier and it correspond

X.509 certificate for the entity that signe

3-3 of SP 800-78. 

No requirement for vendor. 

TE06.01.11.01: The tester sh

of the PIV card and is in accordance with Table 3-3 of SP80078. 

1.2.840.113549.1.9.4) attribute containing the hash computed over the concatenated co

of the CHUID, excluding the asymmetric signature field. 

No requirem

TE06.01.12.01: The tester sh

attributes. 

 Page 19
Special Publication 800-85B PIV Data Model Testing Specification

TE06.01.12.02: The tester shall validate the value of the MessageDigest attribute against the 

hash of the concatenated content of the CHUID, excluding the asymmetric signature field. 

AS06.01.13: The signedAttrs of the SignerInfo shall include the pivSigner-DN (OID = 

subject name that appears in the X.509 

certificate for the entity that signed the CHUID. 

attribute in the signed 

ttribute is the same as 

AS06.01.14: The signatureAlgorithm field specified in the SignerInfo field shall be in 

tion date in

of SP 800-78.

ate that the signature algorithm is based on the expiration 

date of the certificate and is in accordance with Table 3-4 of SP80078. 

e digital signature.

al

7.2.1 the following shall be met. 

.101.3.6.7).

validate that the certificate that was used to sign the CHUID 

gning OID in the extended key usage extension. 

by the expiration of the Card in accordance with Table 3-3 of 

SP 800-78. 

hall validate that the public key size is in accordance with Table 3-3 

2.16.840.1.101.3.6.5) attribute containing the

No requirement for vendor. 

TE06.01.13.01: The tester shall validate the presence of a pivSigner-DN

attributes. 

TE06.01.13.02: The tester shall validate the value of the pivSigner-DN a

the subject name that appears in the certificate that signed the CHUID. 

accordance with Table 3-4 of SP 800-78 and based on the PIV card expira

accordance with Table 3-3

No requirement for vendor. 

TE06.01.14.01: The tester shall valid

AS06.01.15: The SignedData content type shall include th

No requirement for vendor. 

TE06.01.15.01: The tester shall validate that the SignedData content type includes the digit

signature corresponding to the CHUID. 

6.1.2 Certificate that signs the CHUID 

In addition to the requirements from Section

AS06.01.16: The digital signature certificate used to sign the CHUID shall in the 

extKeyUsage assert id-PIV-content-signing (OID = 2.16.840.1

No requirement for vendor. 

TE06.01.16.01: The tester shall

asserts the id-PIV-content-si

AS06.01.17: The size of the public key for digital signature certificate used to sign the 

CHUID shall be determined

No requirement for vendor. 

TE06.01.17.01: The tester s

of SP80078. 

 Page 20
Special Publication 800-85B PIV Data Model Testing Specification

6.2 Biometric Fingerprint 

URE_BLOCK shall be encoded as a Cryptographic 

tly as a CMS external signature as

AS06.02.02: The digital signature is implemented as a SignedData Type. 

all validate that the CMS external digital signature has been 

v3

the certificates field is omitted or not. 

version 3 depending on whether the certificates field is omitted.

AS06.02.05: The eContentType of the encapContentInfo shall be id-PIV-biometricObject 

vendor.

all validate that eContentType of the encapContentInfo asserts the 

AS06.02.06: The encapContentInfo of the SignedData content type shall omit the eContent 

field. 

No requirement for vendor. 

6.2.1 Asymmetric Signature Conformance

AS06.02.01: The CBEFF_SIGNAT

Message Syntax external digital signature as defined in RFC 3852. 

No requirement for vendor. 

TE06.02.01.01: The tester shall validate that the digital signature in the 

CBEFF_SIGNATURE_BLOCK has been formatted correc

defined in RFC 3852. 

No requirement for vendor. 

TE06.02.02.01: The tester sh

implemented as a SignedData type. 

AS06.02.03: The value of the version field of the SignedData content type shall be v1 or

based on whether

No requirement for vendor. 

TE06.02.03.01: The tester shall validate the version of the SignedData type is version 1 or 

AS06.02.04: The digestAlgorithms field of the SignedData content type shall be in 

accordance with Table 3-3 of SP 800-78. 

No requirement for vendor. 

TE06.02.04.01: The tester shall validate that the digest algorithm is based on the expiration date

of the PIV card and is in accordance with Table 3-3 of SP80078. 

(OID = 2.16.840.1.101.3.6.2). 

No requirement for

TE06.02.05.01: The tester sh

id-PIV-biometricObject OID. 

 Page 21
Special Publication 800-85B PIV Data Model Testing Specification

TE06.02.06.01: The tester shall validate that the eContent field has been omitted from the 

encapContentInfo. 

AS06.02.07: If the signature on the fingerprint biometric was generated with a different 

field shall be omitted. 

e

ates

e that the certificate in 

ID can verify the digital signature in the SignerInfo. 

m the SignedData.

le

.

ed

the to the issuer and serialNumber fields found in 

entity that signed the biometric data. 

all validate that the digest algorithm in the SignerInfo is based on 

key as the signature on the CHUID, the certificates field shall include only a single 

certificate in the SignerInfo field which can be used to verify the signature; else the 

certificates

VE06.02.07.01: The vendor shall state whether or not the same certificate was used to sign th

CHUID and the Biometrics. 

TE06.02.07.01: The tester shall validate that there is a single X.509 certificate in the certific

field that can verify the digital signature in the SignerInfo. 

TE06.02.07.02: If the certificates field is omitted, the tester shall validat

the SignedData for the CHU

AS06.02.08: The crls field from the SignedData content type shall be omitted. 

No requirement for vendor. 

TE06.02.08.01: The tester shall validate that the crls field has been omitted fro

AS06.02.09: The signerInfos in the SignedData content type shall contain only a sing

SignerInfo type. 

No requirement for vendor. 

TE06.02.09.01: The tester shall validate that only a single SignerInfo exists in the SignedData

AS06.02.10: The SignerInfo type shall use the issuerAndSerialNumber choice for the sid 

and this shall correspond to the issuer and serialNumber fields found in the X.509 

certificate for the entity that signed the biometric data. 

No requirement for vendor. 

TE06.02.10.01: The tester shall validate that the issuerAndSerialNumber choice has been us

for the SignerIdentifier and it corresponds to

the X.509 certificate for the

AS06.02.11: The SignerInfo type shall specify a digestAlgorithm in accordance with Table 

3-3 of SP 800-78. 

No requirement for vendor. 

TE06.02.11.01: The tester sh

the expiration date of the PIV card and is in accordance with Table 3-3 of SP80078. 

 Page 22
Special Publication 800-85B PIV Data Model Testing Specification

AS06.02.12: The signedAttrs of the SignerInfo shall include the MessageDigest (OID =

EFF_HEADER

in the signed

TE06.02.13.02: The tester shall validate the value of the pivSigner-DN attribute is the same as 

the su the certificate that signed the biometric data. 

fo shall include the pivFASC-N (OID = 

2.16.840.1.101.3.6.6) attribute containing the FASC-N of the PIV card. 

ttribute in the signed 

ibute is the same as the 

AS06.02.15: The signatureAlgorithm field specified in the SignerInfo field shall be in 

tion date in

of SP 800-78.

ate that the signature algorithm is based on the expiration 

date of the PIV card and is in accordance with Table 3-4 of SP80078. 

e digital signature.

al

1.2.840.113549.1.9.4) attribute containing the hash of the concatenated CB

and the STD_BIOMETRIC_RECORD. 

No requirement for vendor. 

TE06.02.12.01: The tester shall validate the presence of a MessageDigest attribute

attributes. 

TE06.02.12.02: The tester shall validate the value of the MessageDigest attribute against the 

hash of the concatenated CBEFF_HEADER and the STD_BIOMETRIC_RECORD. 

AS06.02.13: The signedAttrs of the SignerInfo shall include the pivSigner-DN (OID = 

2.16.840.1.101.3.6.5) attribute containing the subject name that appears in the X.509 

certificate for the entity that signed the fingerprint biometric data. 

No requirement for vendor. 

TE06.02.13.01: The tester shall validate the presence of a pivSigner-DN attribute in the signed 

attributes. 

bject name that appears in

AS06.02.14: The signedAttrs of the SignerIn

No requirement for vendor. 

TE06.02.14.01: The tester shall validate the presence of a pivFASC-N a

attributes. 

TE06.02.14.02: The tester shall validate the value of the pivFASC-N attr

FASC-N that is present in the CHUID. 

accordance with Table 3-4 of SP 800-78 and based on the PIV card expira

accordance with Table 3-3

No requirement for vendor. 

TE06.02.15.01: The tester shall valid

AS06.02.16: The SignedData content type shall include th

No requirement for vendor. 

TE06.02.16.01: The tester shall validate that the SignedData content type includes the digit

signature corresponding to the signed biometric data. 

 Page 23
Special Publication 800-85B PIV Data Model Testing Specification

6.2.2 Certificate that signs the biometric fingerpint 

In addition to the requirements from Section 7.2.1 the following shall be met. 

40.1.101.3.6.7).

validate that the certificate that was used to sign the fingerprint 

e extended key usage extension. 

d by the expiration of the Card in accordance with Table 3-3 

of SP 800-78. 

te that the public key size is in accordance with Table 3-3 

cial Image

hic

nature as defined in RFC 3852.

tly as a CMS external signature as

AS06.03.02: The digital signature is implemented as a SignedData Type. 

all validate that the CMS external digital signature has been 

v3

the certificates field is omitted or not. 

version 3 depending on whether the certificates field is omitted.

AS06.02.17: The digital signature certificate used to sign PIV fingerprint biometric shall in

the extKeyUsage assert id-PIV-content-signing (OID = 2.16.8

No requirement for vendor. 

TE06.02.17.01: The tester shall

biometric data asserts the id-PIV-content-signing OID in th

AS06.02.18: The size of the public key for digital signature certificate used to sign the 

biometrics shall be determine

No requirement for vendor. 

TE06.02.18.01: The tester shall valida

of SP80078. 

6.3 Biometric Fa

6.3.1 Asymmetric Signature Conformance

AS06.03.01: The CBEFF_SIGNATURE_BLOCK shall be encoded as a Cryptograp

Message Syntax external digital sig

No requirement for vendor. 

TE06.03.01.01: The tester shall validate that the digital signature in the 

CBEFF_SIGNATURE_BLOCK has been formatted correc

defined in RFC 3852. 

No requirement for vendor. 

TE06.03.02.01: The tester sh

implemented as a SignedData type. 

AS06.03.03: The value of the version field of the SignedData content type shall be v1 or

based on whether

No requirement for vendor. 

TE06.03.03.01: The tester shall validate the version of the SignedData type is version 1 or 

 Page 24
Special Publication 800-85B PIV Data Model Testing Specification

AS06.03.04: The digestAlgorithms field of the SignedData content type shall be in 

accordance with Table 3-3 of SP 800-78. 

No requirement for vendor. 

TE06.03.04.01: The tester shall validate that the digest algorithm is based on the expiration date 

all be id-PIV-biometricObject 

(OID = 2.16.840.1.101.3.6.2). 

all validate that eContentType of the encapContentInfo asserts the 

.

he eContent 

field. 

e eContent field has been omitted from the 

signature on the CHUID, the certificates field shall include only a single 

No requirement for vendor. 

ates

ates field is omitted, the tester shall validate that the certificate in 

ID can verify the digital signature in the SignerInfo. 

: The crls field from the SignedData content type shall be omitted. 

 the SignedData.

le

of the PIV card and is in accordance with Table 3-3 of SP80078. 

AS06.03.05: The eContentType of the encapContentInfo sh

No requirement for vendor. 

TE06.03.05.01: The tester sh

id-PIV-biometricObject OID

AS06.03.06: The encapContentInfo of the SignedData content type shall omit t

No requirement for vendor. 

TE06.03.06.01: The tester shall validate that th

encapContentInfo. 

AS06.03.07: If the signature on the facial image biometric was generated with a different 

key as the

certificate in the SignerInfo field which can be used to verify the signature; else the 

certificates field shall be omitted. 

TE06.03.07.01: The tester shall validate that there is a single X.509 certificate in the certific

field that can verify the digital signature in the SignerInfo. 

TE06.03.07.02: If the certific

the SignedData for the CHU

AS06.03.08

No requirement for vendor. 

TE06.03.08.01: The tester shall validate that the crls field has been omitted from

AS06.03.09: The signerInfos in the SignedData content type shall contain only a sing

SignerInfo type. 

No requirement for vendor. 

TE06.03.09.01: The tester shall validate that only a single SignerInfo exists in the SignedData. 

 Page 25
Special Publication 800-85B PIV Data Model Testing Specification

AS06.03.10: The SignerInfo type shall use the issuerAndSerialNumber choice for the s

and this shall correspond to the issuer and serialNumber fields found in the X.509 

certificate for the entity that signed the bi

id

ometric data.

ber fields found in the 

X.509 certificate for the entity that signed the biometric data. 

o type shall specify a digestAlgorithm in accordance with Table 

TE06.03.11.01: The tester shall validate that the digest algorithm in the SignerInfo is based on 

with Table 3-3 of SP80078. 

1.2.840.113549.1.9.4) attribute containing the hash of the concatenated CBEFF_HEADER 

all validate the presence of a MessageDigest attribute in the signed 

hash of the concatenated CBEFF_HEADER and the STD_BIOMETRIC_RECORD. 

.3.6.5) attribute containing the subject name that appears in the X.509 

t signed the biometric data. 

01: The tester shall validate the presence of a pivSigner-DN attribute in the signed 

attributes. 

TE06.03.13.02: The tester shall validate the value of the pivSigner-DN attribute is the same as 

rtificate that signed the biometric data. 

or vendor.

all validate the presence of a pivFASC-N attribute in the signed 

 as the 

ASC-N that is present in the CHUID. 

No requirement for vendor. 

TE06.03.10.01: The tester shall validate that the issuerAndSerialNumber choice has been used 

for the SignerIdentifier and it corresponds to the issuer and serialNum

AS06.03.11: The SignerInf

3-3 of SP 800-78. 

No requirement for vendor. 

the expiration date of the PIV card and is in accordance

AS06.03.12: The signedAttrs of the SignerInfo shall include the MessageDigest (OID = 

and the STD_BIOMETRIC_RECORD. 

No requirement for vendor. 

TE06.03.12.01: The tester sh

attributes. 

TE06.03.12.02: The tester shall validate the value of the MessageDigest attribute against the

AS06.03.13: The signedAttrs of the SignerInfo shall include the pivSigner-DN (OID = 

2.16.840.1.101

certificate for the entity tha

No requirement for vendor. 

TE06.03.13.

the subject name that appears in the ce

AS06.03.14: The signedAttrs of the SignerInfo shall include the pivFASC-N (OID = 

2.16.840.1.101.3.6.6) attribute containing the FASC-N of the PIV card. 

No requirement f

TE06.03.14.01: The tester sh

attributes. 

TE06.03.14.02: The tester shall validate the value of the pivFASC-N attribute is the same

F

 Page 26
Special Publication 800-85B PIV Data Model Testing Specification

AS06.03.15: The signatureAlgorithm field specified in the SignerInfo field shall be in 

accordance with Table 3-4 of SP 800-78 and based on the PIV card expiration date in 

.

all validate that the signature algorithm is based on the expiration 

AS06.03.16: The SignedData content type shall include the digital signature. 

all validate that the SignedData content type includes the digital 

6.3.2 Certificate that signs the biometric facial image 

shall

in the extKeyUsage assert id-PIV-content-signing (OID = 2.16.840.1.101.3.6.7). 

used to sign the facial image 

e extended key usage extension. 

rtificate used to sign the 

biometrics shall be determined by the expiration of the card in accordance with Table 3-3 

dor.

hall validate that the public key size is in accordance with Table 3-3 

6.4 Security Object 

all validate that the message digests for the various data objects 

are identical to the message digest of the data object itself. 

accordance with Table 3-3 of SP 800-78. 

No requirement for vendor

TE06.03.15.01: The tester sh

date of the PIV card and is in accordance with Table 3-4 of SP80078. 

No requirement for vendor. 

TE06.03.16.01: The tester sh

signature corresponding to the signed biometric data. 

In addition to the requirements from Section 7.2.1 the following shall be met. 

AS06.03.17: The digital signature certificate used to sign PIV facial image biometric

No requirement for vendor. 

TE06.03.17.01: The tester shall validate that the certificate that was 

biometric data asserts the id-PIV-content-signing OID in th

AS06.03.18: The size of the public key for digital signature ce

of SP 800-78. 

No requirement for ven

TE06.03.18.01: The tester s

of SP80078. 

6.4.1 Data Integrity Check 

AS06.04.01: The message digest produced as a result of a hash function on the contents of a 

data object buffer shall be identical to that data object’s message digest contained in the

security object. 

No requirement for vendor. 

TE06.04.01.01: The tester sh

present in the security object

 Page 27
Special Publication 800-85B PIV Data Model Testing Specification

6.4.2 Asymmetric Signature Conformance

AS06.04.02: The security object buffer shall contain an asymmetric digital signature as 

all validate that the digital signature has been formatted correctly as 

AS06.04.03: The digital signature is implemented as a SignedData Type. 

ion 1.

eld of the SignedData content type shall be in 

digest algorithm is based on the expiration date 

of the PIV card and is in accordance with Table 3-7 of SP80078. 

f the encapContentInfo shall be id-icao-ldsSecurityObject 

ContentType of the encapContentInfo asserts the 

id-icao-ldsSecurityObject OID. 

AS06.04.07: The eContent of the encapContentsInfo field shall contain the encoded 

contents of the ldsSecurity object.

No requirement for vendor. 

TE06.04.07.01: The tester shall validate that eContent of the encapContentInfo contains the 

contents of the ldsSecurity object. 

AS06.04.08: The certificates field shall be omitted since it is included in the CHUID. 

No requirement for vendor. 

specified in RFC (3852). 

No requirement for vendor. 

TE06.04.02.01: The tester sh

a CMS signature as defined in RFC (3852). 

No requirement for vendor. 

TE06.04.03.01: The tester shall validate that the CMS digital signature has been implemented as 

a SignedData type. 

AS06.04.04: The value of the version field of the SignedData content type shall be v1. 

No requirement for vendor. 

TE06.04.04.01: The tester shall validate the version of the SignedData type is vers

AS06.04.05: The digestAlgorithms fi

accordance with Table 3-7 of SP 800-78. 

No requirement for vendor. 

TE06.04.05.01: The tester shall validate that the

AS06.04.06: The eContentType o

(OID = 1.3.27.1.1.1). 

No requirement for vendor. 

TE06.04.06.01: The tester shall validate that e

 Page 28
Special Publication 800-85B PIV Data Model Testing Specification

TE06.04.08.01: The tester shall validate that the certificates field has been omitted from the 

AS06.04.09: The digestAlgorithm field specified in the SignerInfo field is in accordance 

with

TE06.04.09.01: The tester shall validate that the digest algorithm in the SignerInfo is based on 

ignerInfo field shall be in 

based on the expiration

date of the certificate and is in accordance with Table 3-4 of SP80078. 

er’s digital signature key used to sign the CHUID shall also be 

used to sign the security object. 

SignedData. 

Table 3-7 of SP 800-78.

No requirement for vendor. 

the expiration date of the PIV card and is in accordance with Table 3-7 of SP80078. 

AS06.04.10: The signatureAlgorithm field specified in the S

accordance with Table 3-4 of SP 800-78 and based on the PIV card expiration date in 

accordance with Table 3-3 of SP 800-78. 

No requirement for vendor. 

TE06.04.10.01: The tester shall validate that the signature algorithm is

AS06.04.11: The SignedData content type shall include the digital signature. 

No requirement for vendor. 

TE06.04.11.01: The tester shall validate that the SignedData content type includes the digital 

signature corresponding to the signed security object. 

6.4.3 Certificate that signs the Security Object 

AS06.04.12: The card issu

No requirement for vendor. 

TE06.04.12.01: The tester shall validate that the certificate in the SignedData for the CHUID can 

verify the digital signature in the SignerInfo. 

 Page 29
Special Publication 800-85B PIV Data Model Testing Specification

7. Asymmetric Key Pairs 

7.1 PIV Authentication Key

7.1.1 Certificate Profile Conformance 

AS07.01.01: The signature field in the certificate shall specify an algorithm in the 

VE07.01.01.01: The vendor shall specify in its documentation the algorithms used to sign 

rithm is based on the expiration 

an (RSA) with Probabilistic Signature Scheme (PSS) 

Algorithm (ECDSA), the parameters field is absent. 

800-78.

can

. 

e appropriate OID from Table 3-6 of SP

f the

lgorithm used to generate 

the key pair. 

AlgorithmIdentifier in accordance with Table 3-4 of SP 800-78 and based on the certificate 

expiration date in accordance with Table 3-3 of SP 800-78. 

certificates issued. 

TE07.01.01.01: The tester shall validate that the signature algo

date of the certificate and is in accordance with Table 3-4 of SP80078. 

AS07.01.02: If Rivest Shamir Adlem

padding is used, the parameters field of the AlgorithmIdentifier type shall assert Secure 

Hash Algorithm (SHA) 256 (OID = 2.16.840.1.101.3.4.2.1). For the other RSA algorithms, 

the parameters field is populated with NULL. For Elliptic Curve Digital Signature 

VE07.01.02.01: The vendor shall specify in its documentation the permitted values of the 

AlgorithmIdentifier field based on the signature algorithm used to sign certificates issued. 

TE07.01.02.01: The tester shall validate that the correctness of the values of the

AlgorithmIdentifier fields. 

AS07.01.03: The subjectPublicKeyInfo field shall assert an algorithm in the 

AlgorithmIdentifier in accordance with Table 3-5 of SP

VE07.01.03.01: The vendor shall specify in its documentation the applicable algorithms that

be used to generate PIV authentication keys. 

TE07.01.03.01: The tester shall validate that the algorithm used to generate PIV authentication 

keys are in accordance with Table 3-5 of SP80078

AS07.01.04: If the public key algorithm is Elliptic Curve, then the EcpkParameters field

uses either the namedCurve field populated with th

800-78 or the implicitlyCA choice. 

VE07.01.04.01: The vendor shall specify in its documentation the allowed values o

parameters field of the algorithm of the subjectPublicKeyInfo field as part of the PIV 

authentication certificate profile. These values shall be based on the a

 Page 30
Special Publication 800-85B PIV Data Model Testing Specification

TE07.01.04.01: The tester shall validate the correctness of the values of the parameters field of

the algorithm of the subjectPublicKeyInfo field in the PIV authentication certificate issued by the

vendor. 

assert only the digitalSignature bit. No other bits 

ocumentation the assertion of the 

digitalSignature bit in the keyUsage extension as part of the PIV authentication certificate 

TE07.01.05.01: The tester shall validate the assertion of the digitalSignature bit in the keyUsage 

licies extension which asserts the id-fki-common-authentication OID as part of the 

PIV authentication certificate profile.

in the PIV authentication certificate issued by the vendor. 

te Status

Protocol (OCSP) Server distributing status information for this certificate. 

 part of the PIV authentication certificate 

essLocation for this accessMethod uses the URI name form to 

authorityInfoAccess extension in the PIV authentication certificate issued by the vendor. The 

e form

hall be populated in the subjectAltName extension using the 

on the inclusion of the FASC-N in

on certificate issued by the vendor. 

AS07.01.05: The keyUsage extension shall

shall be asserted. 

VE07.01.05.01: The vendor shall specify in its d

profile. 

extension in the PIV authentication certificate issued by the vendor. 

AS07.01.06: The policyIdentifier field in the certificatePolicies must assert id-fpkicommon-authentication (OID = 2.16.840.1.101.3.2.1.3.13).

VE07.01.06.01: The vendor shall specify in its documentation the inclusion of the 

certificatePo

TE07.01.06.01: The tester shall validate the presence of the id-fki-common-authentication OID 

in the certificatePolicies extension

AS07.01.07: The authorityInfoAccess field shall contain an id-ad-ocsp accessMethod. The 

access location uses the Uniform Resource Identifier (URI) name form to specify the 

location of an Hypertext Transfer Protocol (HTTP) accessible Online Certifica

VE07.01.07.01: The vendor shall specify in its documentation the inclusion of an id-ad-ocsp 

accessMethod in the authorityInfoAccess extension as

profile. Additionally, the acc

specify the location of an HTTP accessible OCSP server. 

TE07.01.07.01: The tester shall validate the presence of an id-ad-ocsp accessMethod in the 

tester shall also validate that the accessLocation for this accessMethod uses the URI nam

and points to an HTTP accessible OCSP server.

AS07.01.08: The FASC-N s

pivFASC-N attribute (OID = 2.16.840.1.101.3.6.6). 

VE07.01.08.01: The vendor shall specify in its documentati

the subjectAltName extension as part of the PIV authentication certificate profile. 

TE07.01.08.01: The tester shall validate the presence of the FASC-N in the subjectAltName

extension in the PIV authenticati

 Page 31
Special Publication 800-85B PIV Data Model Testing Specification

AS07.01.09 The piv-interim extension (OID = 2.16.840.1.101.3.6.9.1) shall be present and 

contain an interim_indicator field which is populated with a Boolean value. This extension 

is not critical. 

VE07.01.09.01: The vendor shall specify in its documentation the use of this extension as part 

of the PIV authentication certificate profile. 

that the piv-interim extension is present in the PIV 

authentication certificate issued by the vendor. 

he

ertificate in accordance with Table 3-1 of SP 800-78. 

ce with Table 3-1

thentication

ion certificate

at the FASC-N in the subjectAltName field in the PIV 

AS07.01.13: The expiration of the PIV authentication certificate is not beyond the 

te that the expiration of the PIV authentication certificate 

al

d

nerating an RSA key pair for PIV authentication. 

TE07.01.09.01: The tester shall validate

7.1.2 Key Pair and Certificate Conformance 

AS07.01.10: The size of the public key for PIV authentication shall be determined by t

expiration of the c

VE07.01.10.01: The vendor shall specify in its documentation the allowable public key size to 

be used while generating PIV authentication keys. 

TE07.01.10.01: The tester shall validate that the public key size is in accordan

of SP80078. 

AS07.01.11: The public key present in the PIV authentication certificate correspond to the 

PIV authentication private key. 

No requirement for vendor. 

TE07.01.11.01: The tester shall validate that the public key present in the PIV au

certificate is part of the key pair corresponding to the private key on the PIV card. 

AS07.01.12: The FASC-N in the subjectAltName field in the PIV authenticat

is the same as the FASC-N present in the CHUID. 

No requirement for vendor. 

TE07.01.12.01: The tester shall validate th

authentication certificate is the same as the FASC-N present in the CHUID in the PIV card. 

expiration of the CHUID. 

No requirement for vendor. 

TE07.01.13.01: The tester shall valida

is not beyond the expiration of the CHUID in the PIV card. 

AS07.01.14: If the public key algorithm is RSA, the exponent shall be greater than or equ

to 65,537. 

VE07.01.14.01: The vendor shall specify in its documentation the size of the exponent permitte

while ge

 Page 32
Special Publication 800-85B PIV Data Model Testing Specification

TE07.01.14.01: The tester shall validate that the RSA public key exponent size is gr

equal to 65,537. 

eater than or

.01: The signature field in the certificate shall specify an algorithm in the 

AlgorithmIdentifier in accordance with Table 3-4 of SP 800-78 and based on the certificate 

3 of SP 800-78.

VE07.02.01.01: The vendor shall specify in its documentation the algorithms used to sign 

d on the expiration

rameters field is populated with NULL. For ECDSA, the 

ll specify in its documentation the permitted values of the 

ed on the signature algorithm used to sign certificates issued. 

shall specify in its documentation the applicable algorithms that can 

gnature keys.

the namedCurve field populated with the appropriate OID from Table 3-6 of SP 

ation the allowed values of the

These values shall be based on the algorithm used to generate the key pair. 

E07.02.04.01: The tester shall validate the correctness of the values of the parameters field of 

the algorithm of the subjectPublicKeyInfo field in the digital signature certificate issued by the 

vendor. 

7.2 Digital Signature Key

7.2.1 Certificate Profile Conformance 

AS07.02

expiration date in accordance with Table 3-

certificates issued. 

TE07.02.01.01: The tester shall validate that the signature algorithm is base

date of the certificate and is in accordance with Table 3-4 of SP80078. 

AS07.02.02: If RSA with PSS padding is used, the parameters field of the 

AlgorithmIdentifier type shall assert SHA-256 (OID = 2.16.840.1.101.3.4.2.1). For the other 

RSA algorithms, the pa

parameters field is absent. 

VE07.02.02.01: The vendor sha

AlgorithmIdentifier field bas

TE07.02.02.01: The tester shall validate that the correctness of the values of the 

AlgorithmIdentifier fields. 

AS07.02.03: The subjectPublicKeyInfo field shall assert an algorithm in the 

AlgorithmIdentifier in accordance with Table 3-5 of SP 800-78. 

VE07.02.03.01: The vendor

be used to generate digital si

TE07.02.03.01: The tester shall validate that the algorithm used to generate digital signature 

keys are in accordance with Table 3-5 of SP80078. 

AS07.02.04: If the public key algorithm is Elliptic Curve, then the EcpkParameters field 

uses either

800-78 or the implicitlyCA choice. 

VE07.02.04.01: The vendor shall specify in its document

parameters field of the algorithm of the subjectPublicKeyInfo field as part of the digital signature 

certificate profile.

T

 Page 33
Special Publication 800-85B PIV Data Model Testing Specification

AS07.02.05: The keyUsage extension shall assert both the digitalSignature and 

nonRepudiation bits. No other bits shall be asserted. 

.0 y in its documentation the assertion of the 

digitalSignature bit and the nonRepudiation bit in the keyUsage extension as part of the digital 

ature certificate issued by the 

AS07.02.06: The size of the public key for digital signature shall be determined by the 

onds to the

ey.

signature

signature certificate is not beyond the expiration 

r equal

rating an RSA key pair for digital signatures. 

r

VE07 2.05.01: The vendor shall specif

signature certificate profile. 

TE07.02.05.01: The tester shall validate the assertion of the digitalSignature bit and the 

nonRepudiation bit in the keyUsage extension in the digital sign

vendor. 

7.2.2 Key Pair and Certificate Conformance 

expiration of the certificate in accordance with Table 3-1 of SP 800-78. 

VE07.02.06.01: The vendor shall specify in its documentation the allowable public key size to 

be used while generating digital signature keys. 

TE07.02.06.01: The tester shall validate that the public key size is in accordance with Table 3-1 

of SP80078. 

AS07.02.07: The public key present in the digital signature certificate corresp

digital signature private k

No requirement for vendor. 

TE07.02.07.01: The tester shall validate that the public key present in the digital

certificate is part of the key pair corresponding to the private key on the PIV card. 

AS07.02.08: The expiration of the digital

of the CHUID. 

No requirement for vendor. 

TE07.02.08.01: The tester shall validate that the expiration of the digital signature certificate is

not beyond the expiration of the CHUID in the PIV card. 

AS07.02.09: If the public key algorithm is RSA, the exponent shall be greater than o

to 65,537. 

VE07.02.09.01: The vendor shall specify in its documentation the size of the exponent permitted 

while gene

TE07.02.09.01: The tester shall validate that the RSA public key exponent size is greater than o

equal to 65,537. 

 Page 34
Special Publication 800-85B PIV Data Model Testing Specification

7.3 Key Management Key

7.3.1 Certificate Profile Conformance 

AS07.03.01: The signature field in the certificate shall specify an algorithm in the 

AlgorithmIdentifier in accordance with Table 3-4 of SP 800-78 and based on the certificate

expiration date in accordance with Table 3-3 of SP 800-78.

.840.1.101.3.4.2.1). For the other

ith NULL. For ECDSA, the 

dentifier in accordance with Table 3-5 of SP 800-78. 

n

hall validate that the algorithm used to generate key management 

Table 3-5 of SP80078. 

eters field

uses either the namedCurve field populated with the appropriate OID from Table 3-6 of SP 

.01: The vendor shall specify in its documentation the allowed values of the 

ed on the algorithm used to generate the 

he tester shall validate the correctness of the values of the parameters field of 

e algorithm of the subjectPublicKeyInfo field in the key management certificate issued by the 

VE07.03.01.01: The vendor shall specify in its documentation the algorithms used to sign 

certificates issued. 

TE07.03.01.01: The tester shall validate that the signature algorithm is based on the expiration 

date of the certificate and is in accordance with Table 3-4 of SP80078. 

AS07.03.02: If RSA with PSS padding is used, the parameters field of the 

AlgorithmIdentifier type shall assert SHA-256 (OID = 2.16

RSA algorithms, the parameters field is populated w

parameters field is absent. 

VE07.03.02.01: The vendor shall specify in its documentation the permitted values of the 

AlgorithmIdentifier field based on the signature algorithm used to sign certificates issued. 

TE07.03.02.01: The tester shall validate that the correctness of the values of the 

AlgorithmIdentifier fields. 

AS07.03.03: The subjectPublicKeyInfo field shall assert an algorithm in the 

AlgorithmI

VE07.03.03.01: The vendor shall specify in its documentation the applicable algorithms that ca

be used to generate key management keys. 

TE07.03.03.01: The tester s

keys are in accordance with

AS07.03.04: If the public key algorithm is Elliptic Curve, then the EcpkParam

800-78 or the implicitlyCA choice. 

VE07.03.04

parameters field of the algorithm of the subjectPublicKeyInfo field as part of the key 

management certificate profile. These values shall be bas

key pair. 

TE07.03.04.01: T

th

vendor. 

 Page 35
Special Publication 800-85B PIV Data Model Testing Specification

AS07.03.05: If the public key algorithm is RSA, then the keyUsage extension shall only 

assert the keyEncipherment bit. 

y in its documentation that certificates corresponding to 

RSA keys assert only the keyEncipherment bit in the keyUsage extension.

shall

Agreement bit.

xtension.

tic curve keys

te Conformance 

ic key size to

y management keys. 

with Table 3-1

TE07.03.08.01: The tester shall validate that the public key present in the key management 

thm is RSA, the exponent shall be greater than or equal 

t permitted 

1: The tester shall validate that the RSA public key exponent size is greater than or 

VE07.03.05.01: The vendor shall specif

TE07.03.05.01: The tester shall validate that certificates corresponding to RSA keys assert only 

the keyEncipherment bit in the keyUsage extension.

AS07.03.06: If the public key algorithm is Elliptic Curve, then the keyUsage extension

only assert the key

VE07.03.06.01: The vendor shall specify in its documentation that certificates corresponding to

elliptic curve keys assert only the keyAgreement bit in the keyUsage e

TE07.03.06.01: The tester shall validate that certificates corresponding to ellip

assert only the keyAgreement bit in the keyUsage extension. 

7.3.2 Key Pair and Certifica

AS07.03.07: The size of the public key for key management shall be determined by the

expiration of the certificate in accordance with Table 3-1 of SP 800-78. 

VE07.03.07.01: The vendor shall specify in its documentation the allowable publ

be used while generating ke

TE07.03.07.01: The tester shall validate that the public key size is in accordance

of SP80078. 

AS07.03.08: The public key present in the key management certificate corresponds to the 

key management private key. 

No requirement for vendor. 

certificate is part of the key pair corresponding to the private key on the PIV card. 

AS07.03.09: If the public key algori

to 65,537. 

VE07.03.09.01: The vendor shall specify in its documentation the size of the exponen

while generating an RSA key pair for key management. 

TE07.03.09.0

equal to 65,537. 

 Page 36
Special Publication 800-85B PIV Data Model Testing Specification

7.4 Card Authentication Key

7.4.1 Certificate Profile Conformance 

AS07.04.01: The signature field in the certificate shall specify an algorithm in the 

VE07.04.01.01: The vendor shall specify in its documentation the algorithms used to sign 

e algorithm is based on the expiration 

other

pulated with NULL. For ECDSA, the 

parameters field is absent. 

ubjectPublicKeyInfo field shall assert an algorithm in the 

AlgorithmIdentifier in accordance with Table 3-5 of SP 800-78. 

n

n

e, then the EcpkParameters field

f SP

blicKeyInfo field as part of the card 

authentication certificate profile. These values shall be based on the algorithm used to generate 

ss of the values of the parameters field of 

AlgorithmIdentifier in accordance with Table 3-4 of SP 800-78 and based on the certificate 

expiration date in accordance with Table 3-3 of SP 800-78. 

certificates issued. 

TE07.04.01.01: The tester shall validate that the signatur

date of the certificate and is in accordance with Table 3-4 of SP80078. 

AS07.04.02: If RSA with PSS padding is used, the parameters field of the 

AlgorithmIdentifier type shall assert SHA-256 (OID = 2.16.840.1.101.3.4.2.1). For the

RSA algorithms, the parameters field is po

VE07.04.02.01: The vendor shall specify in its documentation the permitted values of the 

AlgorithmIdentifier field based on the signature algorithm used to sign certificates issued. 

TE07.04.02.01: The tester shall validate that the correctness of the values of the 

AlgorithmIdentifier fields. 

AS07.04.03: The s

VE07.04.03.01: The vendor shall specify in its documentation the applicable algorithms that ca

be used to generate card authentication keys. 

TE07.04.03.01: The tester shall validate that the algorithm used to generate card authenticatio

keys are in accordance with Table 3-5 of SP80078. 

AS07.04.04: If the public key algorithm is Elliptic Curv

uses either the namedCurve field populated with the appropriate OID from Table 3-6 o

800-78 or the implicitlyCA choice. 

VE07.04.04.01: The vendor shall specify in its documentation the allowed values of the 

parameters field of the algorithm of the subjectPu

the key pair. 

TE07.04.04.01: The tester shall validate the correctne

the algorithm of the subjectPublicKeyInfo field in the card authentication certificate issued by 

the vendor. 

 Page 37
Special Publication 800-85B PIV Data Model Testing Specification

AS07.04.05: The keyUsage extension shall assert only the digitalSignature bit. No othe

shall be asserted. 

VE07.04.05.01:

r bits

The vendor shall specify in its documentation the assertion of the 

ge

sued by the vendor.

.0 certificatePolicies must assert id-fpkicommon-cardAuth (OID = 2.16.840.1.101.3.2.1.3.17). 

: The extKeyUsage extension shall assert id-PIV-cardAuth (OID = 

2.16.840.1.101.3.6.8). This extension is critical. 

all validate the extKeyUsage asserts the id-PIV-cardAuth OID as a 

AS07.04.08: The authorityInfoAccess field shall contain an id-ad-ocsp accessMethod. The 

is certificate. 

shall specify in its documentation the inclusion of an id-ad-ocsp 

e

also validate that the accessLocation for this accessMethod uses the URI name form

ibute OID = 2.16.840.1.101.3.6.6).

VE07.04.09.01: The vendor shall specify in its documentation the inclusion of the FASC-N in 

the subjectAltName extension as part of the card authentication certificate profile. 

TE07.04.09.01: The tester shall validate the presence of the FASC-N in the subjectAltName

extension in the card authentication certificate issued by the vendor. 

digitalSignature bit in the keyUsage extension as part of the card authentication certificate 

profile. 

TE07.04.05.01: The tester shall validate the assertion of the digitalSignature bit in the keyUsa

extension in the card authentication certificate is

AS07 4.06: The policyIdentifier field in the

VE07.04.06.01: The vendor shall specify in its documentation that the policyIdentifier field in 

certificatePolicies asserts the id-fpki-common-cardAuth OID. 

TE07.04.06.01: The tester shall validate the policyIdentifier field in certificatePolicies has 

asserted the id-fpki-common-cardAuth OID. 

AS07.04.07

VE07.04.07.01: The vendor shall specify in its documentation that the extKeyUsage extension 

asserts the id-PIV-cardAuth OID. 

TE07.04.07.01: The tester sh

critical extension. 

access location uses the URI name form to specify the location of an HTTP accessible 

OCSP Server distributing status information for th

VE07.04.08.01: The vendor

accessMethod in the authorityInfoAccess extension as part of the card authentication certificat

profile. Additionally, the accessLocation for this accessMethod uses the URI name form to 

specify the location of an HTTP accessible OCSP server. 

TE07.04.08.01: The tester shall validate the presence of an id-ad-ocsp accessMethod in the 

authorityInfoAccess extension in the card authentication certificate issued by the vendor. The 

tester shall

and points to an HTTP accessible OCSP server.

AS07.04.09: The FASC-N shall be populated in the subjectAltName extension using the 

pivFASC-N attr

 Page 38
Special Publication 800-85B PIV Data Model Testing Specification

AS07.04.10: The piv-interim extension (OID = 2.16.840.1.101.3.6.9.1) shall be present 

hich is populated with a Boolean value. This extension 

The vendor shall specify in its documentation the use of this extension as part 

e card authenti

TE07.04.10.01: Th

authentication certi

7.4.2 Key Pair and

AS07.04.11: The si

expiration of the c

VE07.04.11.01: Th

be used while gener

TE07.04.11.01: Th lic key size is in accordance with Table 3-1

80078. 

7.04.12: The p the

authenticatio

No requirement for

7.04.12.01: Th

certificate is part of d.

3: The FAS e subje

as the FASC-N present in the CHUID. 

uirement for ven

04.13.01: The te shall validate that the FASC-N in the sub ame field in the 

uthentication certificate is the sam N present in t in the PIV card.

04.14: If the pu key algorith t sha n or equal

to 65,537. 

VE07.04.14.01: The vendor shall specify in its documentation the size of the exponent permitted 

while tion.

4.01: The te

equal to 65,537. 

contain an interim_indicator field w

is not critical. 

VE07.04.10.01:

of th cation certificate profile. 

e tester shall validate that the piv-interim extension is present in the card 

ficate issued by the vendor.

 Certificate Conformance 

ze of the public key for card authentication shall be determined by the 

ertificate in accordance with Table 3-1 of SP 800-78. 

e vendor shall specify in its documentation the allowable public key size to 

ating card authentication keys. 

e tester shall validate that the pub

of SP

AS0

card

ublic key present in the card authentication certificate correspond to

n private key.

vendor.

TE0 e tester shall validate that the public key present in the card authentication 

the key pair corresponding to the private key on the PIV car

AS07.04.1 C-N in th ctAltName field in the card authentication certificate 

is the same

No req dor.

TE07. ster jectAltN

card a e as the FASC- he CHUID

AS07. blic m is RSA, the exponen ll be greater tha

generating an RSA key pair for card authentica

TE07.04.1 ster shall validate that the RSA public key exponent size is greater than or 

 Page 39
Special Publication 800-85B PIV Data Model Testing Specification

8. BER-TLV Test Assertions 

Assumptions: 

1.0 Wh t 0 and 127 bytes, the

length field consists of a single byte where bit 8 is set to 0 and bits 

7 to

When the length of the value field is greater than 127 bytes, the length 

field consists of two or more bytes. The first byte is '81', '82', '83' 

or '84' where the low order nibble of each of these possible first-byte

val

and remaining bytes in the length field. These subsequent and 

m n integer 

enc i le 8-1 shows the

enc i

en he length of the value field is between

1 encode the number of bytes in the value field.

ues (1, 2, 3, or 4 respectively) encodes the number of subsequent 

re aining bytes are taken together in order to be a big-endia

od ng the number of bytes in the value field. Tab

od ng of the length field.

1.1 Each BER-TLV tag is encoded as three bytes. 

1.2 Each data object returned is appended with a 2 byte status word. 

1.3 can have zero lengths, which will 

y followed by the next 

tag

All variable length value fields 

result in a tag length field being immediatel

, if applicable.

1.4 The final byte of the command string can be set to 0x00 to retrieve an 

entire data object regardless of the size of that object. 

Number of 

Bytes in the 

Length Field 

First Byte Subsequent Bytes Length of 

the Value Field

1 byte ‘00’ to ‘7F’ None 0 to 127 

2 byte ‘81’ '00' to 'FF' 0 to 255 

3 byte ‘82’ '0000' to 'FFFF' 0 to 65,535

4 byte ‘83’ '000000' to 'FFFFFF' 0 to 16,777,215 

5 byte ‘84’ '00000000' to 'FFFFFFFF' 0 to 4,294,967,295 

Table 8-1. Encoding of Length Field 

8.1 “Card Capabilities Container” Data Object 

Purpose Confirms that the CCC of the PIV card Application conforms to the 

PIV data model requirements as per Appendix A of SP80073. 

Reference(s) 1. SP80073, Appendix A 

2. TE04.01.01.01 

3. TE04.02.01.01 

4. TE04.02.01.02 

 Page 40
Special Publication 800-85B PIV Data Model Testing Specification

Precondition(s) 1. A valid PIV card is inserted into the contact reader.

h card handle.

on the PIV card.

2. A valid PC/SC connection exists between the test application and the 

contact reader. 

3. The test application is currently connected to the card application 

which is accessible throug

4. A valid CCC is present

Test Scenario 1. Set cardHandle := <<valid card handle>>.

2. Set OID := <<CCC (2.16.840.1.101.3.7.1.219.0)>>.

3. Call pivGetData w/ 

• (IN) cardHandle

• (IN) OID 

• (OUT) data 

4. Read and parse the byte array in accordance with BER-TLV 

format. 

Expected Result(s) 1. The size of the byte array does not exceed 297 byte

2. All mandatory tags in CCC table are present. 

ble tags co

s.

nform with the vendor

p

3. The values of the availa

rovided data.

8.2 “Card Holder Unique Identifier” Data Object

Purpose Confirms that the CHUID of the PIV card Application conforms to 

the PIV data model requirements as per Appendix A of SP80073. 

Reference(s) 1. SP80073, Appendix A 

2. TE04.01.01.01

3. TE04.03.01.01 

Precondition(s) 1. A valid PIV card is inserted

2. A valid PC/SC connec

 into the contact reader. 

tion exists between the test application and the

h card handle.

nt on the PIV card.

contact reader. 

3. The test application is currently connected to the card application 

which is accessible throug

4. A valid CHUID is prese

Test Scenario 1. Set cardHandle

2. Set OID := <<CH

:= <<valid card handle>>

UID (2.16.840.1.101.3.7.2.48.0)>>

w/

le

R LV

f

3. Call pivGetData

• (IN) cardHand

• (IN) OID 

• (OUT) data 

4. ead and parse the byte array in accordance with BER-T

ormat.

Expected Result(s) 1. 

3. Expiration date is encoded as YYYYMMDD.

4. Expriation date is within the next five years. 

The size of the byte array does not exceed 3395 bytes. 

2. All mandatory tags in CHIID table are present.

 Page 41
Special Publication 800-85B PIV Data Model Testing Specification

8.3 “X.509 Certificate for PIV Authentication” Data Object 

Purpose Confirms that the X.509 Certificate for PIV Authentication of the PIV

s to the PIV data model requirements as

per 3

card Application conform

Appendix A of SP8007

Reference(s) 1. dix A

2. TE04.01.01.01 

SP80073, Appen

Precondition(s) 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the

contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card handle.

4. A valid X.509 certificate for PIV authentication object is present on the 

PIV card.

Test Scenario 1. Set cardHandle := <<valid card handle>>

with BER-TLV

2. Set OID := <<PIV Authentication Certificate 

(2.16.840.1.101.3.7.2.1.1)>> 

3. Call pivGetData w/ 

• (IN) cardHandle

• (IN) OID 

• (OUT) data 

4. Read and parse the byte array in accordance

format.

Expected Result(s) 1. The size of the byte array does not exceed 1905 bytes. 

2. All mandatory tags in “X.509 Certificate for PIV Authentication”

table are present.

8.4 “Card Holder Fingerprints” Data Object 

Purpose Confirms that the “Card Holder Fingerprints” data object of the PIV 

card s to the PIV data model requirements as

per Appendix A of SP80073 

Application conform

Reference(s) 1. SP80073, Appendix A

2. TE04.01.01.01 

3. TE04.04.01.01 

4. TE04.04.02.01 

Precondition(s) 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the 

contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card handle. 

4. A valid card holder fingerprints object is present on the PIV card.

 Page 42
Special Publication 800-85B PIV Data Model Testing Specification

Test Scenario 1. Set cardHandle := <<valid card handle>>

rd Holder Fingerprints

.3.7.2.96.16)>>

w/

le

R LV

2. Set OID := <<Ca

(2.16.840.1.101

3. Call pivGetData

• (IN) cardHand

• (IN) OID 

• (OUT) data 

4. ead and parse the byte array in accordance with BER-T

format. 

Expected Result(s) 1. The size of the byte array does not exceed 4006 bytes.

2. All mandatory tags in “Card Holder Fingerprints” table are

present. 

8.5 “Printed Information” Data Object

Purpose Confirms that the “Printed Information” Data Object of the PIV card 

Application conforms to the PIV data model requirements as per 

Appendix A of SP80073 

Reference(s) 1. SP80073, Appendix A 

2. TE04.01.01.01 

Precondition(s) 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the

nected to the card application 

contact reader. 

3. The test application is currently con

which is accessible through card handle. 

4. A valid printed information is stored on the PIV card.

Test Scenario 1. Set cardHandle := <<valid card handle>>

S Information

.2.48.1)>>

w/

4. Read and parse the byte array in accordance with BER-TLV 

2. et OID := <<Printed

(2.16.840.1.101.3.7

3. Call pivGetData

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

format.

Expected Result(s) 1. The size of the byte array does not exceed 120 bytes.

2. All mandatory tags in “Printed Information” table are present.

8.6 “Card Holder Facial Image” Data Object

Purpose Confirms that the “Card Holder Facial Image” data object of the PIV 

card Application conforms to the PIV data model requirements as 

per Appendix A of SP80073. 

 Page 43
Special Publication 800-85B PIV Data Model Testing Specification

Reference(s) 1. SP80073, Appendix A 

2. TE04.01.01.01 

3. TE04.05.01.01

4. TE04.05.02.01 

Precondition(s) 1. A valid PIV card is inserted into the contact reader. 

tween the test application and the

image object is present on the PIV card.

2. A valid PC/SC connection exists be

contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card handle.

4. A valid card holder facial

Test Scenario 1. Set cardHandle

2. Set OID := <<Ca

:= <<valid card handle>>

rd Holder Facial Image

(2.16.840.1.101.3.7.2.96.48)>> 

3. Call pivGetData w/ 

• (IN) cardHandle

• (IN) OID 

• (OUT) data 

4. Read and parse the byte array in accordance with BER-TLV 

format.

Expected Result(s) 1. The size of the byte array does not exceed 12710 bytes.

2. All mandatory tags in “Card Holder Facial Image” table are

present. 

8.7 “X.509 Certificate for Digital Signature” Data Object 

Purpose Confirms that the X.509 Certificate for Digital Signature of the PIV 

card Application conforms to the PIV data model requirements as 

per Appendix A of SP80073

Reference(s) 1. SP80073, Section 7.1.2 

2. TE04.01.01.01 

Precondition(s) 1. inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the 

contact reader. 

ted to the card application 

A valid PIV card is

3. The test application is currently connec

which is accessible through card handle. 

4. A valid X.509 certificate for digital signature object is present on the 

PIV card.

Test Scenario 1. dHandle := <

2. et OID := <<Digital

Set car <valid card handle>>

S Signature Certificate

.3.7.2.1.0)>>

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Read and parse the byte array in accordance with BER-TLV 

format. 

(2.16.840.1.101

 Page 44
Special Publication 800-85B PIV Data Model Testing Specification

Expected Result(s) 1. The size of the byte array does not exceed 1905 bytes. 

2. Al mandatory tags in “X.509 Certificate for Digital Signature”

table are present. 

8.8 “X.509 Certificate for Key Management” Data Object 

Purpose Confirms that the X.509 Certificate for Key Management of the PIV

card Application conforms to the PIV data model requirements as

per Appendix A of SP80073. 

Reference(s) 1. SP80073, Appendix A

2. TE04.01.01.01 

Precondition(s) 1. is inserted into the contact reader. 

2. onnection exists between the test application and the

tion 

A valid PIV card

A valid PC/SC c

contact reader. 

3. The test application is currently connected to the card applica

which is accessible through card handle. 

4. A valid X.509 certificate for key management object is present on the 

PIV card.

Test Scenario 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Key Management Certificate 

1.101.3.7.2.1.2)>>

yte array in accordance with BER-TLV

(2.16.840.

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Read and parse

format. 

the b

Expected Result(s) 1. The size of the byte array does not exceed 1905 bytes.

2. All mandatory tags in “X.509 Certificate for Key Management” 

table are present.

8.9 “X.509 Certificate for Card Authentication” Data Object 

Purpose Confirms that the X.509 Certificate for Card Authentication of the

PIV card Application conforms to the PIV data model requirements

as per Appendix A of SP80073

Reference(s) 1. SP80073, Appendix A 

2. TE04.01.01.01 

 Page 45
Special Publication 800-85B PIV Data Model Testing Specification

Precondition(s) 1. A valid PIV card is inserted into the contact reader.

en the test application and the

rrently connected to the card application 

ough card handle.

4. rtificate for card authentication object is present on the 

2. A valid PC/SC connection exists betwe

contact reader. 

3. The test application is cu

which is accessible thr

A valid X.509 ce

PIV card.

Test Scenario 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Authentication Certificate 

(2.16.840.1.101.3.7.2.5.0)>> 

3. Call pivGetData w/

4. Read and parse the byte array in accordance with BER-TLV 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

format. 

Expected Result(s) 1. The size of the byte array does not exceed 1905 bytes. 

2. All mandatory tags in “X.509 Certificate for Card Authentication”

table are present. 

8.10 “Security Object” Data Object 

Purpose Confirms that the “Security Object” data object of the PIV card 

Application conforms to the PIV data model requirements as per 

Appendix A of SP80073 

Reference(s) 1. SP80073, Section 7.1.2 

2. TE04.01.01.01 

3. TE04.06.01.01 

Precondition(s) 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the 

contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card handle. 

4. A valid security object is present on the PIV card.

 Page 46
Special Publication 800-85B PIV Data Model Testing Specification

Test Scenario 1. Set cardHandle := <<valid card handle>> 

2.144.0)>>

3. Call pivGetData w/ 

ance with BER-TLV

format. 

ract the Data Groups to Container

ID mapping instances. 

ner.

2. Set OID := <<Security Object 

(2.16.840.1.101.3.7.

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Read and parse the byte array in accord

5. Parse the tag 0xBA to ext

6. Verify that the PIV data containers exist on the card by 

selecting each contai

Expected Result(s) 1. From Step 4: The size of the byte array does not exceed 1008 bytes. 

2. From Step 4: All mandatory tags in “Security Object” table are 

: Verify that all data containers found in the mapping are 

sent in the card by performing a select on each container 

ases.

present.

3. From Step 5

actually pre

(with appropriate authorization) and expecting ’90 00’ in all c

 Page 47
Special Publication 800-85B PIV Data Model Testing Specification

9. Biometric Data Object Test Assertions

The test assertions do t

and Facial Image on P

PIV specification (Ta 8 tes

(Table 3 of SP80076) I

9.1 CBEFF Patron

9.1.1 CBEFF Struct

cumented in this section relate to testing the Card Holder Fingerprint objec

the IV card for conformance to the common CBEFF Patron Format for 

ble of SP80076) as well as to INCITS 378 Profile for PIV card Templa

and NCITS 385 profile for Facial Image respectively. 

Format for Fingerprint Template

ure for Fingerprint Template 

Purpose Validates that the CBEFF structure generated complies with SP80076 Table 

7, “Simple CBEFF Structure”.

References(s) 1. S

2. A

3

P80076, Table 7.

S05.01.01

. AS05.01.03

Precondition(s) 1. All templates have been generated and stored on the PIV card. 

A valid PIV card is inserted into the contact reader. 

application and th

2. 

e

contact reader. 

t application is currently connected to the card application 

to read the object are met. 

3. A valid PC/SC connection exists between the test

4. The tes

which is accessible through card handle. 

5. A valid Card Holder Fingerprints object is present on the PIV card. 

6. Security conditions 

Test Scenario 1. Set cardHandle := <<valid card handle>>

2. Set OID := <<Card Holder Fingerprints

(2.16.840.1.101.3.7.2.96.16)>>

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID

• (OUT) data 

4. Extract the BDB Length field of CBEFF Header. 

5. Extract the SB Length field of CBEFF Header.

Expected Result(s) 1. From step 4: BDB Length field is non-zero and the recorded length

recorded length match 

3. The Card Holder Fingerprint object length is equal to CBEFF Header 

le ngth + SB Length.

match the actual length. 

2. From step 5: SB Length field is non-zero and the

the actual length. 

ngth + BDB Le

9.1.2 CBEFF Heade

9.1.2.1 Patron Header V

r for late 

ersion

Fingerprint Temp

Purpose Validates that the CBEFF field “Patron Header Version” complies with

SP80076 Table 8, “Patron Format PIV Specification” 

 Page 48
Special Publication 800-85B PIV Data Model Testing Specification

References(s) 1. SP80076, Table 8.

2. AS05.01.02

3. AS05.01.04

Precondition(s) 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the

er. 

plication is currently connected to the card application 

contact read

3. The test ap

which is accessible through card handle. 

4. A valid Card Holder Fingerprints object is present on the PIV card.

5. Security conditions to read the object are met. 

Test Scenario 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Fingerprints

(2.16.840.1.101.3.7.2.96.16)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the value field for tag 0xBC, extract the first

88 bytes (CBEFF Header) and read the Patron Header 

Version field (based on its position) in CBEFF Header. 

Expected Result(s) The Patron Header Version field has a value of 0x03. 

9.1.2.2 SBH Security Option 

Purpose Validates that the biometric data block on the PIV card is digitally signed

but not encrypted. 

References(s) 1. SP80076

2. AS05.01.02

3. AS05.01.05

Precondition(s) 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the 

contact reader.

3. The test application is currently connected to the card application 

ble through card handle.

the PIV card.

which is accessi

4. A valid Card Holder Fingerprints object is present on

5. Security conditions to read the object are met. 

Test Scenario 1. Set cardHandle := <<valid card handle>>

2. Set OID := <<Card Holder Fingerprints 

(2.16.840.1.101.3.7.2.96.16)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the value field for tag 0xBC, extract the first 

88 bytes (CBEFF Header) and read the SBH Security Option 

field (based on its position) in CBEFF Header. 

Expected Result(s) The SBH Security Options field has a value of b00001101. 

 Page 49
Special Publication 800-85B PIV Data Model Testing Specification

9.1.2.3 BDB Format Owner Values

Purpose Validates that BDB Format Owner is set to a value

Committee on B

of 0x001B denoting

M1, the INCITS Technical iometrics. 

References(s) 1. SP

2. A

3. A

80076

S05.01.02

S05.01.03

4. AS05.01.06

Precondition(s) 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and

3. The test application is currently connected to the card application 

s accessible through card handle. 

 the contact reader. 

which i

4. A valid Card Holder Fingerprints object is present on the PIV card. 

5. Security conditions to read the object are met. 

Test Scenario 1. Set cardHandle

<<C

:= <<valid card handle>>

2. Set OID :=

(2.16.840.1

ard Holder Fingerprints

.101.3.7.2.96.16)>>

Data w/

Handle

t

3. Call pivGet

• (IN) card

• (IN) OID 

• (OUT) data 

4. Extract the value field for tag 0xBC, extract the firs

88 bytes (CBEFF Header) and read the BDB Format Owner

field (based on its position) in CBEFF Header.

Expected Result(s) The BDB Format Owner field has a value of 0x001B. 

9.1.2.4 BDB Format Type 

Purpose Validates that for mandatory fingerprint minutiae te

Type is set to a

mplate data stored on a 

PIV card, the BDB Format value of 0x0201.

References(s) 1. SP80076

2.

3.

4.

AS05.01.02

AS05.01.03

AS05.01.07

Precondition(s) 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and 

3. The test application is currently connected to the card application 

h is accessible through card handle. 

 the contact reader. 

whic

4. A valid Card Holder Fingerprints object is present on the PIV card. 

5. Security conditions to read the object are met. 

 Page 50
Special Publication 800-85B PIV Data Model Testing Specification

Test Scenario 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Fingerprints 

(2.16.840.1.101.3.7.2.96.16)>>

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the value field for tag 0xBC, extract the first

B Format Type

CBEFF Header.

88 bytes (CBEFF Header) and read the BD

field (based on its position) in

Expected Result(s) The BDB Format Type field has a value of 0x0201.

9.1.2.5 Biometric Creation Date

Purpose Validates that the creation date in the PIV Patron Format is encoded in 8

bytes using a binary representation of “YYYYMMDDhhmmssZ”. 

References(s) 1. 

2.

SP80076, Table 8. 

AS05.01.02

3. AS05.01.03 

4. AS05.03.08 

Precondition(s) 1. A valid PIV card is inse

2. A valid

rted into the contact reader. 

PC/SC connection exists between the test application and 

t application is currently connected to the card application 

essible through card handle. 

Holder Fingerprints object is present on the PIV card. 

ditions to read the object are met. 

 the contact reader. 

3. The tes

which is acc

4. A valid Card

5. Security con

Test Scenario 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Fingerprints 

(2.16.840.1.101.3.7.2.96.16)>>

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the value field for tag 0xBC, extract the first

ometric Creation

n) in CBEFF Header.

88 bytes (CBEFF Header) and read the Bi

Date field (based on its positio

Expected Result(s) The Biometric Creation Date is in the YYYYMMDDhhmmssZ format. 

9.1.2.6 Validity Period Dates 

Purpose Validates that the Validity Period in the PIV Patron Format contains two 

dates encoded in the same format as expected in 9.1.2.5 above. 

References(s) 1. SP80076, Table 8 

2. AS05.01.02

3. AS05.01.03 

4. AS05.01.09 

 Page 51
Special Publication 800-85B PIV Data Model Testing Specification

Precondition(s) 1. A valid PIV card is inserted into the contact reader. 

rd ap tion 

Holder Fingerprints object is present on the PIV card. 

ditions to read the object are met. 

2. A valid PC/SC connection exists between the test application and 

 the contact reader. 

3. The test application is currently connected to the ca plica

which is accessible through card handle. 

4. A valid Card

5. Security con

Test Scenario 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Fingerprints 

(2.16.840.1.101.3.7.2.96.16)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the value field for tag 0xBC, extract the first

alidity Period

ader.

88 bytes (CBEFF Header) and read the V

field (based on its position) in CBEFF He

Expected Result(s) The Validity Period contains two dates and each is e

YYYYMMDDhhmmssZ format. 

ncoded in the

9.1.2.7 Biometric Type Values

Purpose Validates that Biometric Type has the value 0x000008 

References(s) 1. SP80076

2. AS05.01.02

3. AS05.01.03

4. AS05.01.10

Precondition(s) 1.

lication and

 the contact reader. 

application is currently connected to the card application 

Card Holder Fingerprints object is present on the PIV card. 

ditions to read the object are met. 

A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test app

3. The test

 which is accessible through card handle. 

4. A valid

5. Security con

Test Scenario 1. Set cardHandle := <<valid card handle>>

e

FF Header.

5. Extract the value field for tag 0xBC, extract the first 

88 bytes (CBEFF Header) and read the Biometric Type field 

(based on its position) in CBEFF Header. 

2. Set OID := <<Card Holder Fingerprints 

(2.16.840.1.101.3.7.2.96.16)>> 

3. Call pivGetData w/ 

• (IN) cardHandl

• (IN) OID 

• (OUT) data 

4. Extract the Biometric Type field of CBE

Expected Result(s) The value of the Biometric Type field for the fingerprint template is 

0x000008 

 Page 52
Special Publication 800-85B PIV Data Model Testing Specification

9.1.2.8 Biometric Data Type 

Purpose Validates that for the mandatory minutia PIV card te

g value shall be

mplates, the CBEFF 

b100xxxxx, which 

corr ta that has been processed. 

biometric data type encodin

esponds to biometric da

References(s) 1. S

2. A

3

P80076

S05.01.02

. AS05.01.11

Precondition(s) 1. All required sample finger images have been recorded. 

2. All templates have been generated and stored on the PIV card. 

A valid PIV card is inserted into the contact reader. 

nd the

3. 

contact reader. 

test application is currently connected to the card application which 

4. A valid PC/SC connection exists between the test application a

5. The

is accessible through card handle. 

6. A valid Card Holder Fingerprints object is present on the PIV card. 

7. Security conditions to read the object are met. 

Test Scenario 1. Set cardHandle := <<valid card handle>>

2. Set OID := <<Card Holder Fingerprints

.101.3.7.2.96.16)>>

Data w/

ld of CBEFF Header.

(2.16.840.1

3. Call pivGet

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the Biometric Data Type fie

5. Extract the value field for tag 0xBC, extract the first

88 bytes (CBEFF Header) and read the Biometric Data Type

field (based on its position) in CBEFF Header.

Expected Result(s) The Biometric Data Type field has a value of b100xxxxx. 

9.1.2.9 Biometric Data Quality

Purpose Validates that the biometric data quality field carries valid values 

References(s) 1. SP80076

2. AS05.01.02 

3. AS05.01.12 

Precondition(s) 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and 

the contact reader.

t is present on the PIV card. 

bject are met. 

3. The test application is currently connected to the card application 

 which is accessible through card handle. 

4. A valid Card Holder Fingerprints objec

5. Security conditions to read the o

 Page 53
Special Publication 800-85B PIV Data Model Testing Specification

Test Scenario 1. Set cardHandle := <<valid card handle>>

<<Card Holder Fingerprints

.101.3.7.2.96.16)>>

Data w/

er.

C, extract the first

2. Set OID :=

(2.16.840.1

3. Call pivGet

• (IN) cardHandle

• (IN) OID 

• (OUT) data 

4. Extract the Biometric Data Quality field of CBEFF Head

5. Extract the value field for tag 0xB

88 bytes (CBEFF Header) and read the Biometric Data 

Quality field (based on its position) in CBEFF Header.

Expected Result(s) The Biometric Data Quality field has a value between -2 and 100.

9.1.2.10 Creator Field Value

Purpose Validates that the Creator field in the PIV Patron Format contains 18 bytes 

of which the first K <= 17 bytes shall be ASCII characters, and the first of 

the remaining 18-K shall be a null terminator (zero). 

References(s) 1. SP80076

2. AS05.01.02

3. AS05.01.13

Precondition(s) 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and

3. The test application is currently connected to the card application 

 which is accessible through card handle. 

4. A valid Card Holder Fingerprints object is present on the PIV card. 

the contact reader.

5. Security conditions to read the object are met. 

Test Scenario Extract the value field for tag 0xBC, extract the first 88

bytes (CBEFF Header) and read the Creator field (based on its

.

rate through remaining bytes in field and fail

.

position) in CBEFF Header. Start the following procedure at

the first byte of the Creator field: 

For bytes 0 to 16, check if byte represents an ASCII 

character

If yes, continue.

Else, check if zero.

If no, fail

Else ite

iff non-zero

For bytes 17 through the end of the field, iterate through 

all bytes and fail iff non-zero

Expected Result(s) Procedure completes without failing. 

9.1.2.11 FASC-N Value 

Purpose The FASC-N field in the PIV Patron Format shall contain the 25 bytes of

the FASC-N component of the CHUID identifier. 

 Page 54
Special Publication 800-85B PIV Data Model Testing Specification

References(s) 1. SP80076

2. AS05.01.02

3. AS05.01.03

4. AS05.01.14

Precondition(s) 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and 

 the contact reader. 

rd.

bject are met. 

3. The test application is currently connected to the card application 

which is accessible through card handle. 

4. A valid Card Holder Fingerprints object is present on the PIV ca

5. Security conditions to read the o

Test Scenario 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Fingerprints 

(2.16.840.1.101.3.7.2.96.16)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the FASC-N field of CBEFF Header. 

5. Set cardHandle := <<valid card handle>> 

6. Set OID := <<Card Holder Unique Identifier 

(2.16.840.1.101.3.7.2.48.0)>> 

7. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

8. Extract the value field for tag 0xBC, extract the first 

88 bytes (CBEFF Header) and read the FASC-N field (based 

on its position) in CBEFF Header. 

Expected Result(s) The FASC-N field in CBEFF header is the same as the one extracted from

the CHUID.

9.1.2.12 Reserved Field Value 

Purpose Validates that the “Reserved for Future Use” field is equal to 0x00000000. 

References(s) 1. SP80076

2. AS05.01.02 

3. AS05.01.15 

Precondition(s) 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and 

 the contact reader. 

3. The test application is currently connected to the card application 

 which is accessible through card handle. 

4. A valid Card Holder Fingerprints object is present on the PIV card. 

5. Security conditions to read the object are met. 

 Page 55
Special Publication 800-85B PIV Data Model Testing Specification

Test Scenario 1. Set cardHandle := <<valid card handle>> 

lder Fingerprints

(2.16.840.1.101.3.7.2.96.16)>> 

a w/

ndle

ue field for tag 0xBC, extract the first

FF Header) and read the “Reserved for Future

2. Set OID := <<Card Ho

3. Call pivGetDat

• (IN) cardHa

• (IN) OID 

• (OUT) data

4. Extract the val

88 bytes (CBE

Use” field (based on its position) in CBEFF Header.

Expected Result(s) The field has a value of 0x00000000.

 

 Page 56
Special Publication 800-85B PIV Data Model Testing Specification

9.2 CBEFF Patron r

9.2.1 CBEFF Structure f

Fo mat for Facial Image

or Facial Image 

Purpose Validates that the CBEFF structure generated complies with SP80076 Table

7, “Simple CBEFF Structure”. 

References(s) 1. SP80076, Table 7. 

2. AS05.01.01 

3. AS05.01.03 

Precondition(s) 1. All templates have been generated and stored on the PIV card. 

2. rted into the contact reader. 

3. connection exists between the test application and the

5. 

A valid PIV card is inse

A valid PC/SC

contact reader. 

4. The test application is currently connected to the card application 

which is accessible through card handle. 

A valid Card Holder Facial Image object is present on the PIV card.

6. Security conditions to read the object are met. 

Test Scenario 1. Set cardHandle := <<valid card handle>> 

D := <<Card Holder Facial Image

andle

a

er.

2. Set OI

(2.16.840.1.101.3.7.2.96.48)>> 

3. Call pivGetData w/ 

• (IN) cardH

• (IN) OID

• (OUT) dat

4. Extract the BDB Length field of CBEFF Head

5. Extract the SB Length field of CBEFF Header. 

Expected Result(s) 1. From step 4: BDB Length field is non-zero and the recorded length 

match the actual length. 

2. From step 5: SB Length field is non-zero and the recorded length match 

the actual length.

3. The Card Holder Facial Image object length is equal to CBEFF Header

length + BDB Length + SB Length. 

9.2.2 CBEFF Heade

9.2.2.1 Patron Header V

r for Facial Image 

ersion

Purpose Vali EFF field “Patron Header Version” complies with 

SP80 ron Format PIV Specification” 

dates that the CB

076 Table 8, “Pat

References(s) 1. SP80076, Table 8. 

AS05.01.02

AS05.01.04

2.

3.

 Page 57
Special Publication 800-85B PIV Data Model Testing Specification

Precondition(s) 1. A valid PIV card is inserted into the contact reader. 

lication 

cessible through card handle.

d Holder Facial Image object is present on the PIV card. 

nditions to read the object are met. 

2. A valid PC/SC connection exists between the test application and the

contact reader. 

3. The test application is currently connected to the card app

which is ac

4. A valid Car

5. Security co

Test Scenario 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Facial Image 

(2.16.840.1.101.3.7.2.96.48)>> 

3. Call pivGetData w/

ract the first

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the value field for tag 0xBC, ext

88 bytes (CBEFF Header) and read the Patron Header 

Version field (based on its position) in CBEFF Header. 

Expected Result(s) The Patron Header Version field has a value of 0x03. 

9.2.2.2 SBH Security Option

Purpose Validates that the biometric data block on the PIV card is digitally signed 

but not encrypted. 

References(s) 1. SP80076

2. AS05.01.02

3. AS05.01.05 

Precondition(s) 1. A valid PIV card is inserted into the contact reader. 

alid PC/SC connection exists between the test application and the

le.

older Facial Image object is present on the PIV card. 

tions to read the object are met. 

2. A v

contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card hand

4. A valid Card H

5. Security condi

Test Scenario 1. Set cardHandle := <<valid card handle>>

e

xtract the first

H Security Option

field (based on its position) in CBEFF Header. 

2. Set OID := <<Card Holder Facial Image 

(2.16.840.1.101.3.7.2.96.48)>> 

3. Call pivGetData w/ 

• (IN) cardHandl

• (IN) OID 

• (OUT) data 

4. Extract the value field for tag 0xBC, e

88 bytes (CBEFF Header) and read the SB

Expected Result(s) The SBH Security Options field has a value of b00001101. 

 Page 58
Special Publication 800-85B PIV Data Model Testing Specification

9.2.2.3 BDB Format Owner Values

Purpose Validates that BDB Format Owner is set to a value

Committee on B

of 0x001B denoting

M1, the INCITS Technical iometrics. 

References(s) 1. SP

2. A

3. A

80076

S05.01.02

S05.01.03

4. AS05.01.06

Precondition(s) 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and

3. The test application is currently connected to the card application 

s accessible through card handle. 

 the contact reader. 

which i

4. A valid Card Holder Facial Image object is present on the PIV card.

5. Security conditions to read the object are met. 

Test Scenario 1. Set cardHandle

<<C

:= <<valid card handle>>

2. Set OID :=

(2.16.840.1

ard Holder Facial Image

.101.3.7.2.96.48)>>

Data w/

Handle

st

3. Call pivGet

• (IN) card

• (IN) OID 

• (OUT) data 

4. Extract the value field for tag 0xBC, extract the fir

88 bytes (CBEFF Header) and read the BDB Format Owner

field (based on its position) in CBEFF Header.

Expected Result(s) The BDB Format Owner field has a value of 0x001B. 

9.2.2.4 BDB Format Type 

Purpose Validates that for optional facial image data stored o

e of 0x0501.

n a PIV card, the BDB

Format Type is set to a valu

References(s) 1. SP80076

2.

3.

4.

AS05.01.02

AS05.01.03

AS05.01.07

Precondition(s) 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and 

3. The test application is currently connected to the card application 

h is accessible through card handle. 

 the contact reader. 

whic

4. A valid Card Holder Facial Image object is present on the PIV card.

5. Security conditions to read the object are met. 

 Page 59
Special Publication 800-85B PIV Data Model Testing Specification

Test Scenario 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Facial Image 

(2.16.840.1.101.3.7.2.96.48)>>

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the value field for tag 0xBC, extract the first

B Format Type

CBEFF Header.

88 bytes (CBEFF Header) and read the BD

field (based on its position) in

Expected Result(s) The BDB Format Type field has a value of 0x0501.

9.2.2.5 Biometric Creation Date

Purpose Validates that the creation date in the PIV Patron Format is encoded in 8

bytes using a binary representation of “YYYYMMDDhhmmssZ”. 

References(s) 1. SP80076, Table 8. 

2. AS05.01.02

3. AS05.01.03 

4. AS05.01.08 

Precondition(s) 1. A valid PIV card is inse

2. A valid

rted into the contact reader. 

PC/SC connection exists between the test application and 

application is currently connected to the card application 

ssible through card handle. 

Holder Facial Image object is present on the PIV card.

itions to read the object are met. 

 the contact reader. 

3. The test

which is acce

4. A valid Card

5. Security cond

Test Scenario 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Facial Image 

(2.16.840.1.101.3.7.2.96.48)>>

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the value field for tag 0xBC, extract the first

metric Creation

n) in CBEFF Header.

88 bytes (CBEFF Header) and read the Bio

Date field (based on its positio

Expected Result(s) The Biometric Creation Date is in the YYYYMMDDhhmmssZ format. 

9.2.2.6 Validity Period Dates 

Purpose Validates that the Validity Period in the PIV Patron Format contains two 

dates encoded in the same format as expected in 9.2.2.5 above. 

References(s) 1. SP80076, Table 8 

2. AS05.01.02

3. AS05.01.03 

4. AS05.01.09 

 Page 60
Special Publication 800-85B PIV Data Model Testing Specification

Precondition(s) 1. A valid PIV card is inserted into the contact reader. 

a plication 

sible through card handle. 

older Facial Image object is present on the PIV card.

2. A valid PC/SC connection exists between the test application and

 the contact reader. 

3. The test pplication is currently connected to the card ap

which is acces

4. A valid Card H

5. Security conditions to read the object are met. 

Test Scenario 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Facial Image 

(2.16.840.1.101.3.7.2.96.48)>> 

3. Call pivGetData w/ 

• (IN) cardHandle

extract the first

dity Period

ader.

• (IN) OID 

• (OUT) data 

4. Extract the value field for tag 0xBC,

88 bytes (CBEFF Header) and read the Vali

field (based on its position) in CBEFF He

Expected Result(s) The Validity Period contains two dates and each is e

mat. 

ncoded in the

YYYYMMDDhhmmssZ for

9.2.2.7 Biometric Type Values

Purpose Validates that Biometric Type has the value 0x000002

References(s) 1. SP80076

2. AS05.01.02 

3. AS05.01.03 

4. AS05.01.10

Precondition(s) 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and 

ct reader.

accessible through card handle. 

older Facial Image object is present on the PIV card.

tions to read the object are met. 

the conta

3. The test application is currently connected to the card application 

which is

4. A valid Card H

5. Security condi

Test Scenario 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Facial Image 

(2.16.840.1.101.3.7.2.96.48)>>

3. Call pivGetData w/

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the Biometric Type field of CBEFF Header. 

5. Extract the value field for tag 0xBC, extract the first 

88 bytes (CBEFF Header) and read the Biometric Type field 

(based on its position) in CBEFF Header. 

Expected Result(s) The value of the Biometric Type field for the facial image is 0x000002 

 Page 61
Special Publication 800-85B PIV Data Model Testing Specification

9.2.2.8 Biometric Data Type 

Purpose Validates that the CBEFF biometric data type encod

ponds to the raw

ing value shall be

b001xxxxx, which corres biometric data.

References(s) 1. 

2.

3.

SP80076

AS05.01.02

AS05.01.11

Precondition(s) 1. All required sample finger images have been recorded. 

2. All templates have been generated and stored on the PIV card. 

3. A valid PIV card is inserted into the contact reader. 

4. A valid PC/SC connection exists between the test application and the

5. The test application is currently connected to the card application which 

cessible through card handle.

contact reader. 

is ac

6. A valid Card Holder Facial Image object is present on the PIV card. 

7. Security conditions to read the object are met. 

Test Scenario 1. Set cardHandle := <<valid card handle>>

2. Set OID := <<Card Holder Facial Image

(2.16.840.1.1

3. Call pivGetDa

01.3.7.2.96.48)>>

ta w/

andle

t

• (IN) cardH

• (IN) OID 

• (OUT) data 

4. Extract the Biometric Data Type field of CBEFF Header.

5. Extract the value field for tag 0xBC, extract the firs

88 bytes (CBEFF Header) and read the Biometric Data Type

field (based on its position) in CBEFF Header. 

Expected Result(s) The Biometric Data Type field has a value of b001xxxxx.

9.2.2.9 Biometric Data Quality

Purpose Validates that the biometric data quality field carries valid values 

References(s) 1. SP80076

2. AS05.01.02 

3. AS05.01.12 

Precondition(s) 1. A valid PIV card is inserted into

connection exists

the contact reader.

 between the test application and 

ion is currently connected to the card application 

ject are met. 

2. A valid PC/SC

 the contact reader. 

3. The test applicat

 which is accessible through card handle. 

4. A valid Card Holder Facial Image object is present on the PIV card.

5. Security conditions to read the ob

 Page 62
Special Publication 800-85B PIV Data Model Testing Specification

Test Scenario 1. Set cardHandle := <<valid card handle>>

cardHandle

a

CBEFF Header.

ct the first

sed on its position) in CBEFF Header.

2. Set OID := <<Card Holder Facial Image 

(2.16.840.1.101.3.7.2.96.48)>> 

3. Call pivGetData w/ 

• (IN)

• (IN) OID

• (OUT) dat

4. Extract the Biometric Data Quality field of

5. Extract the value field for tag 0xBC, extra

88 bytes (CBEFF Header) and read the Biometric Data 

Quality field (ba

Expected Result(s) The Biometric Data Quality field is -2. 

9.2.2.10 Creator Field Value

Purpose Validates that the Creator field in the PIV Patron Format contains 18 bytes 

ters, and the first of 

.

of which the first K <= 17 bytes shall be ASCII charac

the remaining 18-K shall be a null terminator (zero)

References(s) 1. SP80076

2. AS05.01.02

3. AS05.01.13

Precondition(s) 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and 

plication 

ject is present on the PIV card.

ead the object are met. 

 the contact reader. 

3. The test application is currently connected to the card ap

 which is accessible through card handle. 

4. A valid Card Holder Facial Image ob

5. Security conditions to r

Test Scenario Extract the value field for tag 0xBC, extract the first 88 

bytes (CBEFF Header) and read the Creator field (based on its 

position) in CBEFF Header. Start the following procedure at 

For

, check if zero.

 If no, fail. 

se iterate through remaining bytes in field and fail

the first byte of the Creator field:

bytes 0 to 16, check if byte represents an ASCII

character

 If yes, continue. 

Else

El

 iff non-zero. 

For bytes 17 through the end of the field, iterate through 

all bytes and fail if non-zero 

Expected Result(s) Procedure completes without failing.

 Page 63
Special Publication 800-85B PIV Data Model Testing Specification

9.2.2.11 FASC-N Value 

Purpose The FASC-N field in the PIV Patron Format shall contain the 25 bytes of

the FASC-N component of the CHUID identifier. 

References(s) 1. SP80076

2. AS05.01.02 

3. AS05.01.03 

4. AS05.01.14 

Precondition(s) 1. A valid PIV card is inserted into the contact rea

A valid PC/SC connection exists betwe

der.

en the test application and

3. The test application is currently connected to the card application 

 which is accessible through card handle. 

4. A valid Card Holder Facial Image object is present on the PIV card.

2.

the contact reader.

5. Security conditions to read the object are met. 

Test Scenario 1. Set cardHandle := <<valid card handle>>

Set OID := <<Card Holder Facial Image

)>>

2.

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the FASC-N field of CBEFF Header. 

5. Set cardHandle := <<valid card handle>> 

6. Set OID := <<Card Holder Unique Identifier 

(2.16.840.1.101.3.7.2.48.0)>> 

7. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

8. Extract the value field for tag 0xBC, extract the first 

88 bytes (CBEFF Header) and read the FASC-N field (based 

on its position) in CBEFF Header. 

(2.16.840.1.101.3.7.2.96.48

3. Call pivGetData w/ 

Expected Result(s) The FASC-N field in CBEFF header is the same as the one extracted from

the CHUID.

9.2.2.12 Reserved Field Value 

Purpose Validates that the “Reserved for Future Use” field is equal to 0x00000000. 

References(s) 1. SP80076

2. AS05.01.02 

3. AS05.01.03 

4. AS05.01.15 

 Page 64
Special Publication 800-85B PIV Data Model Testing Specification

Precondition(s) 1. A valid PIV card is inserted into the contact reader. 

lid PC/SC connection exists between the test application and 

 the contact reader. 

is currently connected to the card application 

et. 

2. A va

3. The test application

 which is accessible through card handle. 

4. A valid Card Holder Facial Image object is present on the PIV card.

5. Security conditions to read the object are m

Test Scenario 1. Set cardHandle := <<valid card handle>>

= <<Card Holder Facial Image

.1.101.3.7.2.96.48)>>

etData w/

rdHandle

D

ata

he value field for tag 0xBC, extract the first

(CBEFF Header) and read the “Reserved for Future

ld (based on its position) in CBEFF Header.

2. Set OID :

(2.16.840

3. Call pivG

• (IN) ca

• (IN) OI

• (OUT) d

4. Extract t

88 bytes

Use” fie

Expected Result(s) The field has a value of 0x00000000.

 

 Page 65
Special Publication 800-85B PIV Data Model Testing Specification

9.3 Fingerprint te

9.3.1 General Re

Templa

cord Header Conformance 

Purpose Verify that the General Record Header of the fingerprint template conforms

specifications in Table 3 of SP80076. 

 to 

Reference(s) 1. SP80076, Table 3 

2. AS05.01.03 

3. AS05.02.02 

4. AS05.02.03 

5. AS05.02.04 

6. AS05.02.05 

7. AS05.02.06 

8. AS05.02.07 

9. AS05.02.08 

10. AS05.02.09 

11. AS05.02.10 

12. AS05.02.11 

13. AS05.02.12

Precondition(s) 1. A valid PIV card

2. A valid PC/SC

is inserted into the contact reader. 

connection exists between the test application and 

der.

ation is currently connected to the card application 

ssible through card handle. 

Holder Fingerprints object is present on the PIV card. 

. Security conditions to read the object are met. 

the contact rea

3. The test applic

which is acce

4. A valid Card

5

Test Scenario 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Fingerprints 

(2.16.840.1.101.3.7.2.96.16)>>

arse the first 88

bytes (CBEFF Header) to obtain the BDB and SB lengths and then 

continue on to parse the General Record Header of the BDB 

a.Extract contents of Format Identifier. 

b.Extract contents of Version Number. 

c.Extract contents of Record Length field. 

d.Extract contents of CBEFF Product Identifier Owner 

e.Extract contents of CBEFF Product Identifier Type 

f.Extract contents of Capture Equipment Compliance field. 

g.Extract contents of Capture Equipment ID 

h.Extract contents of “Scanned Image in X Direction” field 

i.Extract contents of “Scanned Image in Y Direction” field 

j.Extract contents of X (horizontal) resolution. 

k.Extract contents of Y (vertical) resolution. 

l.Extract contents of “Number of Finger Views” field. 

m.Extract contents of Reserved Byte. 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the value field for tag 0xBC, p

 Page 66
Special Publication 800-85B PIV Data Model Testing Specification

Expected The expected values for each of the fields parsed in Step 4 above are given 

200

e of 0x20323030

c. R e a value less than the length specified in 

d. & e. Both these fields shall be non-zero The two most significant bytes 

shall identify the vendor while the least two significant bytes identifier the 

obtained from biometric 

below: 

a. Format Identifier has a value 0x4646D5

b. Version Number has a valu

ecord Length shall hav

version number of the minutiae detection algorithm. 

f. Capture Equipment Compliance has a value of 1000b 

g. Capture Equipment ID has a non-null value. 

h & i. These values shall be non-zero and shall be

enrollment records. 

j & k. X and Y resolution has a value of 197 

l. Number of Finger Views is 2 

m. Reserved Byte value is zero 

Result(s) 

9.3.2 View Header Conformance 

Purpose Verify that the View Header of the BDB conforms to specifications in Table

of SP800

3

76. 

Reference(s) 1. SP80076, Table 3 

2. AS05.01.03 

3. AS05.02.02 

4. AS05.02.13 

5. AS05.02.14 

6. AS05.02.16 

Precondition(s) 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and 

 the contact reader. 

ication is currently connected to the card application 

et. 

3. The test appl

 which is accessible through card handle. 

4. A valid Card Holder Fingerprints object is present on the PIV card. 

5. Security conditions to read the object are m

 Page 67
Special Publication 800-85B PIV Data Model Testing Specification

Test Scenario 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Fingerprints 

(2.16.840.1.101.3.7.2.96.16)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the value field for tag 0xBC, parse the first 88 

bytes (CBEFF Header) to obtain the BDB length and then continue 

to parse the View Header of the BDB

Extract Finger View Header fie

on

ld

.

a.

b. Extract contents of Finger Position

c. Extract contents of View Number. 

d. Extract contents of Impression Type.

e. Extract contents of Finger Quality. 

f. Extract contents of Number of Minutiae. 

5.Repeat steps 4a through 4f for the second view header. 

 

Expected 

Result(s) 

The expected values for each of the fields parsed in Step 4 above are given 

below: 

a. Finger View Header shall have the value ‘A’ 

b. Finger Position value shall be between 0 and 14. 

c. View Number shall be 0 if there is only one minutiae record for a finger. 

d. Impression Type is 0 or 2. 

e. Finger Quality value shall be between 60 and 100.

een 0 and 128.

The expected values for each of the fields parsed in Step 5 is the same as 

above. 

f. Number of Minutiae value shall be betw

9.3.3 Fingerprint Minutiae Data 

Purpose Verify that each instance of Fingerprint Minutiae data conforms to 

specifications in Table 3 of SP80076. 

Reference(s) 1. SP80076, Table 3 

2. AS05.02.02 

3. AS05.02.17 

4. AS05.02.19 

Precondition(s) 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and 

 the contact reader. 

3. The test application is currently connected to the card application 

 which is accessible through card handle. 

4. A valid Card Holder Fingerprints object is present on the PIV card. 

5. Security conditions to read the object are met. 

 Page 68
Special Publication 800-85B PIV Data Model Testing Specification

Test Scenario 1. Set cardHandle := <<valid card handle>> 

<<Card Holder Fingerprints

(2.16.840.1.101.3.7.2.96.16)>> 

/

e

4. Extract the value field for tag 0xBC, parse the first 88 

Header) to obtain the BDB length and then

following

a

b

c.Extract contents of Minutiae Angle. 

d

e.Extract contents of Extended Block Length. 

5. Repeat steps 4a to 4e for each Minutiae Data instance. 

2. Set OID :=

3. Call pivGetData w

• (IN) cardHandl

• (IN) OID 

• (OUT) data

bytes (CBEFF

continue on to parse the Minutiae data instances

the View Header of the BDB.

.Extract contents of Minutiae Type.

.Extract contents of Minutiae Position.

.Extract contents of Minutiae Quality.

Expected 

Result(s) 

T p 4 and 5 above are 

g

a. Minutiae Type value shall be either 01b or 10b (Ridge Ending or Ridge 

Bifur

b. Minutiae Position shall be one of the valid X,Y Coordinate position in the 

origin

c

d

e

he expected values for each of the fields parsed in S

iven below:

te

cation). 

al image. 

. Minutiae Angle value shall be between 0 and 179.

. Minutiae Quality shall be between 0 and 100 

. Extended Data Block Length shall be 0

 Page 69
Special Publication 800-85B PIV Data Model Testing Specification

9.4 Facial Image

9.4.1 Facial Image Hea

on PIV Card 

der Conformance 

Purpose Verify that the Record Header of the facial image is conformant to the PIV 

profile presented in Table 6 of SP80076. 

Reference(s) 1. SP80076, Table 6 

2. AS05.03.01 

3. AS05.03.02 

Precondition(s) 1. All required sample facial image is stored on the PIV card. 

2. rted into the contact reader. 

3. connection exists between the test application and the

n which

A valid PIV card is inse

A valid PC/SC

contact reader. 

4. The test application is currently connected to the card applicatio

is accessible through card handle. 

5. Security conditions to read the object are met.

Test Scenario 1. Set cardHandle := <<valid card handle>>

2. Set OID := <<Card Holder Facial Image

(2.16.840.1.101.3.7.2.96.48)>>

• (OUT) data 

4. Parse the contents of Facial Image Header Record. 

5. Extract contents of Format Identifier. 

6. Extract contents of Version Number. 

7. Extract contents of Record Length. 

8. Extract contents of Number of Facial Images. 

9. Extract contents of Number of Feature Points. 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

Expected 

Result(s) 

1. From Step 5: Format Identifier has a value 0x46414300. 

2. From Step 6: Version Number has a value of 0x30313000. 

3. From Step 7: The length of the record is less than the container size limit 

in SP80073-1. 

4. From Step 8: Number of Facial Images value is 1. 

5. From Step 9: Number of Feature Points is a positive value.

9.4.2 Facial Image Data Conformance 

Purpose Verify that the Facial Image Instance is conformant to the PIV profile 

presented in Table 6 of SP80076. 

Reference(s) 1. SP80076, Table 6 

2. AS05.03.01 

3. AS05.03.02 

 Page 70
Special Publication 800-85B PIV Data Model Testing Specification

Precondition(s) 1. All required sample facial image is stored on the PIV card. 

nto the contact reader.

ists between the test application and the

rrently connected to the card application which 

e through card handle.

5. Security conditions to read the object are met. 

2. A valid PIV card is inserted i

3. A valid PC/SC connection ex

contact reader. 

4. The test application is cu

is accessibl

Test Scenario 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Facial Image 

•

tents of Facial Image Instance Record

8. Extract contents of Source Type. 

(2.16.840.1.101.3.7.2.96.48)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

(IN) OID

• (OUT) data

4. Parse the con

5. Extract contents of Facial Image Type. 

6. Extract contents of Image Data Type. 

7. Extract contents of Image Color Space. 

Expected 

Result(s) 

1. Step 5: Facial Image Type is 1. 

2. Step 6: Image Data Type is 0 or 1. 

3. Step 7: Image Color Space is 1. 

4. Step 8: Source Type is 2 or 6. 

 Page 71
Special Publication 800-85B PIV Data Model Testing Specification

10. Signed Data Elements Test Assertions 

10.1 Card Holder Unique Identifier (CHUID) 

10.1.1 Signature Block 

10.1.1.1 Verify prese

Contents 

nce of CMS SignedData asymmetric digital signature 

Purpose Confirms that the CHUID buffer contains an asymmetric digital signature

implemented as a SignedData type in accordance with the Cryptographic 

Message Syntax as defined in RFC 3852. 

Reference(s) 1. FIPS201, Section 4.2.2 

2. AS06.01.01 

3. AS06.01.02 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the

d application 

4. is present on the PIV card.

contact reader.

3. The test application is currently connected to the car

which is accessible through card handle. 

A valid CHUID

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<CHUID (2.16.840.1.101.3.7.2.48.0)>>

4. ained CHUID and extract the contents from

c digital signature field (i.e. Tag 0x3E)

5. ntents of the digital signature

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

Parse the obt

the asymmetri

Process the co

Expected 

Result(s)

The CHUID buffer contains an asymmetric digital signature that is 

implemented as a SignedData type and is encoded as a CMS external

signature according to RFC 3852. 

10.1.1.2 Verify version in SignedData 

Purpose Confirms that the version of the SignedData content type is 3.

Reference(s) 1. FIPS201, Section 4.2.2 

2. AS06.01.03

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the 

contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card handle. 

4. A valid CHUID is present on the PIV card. 

 Page 72
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Set cardHandle := <<valid card handle>>

2. Set OID := <<CHUID (2.16.840.1.101.3.7.2.48.0)>> 

3

) OID

version field contents from the asymmetric

the CHUID

. Call pivGetData w/ 

• (IN) cardHandle 

• (IN

• (OUT) data 

4. Extract the

signature of

Expected 

Result(s)

The value of the version field of the SignedData is 3. 

10.1.1.3 Verify digest Algorithm in SignedData 

Purpose Confirm that the digestAlgorithms field of the SignedData content type is 

in accordance with Table 3-3 of SP80078. 

Reference(s) 1. SP80078, Section 3.2.1 

2. AS06.01.04

Precondition 1. d is inserted into the contact reader. 

2. nnection exists between the test application and the

d.

A valid PIV car

A valid PC/SC co

contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card handle. 

4. A valid CHUID is present on the PIV car

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<CHUID (2.16.840.1.101.3.7.2.48.0)>> 

etData w/

rdHandle

digestAlgorithms field contents from the

7. ract the

ey

ey

78

key

ed to sign the CHUID

 

3. Call pivG

• (IN) ca

• (IN) OID 

• (OUT) data 

4. Extract the

asymmetric digital signature of the CHUID

5. Extract the expiration date value from the CHUID (i.e. 

Tag 0x35) 

6. Extract the certificates field contents from the

asymmetric signature of the CHUID 

From the certificate obtained, ext

subjectPublicKeyInfo->subjectPublicK

8. Compute the size of the signer’s public k

9. Match the digest algorithm with Table 3-3 of SP800

based on the card expiration date, and the public

algorithm and size us

Expected 

Result(s)

The s field value of the SignedData is in accordance with 

Tab

digestAlgorithm

le 3-3 of SP80078. 

 Page 73
Special Publication 800-85B PIV Data Model Testing Specification

10.1.1.4 Verify contents of encapContentInfo

Purpose Confirms that the eContentType of the encapContentInfo is id-PIVCHUIDSecurityObject and the eContent field of the encapContentInfo is 

omitted. 

Reference(s) 1. FIPS201, Section 4.2.2 

2. AS06.01.05 

3. AS06.01.06

Precondition 1. A valid PIV card is inserted into the contact reader. 

connection exists between the test application and the

ble through card handle.

2. A valid PC/SC

contact reader. 

3. The test application is currently connected to the card application 

which is accessi

4. A valid CHUID is present on the PIV card. 

Test Steps 1. dle>>

.7.2.48.0)>>

4. arse the encapContentInfo field contents

etric digital signature of the CHUID

Set cardHandle := <<valid card han

2. Set OID := <<CHUID (2.16.840.1.101.3

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

Extract and p

from the asymm

Expected 

Result(s)

The eContent field has been omitted and the eContentType assert

CHUIDSecurityObject in encapContentInfo. 

s id-piv10.1.1.5 Verify crls field omission 

Purpose Confirm that the crls field from the SignedData content type is omitted. 

Reference(s) 1. FIPS201, Section 4.2.2 

2. AS06.01.08 

Precondition 1. A valid PIV card is inserted into the contact reader. 

ion exists between the test application and the

d application 

4. is present on the PIV card.

2. A valid PC/SC connect

contact reader.

3. The test application is currently connected to the car

which is accessible through card handle. 

A valid CHUID

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<CHUID (2.16.840.1.101.3.7.2.48.0)>>

• (IN) OID 

• (OUT) data 

4. Extract the crls field contents from the asymmetric 

digital signature of the CHUID 

3. Call pivGetData w/ 

• (IN) cardHandle 

 Page 74
Special Publication 800-85B PIV Data Model Testing Specification

Expected The crls field is omitted from the SignedData. 

Result(s)

10.1.1.6 Verify contents of signerInfos 

Purpose Confirms that the signerInfos in the SignedData is populated with a s

SignerInfo. 

ingle

Reference(s) 1. FIPS201, Section 4.2.2 

2. AS06.01.09 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the 

hrough card handle.

4. A valid CHUID is present on the PIV card. 

contact reader. 

3. The test application is currently connected to the card application

which is accessible t

Test Steps 1. Set cardHandle := <<valid card handle>> 

(2.16.840.1.101.3.7.2.48.0)>>

3. Call pivGetData w/ 

SignerInfos field contents from the

2. Set OID := <<CHUID

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the

asymmetric digital signature of the CHUID

Expected 

Result(s)

The signerInfos field in the SignedData contains a single SignerInfo. 

10.1.1.7 Verify Signer Identifier in SignerInfo 

Purpose Confirms that the sid in the SignerInfo uses the issuerAndSerialNumber 

choice. 

Reference(s) 1. FIPS201, Section 4.2.2 

2. AS06.01.10 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the 

contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card handle. 

4. A valid CHUID is present on the PIV card. 

 Page 75
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<CHUID (2.16.840.1.101.3.7.2.48.0)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the signerInfo->sid field contents from the 

asymmetric signature of the CHUID

asymmetric signature of the CHUID 

e

certificate obtained in the previous step 

5. Extract the certificates field contents from the 

6. Extract the issuer and serialNumber fields from th

Expected 

Result(s)

The ber choice and it 

corresponds to the issuer and serialNumber fields found in th

sid in the SignerInfo uses the issuerAndSerialNum

e X.509

certificate of the signer. 

10.1.1.8 Verify Digest Algorithm in SignerInfo

Purpose Confirm that the digestAlgorithm field of the SignerInfo is in accordance

with Table 3-3 of SP80078. 

Reference(s) 1. SP80078, Section 3.2.1 

2. AS06.01.11 

Precondition 1. A valid PIV card is inserted into the c

2. A valid PC/SC connection exists between the test application and the 

ontact reader.

A valid CHUID is present on the PIV card. 

contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card handle. 

4. 

 Page 76
Special Publication 800-85B PIV Data Model Testing Specification

1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<CHUID (2.16.840.1.101.3.7.2.48.0)>> 

e expiration date value from the CHUID (i.e.

6. Extract the certificates field contents from the 

re of the CHUID

te obtained, extract the

80078

nd the public key

lgorithms field contents from the

igital signature of the CHUID i.e.

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the SignerInfo->digestAlgorithm field contents 

from the asymmetric digital signature of the CHUID 

5. Extract th

Tag 0x35) 

Test Steps 

asymmetric signatu

7. From the certifica

subjectPublicKeyInfo->subjectPublicKey 

8. Compute the size of the signer’s public key 

9. Match the digest algorithm with the Table 3-3 of SP

based on the card expiration date, a

algorithm and size used to sign the CHUID 

10. Extract the digestA

asymmetric d

SignedData 

Expected The digestAlgorithm field value of the SignerInfo is in accordance with 

Result(s) Table 3-3 of SP80078 and it matches the value present in the 

digestAlgorithms field of the SignedData. 

10.1.1.9 Verify message digest signed attribute in SignerInfo 

Purpose Confirms that the signedAttrs

attri h c

of the SignerInfo includes a message digest

omputed over the concatenated contents of 

the CHUID, excluding the asymmetric signature field. 

bute containing the has

Reference(s) 1. FIPS201, Section 4.2.2

2. AS06.01.12 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the

contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card handle. 

4. A valid CHUID is present on the PIV card. 

1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<CHUID (2.16.840.1.101.3.7.2.48.0)>> 

3. Call pivGetData w/ 

Test Steps

• (IN) cardHandle 

• (OUT) data 

13549.1.9.4)

• (IN) OID 

4. Parse the SignerInfo-> signedAttrs field contents from

the asymmetric signature field of the CHUID to locate 

the message digest attribute (OID=1.2.840.1

and its corresponding attribute value 

 Page 77
Special Publication 800-85B PIV Data Model Testing Specification

5. Extract the SignerInfo->digestAlgorithm field contents

mmetric digital signature of the CHUID

previous

from the asy

6. Using the digest Algorithm obtained in the

step, calculate the hash of the concatenated contents of

the CHUID, excluding the asymmetric digital signature 

field 

Expected 

Result(s)

The value of the hash obtained from the message digest attribute of the

signedAttrs of the SignerInfo is identical to that obtained after hashing the 

concatenated contents of the CHUID, excluding the asymmetric digital 

signature field. 

10.1.1.10Verify PIV signer distinguished name

Purpose Confirms that the signedAttrs of the SignerInfo includes the pivSignerDN attribute containing the subject name that appears in the X.509 

certificate for the entity that signed the CHUID. 

Reference(s) 1. FIPS201, Section 4.2.2 

2. AS06.01.13 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the

3. 

accessible through card handle.

4. A valid CHUID is present on the PIV card. 

contact reader. 

The test application is currently connected to the card application 

which is

Test Steps 1. Set cardHandle := <<valid card handle>> 

:= <<CHUID (2.16.840.1.101.3.7.2.48.0)>>

3. Call pivGetData w/ 

N) OID

gnerInfo-> signedAttrs field contents from 

ic signature field of the CHUID to locate

.101.3.6.5)

in

2. Set OID

• (IN) cardHandle 

• (I

• (OUT) data 

4. Parse the Si

the asymmetr

the pivSigner-DN attribute (OID=2.16.840.1

5. Extract the certificates field contents from the 

asymmetric signature of the CHUID. 

6. Extract the subject DN from the certificate obtained

the previous step 

Expected 

Result(s)

The certificate in the

that obtained from the 

pivSigner-DN attribute of the signedAttrs of the SignerInfo. 

value of the subject DN obtained from the

certificates field in the SignedData is identical to

10.1.1.11Verify signature algorithm in SignerInfo 

Purpose Confirms that the signatureAlgorithm field specified in the SignerInfo 

field is in accordance with Table 3-4 of SP80078 and based on the PIV card 

expiration date in accordance with Table 3-3 of SP80078. 

 Page 78
Special Publication 800-85B PIV Data Model Testing Specification

Reference(s) 1. SP80078 , Section 3.2.1 

2. AS06.01.14 

Precondition 1. A valid PIV card is insert

A valid PC/SC connect

ed into the contact reader. 

2. ion exists between the test application and the

3. on is currently connected to the card application 

4. 

contact reader. 

The test applicati

which is accessible through card handle. 

A valid CHUID is present on the PIV card. 

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<CHUID (2.16.840.1.101.3.7.2.48.0)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

ct the expiration date value from the CHUID (i.e.

Tag 0x35) 

Info->signatureAlgorithm field

contents. 

4. Extra

5. Extract the Signer

Expected

Result(s)

1

2 ion date value is earlier than or equal to the 

fied in Table 3-3 of SP80078 for the algorithm from

. From Step 5: The signatureAlgorithm value is in accordance with 

Table 3-4 of SP80078

. From Step 4: The expirat

sunset date speci

Step 5.

10.1.1.12Verify digital signature

Purpose C i sponds to the signed

C

onf rms that the signature in the SignerInfo corre

HUID

Reference(s) 1

2

3. A

. FIPS201, Section 4.2.2 

. AS06.01.07

S06.01.15

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the 

o

3. T n

4. A

c ntact reader. 

he test application is currently connected to the card applicatio

which is accessible through card handle.

valid CHUID is present on the PIV card.

 Page 79
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Set cardHandle := <<valid card handle>>

2. Set OID := <<CHUID (2.16.840.1.101.3.7.2.48.0)>> 

3

4 rtificates field contents from the

5

6

located in the asymmetric signature field of the CHUID. 

. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data

. Extract the ce

asymmetric signature of the CHUID.

. Extract the asymmetric signature contents from the CHUID 

. Using the certificate extracted, verify the SignedData 

Expected 

Result(s)

T e

can be SignerInfo.

he c rtificates field in the SignedData contains a single certificate that 

used to verify the digital signature in the

10.1.2 Embedded Ce

10.1.2.1 Verify extended k

rtificate 

ey usage extension

Purpose Confirms that the digital signature certificate used to sign the CHUID 

asserts id-PIV-content-signing in the extendedKeyUsage extension. 

Reference(s) 1. FIPS201, Section 4.2.2 

2. AS06.01.16 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and

ard application 

which is accessible through card handle. 

the contact reader. 

3. The test application is currently connected to the c

4. A valid CHUID is present on the PIV card. 

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<CHUID (2.16.840.1.101.3.7.2.48.0)>>

N) OID

• (OUT) data 

4. Extract the certificates field contents from the 

asymmetric signature of the CHUID

5. Extract all KeyPurposeId fields from the extended key 

usage extension from the certificate obtained

3. Call pivGetData w/ 

• (IN) cardHandle 

• (I

Expected Result(s) A KeyPurposeId asserting id-PIV-content-signing exists in the extended 

key usage extension. 

 Page 80
Special Publication 800-85B PIV Data Model Testing Specification

10.1.2.2 Verify signer public key size 

Purpose Confirms that the size of the public key for digital signature used to sign 

the CHUID is based on the expiration of the PIV card and is in 

accordance with Table 3-3 of SP80078. 

Reference(s) 1. SP80078, Section 3.1 

2. AS06.01.17 

Precondition 1. A valid PIV card is inserted into the contact reader.

.

cation is currently connected to the card application 

.

2 A valid PC/SC connection exists between the test application and 

the contact reader.

3. The test appli

which is accessible through card handle.

4 A valid CHUID is present on the PIV card. 

Test Steps 1. Set cardHandle := <<valid card handle>> 

2 Set OID := <<CHUID (2.16.840.1.101.3.7.2.48.0)>>

3. Call pivGetData w/ 

• (IN) cardHandle 

.

om the CHUID (i.e. Tag

5. ficates field contents from the

signature of the CHUID.

6. jectPublicKeyInfo->algorithm->algorithm

y

• (IN) OID 

• (OUT) data 

4. Extract the expiration date fr

0x35) 

Extract the certi

asymmetric

Extract sub

field value 

7. From the obtained certificate, extract the 

subjectPublicKeyInfo->subjectPublicKey 

Note: - Since the ECDSA keys do not have any size

restrictions based on dates, this test case does not appl

to these types of keys

Expected Result(s) Verify that the size of the key from Step 7, algorithm from Step 6 and 

expiration date from Step 4 are consistent with entries in Table 3-3 of 

SP80078. 

 Page 81
Special Publication 800-85B PIV Data Model Testing Specification

10.2 Fingerprint B

10.2.1 Signature B

10.2.1.1 Verify presence mmetric digital signature 

iometric

lock Contents 

of CMS SignedData asy

Purpose Confirms that the CBEFF_SIGNATURE_BLOCK is implemented as a 

SignedData type and is encoded as a Cryptographic Message Syntax 

external digital signature as defined in RFC 3852 

Reference(s) 1. FIPS201, Section 4.4.2 

2. AS06.02.01 

3. AS06.02.02 

Precondition 1. A valid PIV card is inserted into the contact reader.

2. A valid PC/SC connection exists between the test application and the 

rrently connected to the card application 

is present on the PIV card.

contact reader. 

3. The test application is cu

which is accessible through card handle. 

4. A valid card holder fingerprint object

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Fingerprints

101.3.7.2.96.16)>>

m

5. Process the contents of the digital signature 

(2.16.840.1.

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Parse the obtained biometric and extract the contents

from the asymmetric digital signature field (i.e. fro

the CBEFF_SIGNATURE_BLOCK) 

Expected 

Result(s)

The CBEFF_SIGNATURE_BLOCK is present in the biometric CBEFF 

structure containing an asymmetric digital signature that is implemented 

as a SignedData type according to RFC 3852. 

10.2.1.2 Verify version in SignedData 

Purpose Confirms that the version of the SignedData content type is v1 or v3. 

Reference(s) 1. FIPS201, Section 4.4.2 

2. AS06.02.03 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the 

contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card handle. 

4. A valid card holder fingerprint object is present on the PIV card. 

 Page 82
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Fingerprints 

(2.16.840.1.101.3.7.2.96.16)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the version field contents from the 

CBEFF_SIGNATURE_BLOCK 

5. Extract the certificates field contents from the 

CBEFF_SIGNATURE_BLOCK (if present) 

Expected 

Result(s)

The value of the version field of the SignedData is v1 if the certificates

field is omitted and v3 if present.

10.2.1.3 Verify digest Algorithm in SignedData 

Purpose Confirm that the digestAlgorithms field of the SignedData content type is

in accordance with Table 3-3 of SP80078. 

Reference(s) 1. 

2.

SP80078 , Section 3.2.1 

AS06.02.04

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the

4. 

5. ent on the PIV card.

contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card handle. 

A valid card holder fingerprint object is present on the PIV card. 

A valid CHUID object is pres

 Page 83
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Fingerprints 

(2.16.840.1.101.3.7.2.96.16)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the digestAlgorithms field contents from the 

CBEFF_SIGNATURE_BLOCK 

5. Extract the certificates field contents from the 

CBEFF_SIGNATURE_BLOCK (if pr

6. Set OID := <<CHUID (2.16.840

esent)

.1.101.3.7.2.48.0)>>

7. Call pivGetData w/ 

ion date value from the CHUID (i.e.

icates field

gnature of the CHUID

step 4 with

xpiration date,

size used to sign the

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

8. Extract the expirat

Tag 0x35) 

9. If a certificate extracted from the certif

of the CBEFF_SIGNATURE_BLOCK does not exist, then

extract the certificates field contents from the 

asymmetric si

10. From the certificate obtained (either from the 

CBEFF_SIGNATURE_BLOCK or the CHUID signature field), 

extract the subjectPublicKeyInfo->subjectPublicKey 

11. Compute the size of the signer’s public key 

12. Match the digest algorithm obtained from

Table 3-3 of SP80078 based on the card e

and the public key algorithm and

fingerprint biometric

Expected 

Result(s)

The value of the SignedData is in accordance with 

Tab . 

digestAlgorithms field

le 3-3 of SP80078

10.2.1.4 Verify contents of encapContentInfo

Purpose Confirms that the eContentType of the encapContentInfo is id-PIVbiometricObject and the eContent field of the encapContentInfo is 

omitted. 

Reference(s) 1. FIPS201, Section 4.4.2

2. AS06.02.05 

3. AS06.02.06 

Precondition 1. A valid PIV card is inserted into the contact reader. 

ion exists between the test application and the

tion is currently connected to the card application 

which is accessible through card handle. 

4. A valid card holder fingerprint object is present on the PIV card. 

2. A valid PC/SC connect

contact reader.

3. The test applica

 Page 84
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Fingerprints 

(2.16.840.1.101.3.7.2.96.16)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract and parse the encapContentInfo

from the CBEFF_SIGNATURE_BLOCK 

field contents

Expected 

Result(s)

The eContent field has been o

etricObject in encapCo

mitted and the eContentType asserts id-pivbiom ntentInfo.

10.2.1.5 Verify crls field omission

Purpose Confirm that the crls field from the SignedData content type is omitted.

Reference(s) 1. FIPS201, Section 4.4.2 

2. AS06.02.08 

Precondition 1. A valid PIV card is inserted into the contact reader. 

ction exists between the test application and the

ch is accessible through card handle.

gerprint object is present on the PIV card. 

2. A valid PC/SC conne

contact reader. 

3. The test application is currently connected to the card application 

whi

4. A valid card holder fin

Test Steps 1. Set cardHandle := <<valid card handle>>

2. Set OID := <<Card Holder Fingerprints 

(2.16.840.1.101.3.7.2.96.16)>> 

3. Call pivGetData w/ 

• (IN) cardHandle

• (IN) OID 

• (OUT) data 

4. Extract the crls field contents from the

CBEFF_SIGNATURE_BLOCK 

Expected 

Result(s)

The crls field is omitted from the SignedData.

10.2.1.6 Verify contents of signerInfos 

Purpose Confirms that the signerInfos in the SignedData is populated with a single

SignerInfo. 

Reference(s) 1. FIPS201, Section 4.4.2 

2. AS06.02.09 

 Page 85
Special Publication 800-85B PIV Data Model Testing Specification

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and

contact reader. 

the

3. The test application is currently connected to the card application 

which is accessible through card handle. 

4. A valid card holder fingerprint object is present on the PIV card. 

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Fingerprints 

(2.16.840.1.101.3.7.2.96.16)>>

Call pivGetData w/ 

4. ignerInfos field contents from the

3. 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

Extract the S

CBEFF_SIGNATURE_BLOCK 

Expected 

Result(s)

The signerInfos field in the SignedData contains a single SignerInfo. 

10.2.1.7 Verify Signer Identifier in SignerInfo 

Purpose Confirms that the sid in the Si

cho

gnerInfo uses the issuerAndSerialNumber 

ice.

Reference(s) 1. FIPS201, Section 4.4.2

2. AS06.02.10 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the

ugh card handle.

4. er fingerprint object is present on the PIV card. 

contact reader. 

3. The test application is currently connected to the card application 

which is accessible thro

A valid card hold

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Fingerprints 

(2.16.840.1.101.3.7.2.96.16)>>

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the signerInfo->sid field contents from the

CBEFF_SIGNATURE_BLOCK 

5. Extract the certificates field contents from the 

BEFF_SIGNATURE_BLOCK (if present)

f a certificate extracted from the certificates field

C

6. I

asymmetric signature of the CHUID 

of the CBEFF_SIGNATURE_BLOCK does not exist, then 

extract the certificates field contents from the 

7. Extract the issuer and serialNumber fields from the 

certificate obtained in the previous step 

 Page 86
Special Publication 800-85B PIV Data Model Testing Specification

Expected The sid in the SignerInfo uses the issuerAn

Result(s)

dSerialNumber choice which 

corresponds to the issuer and serialNumber fields found in the X.509 

certificate of the signer. 

10.2.1.8 Verify Digest Algorithm in SignerInfo

Purpose Confirm that the digestAlgorithm field of the SignerInfo is in accordance 

with Table 3-3 of SP80078. 

Reference(s) 1. SP80078, Section 3.2.1

2. AS06.02.11 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the

3. to the card application 

the PIV card.

d.

contact reader. 

The test application is currently connected

which is accessible through card handle. 

4. A valid card holder fingerprint object is present on

5. A valid CHUID object is present on the PIV car

Test Steps 1. Set cardHandle := <<

2. Hol

valid card handle>>

der Fingerprints

.2.96.16)>>

3. ta w/

dle

5. the

d

OCK does not exist, then

extract the certificates field contents from the 

asymmetric signature of the CHUID 

te obtained (either from the

OCK or the CHUID signature field),

h

xpiration date,

ic

digestAlgorithms field contents from the

CBEFF_SIGNATURE_BLOCK 

Set OID := <<Card

(2.16.840.1.101.3.7

Call pivGetDa

• (IN) cardHan

• (IN) OID 

• (OUT) data 

4. Extract the SignerInfo->digestAlgorithm field from the 

CBEFF_SIGNATURE_BLOCK 

Extract the certificates field contents from

CBEFF_SIGNATURE_BLOCK (if present) 

6. Set OID := <<CHUID (2.16.840.1.101.3.7.2.48.0)>>

7. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

8. Extract the expiration date value from the CHUID (i.e. 

Tag 0x35) 

9. If a certificate extracted from the certificates fiel

of the CBEFF_SIGNATURE_BL

10. From the certifica

CBEFF_SIGNATURE_BL

extract the subjectPublicKeyInfo->subjectPublicKey 

11. Compute the size of the signer’s public key 

12. Match the digest algorithm obtained from step 4 wit

Table 3-3 of SP80078 based on the card e

and the public key algorithm and size used to sign the 

fingerprint biometr

11. Extract the

Expected 

Result(s)

The digestAlgorithm field value of the SignerInfo is in accordance with 

Table 3-3 of SP80078 and it matches the value present in the 

 Page 87
Special Publication 800-85B PIV Data Model Testing Specification

Result(s) digestAlgorithms field of the SignedData. 

10.2.1.9 Verify message digest signed attribute in SignerInfo 

Purpose Confirms that the signedAttrs of the SignerInfo includes a message dig

nated

est

D

attribute containing the hash computed over the concate

CBEFF_HEADER and the STD_BIOMETRIC_RECOR

Reference(s) 1. FIPS201, Section 4.2.2 

2. AS06.02.12 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. connection exists between the test application and the

3. on is currently connected to the card application 

4. 

A valid PC/SC

contact reader. 

The test applicati

which is accessible through card handle. 

A valid card holder fingerprint object is present on the PIV card. 

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Fingerprints 

(2.16.840.1.101.3.7.2.96.16)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Parse the SignerInfo-> signedAttrs field contents

the CBEFF_SIGNATURE_BLOCK to locate the message digest

attribute (OID=1.2.840.113549.1.9.4) and its 

corresponding attribute value 

from

5. Extract the SignerInfo->digestAlgorithm field contents 

from the CBEFF_SIGNATURE_BLOCK 

Using the digest Algorithm obtained in the previous 

step, compute the hash over the concatenated 

6. 

CBEFF_HEADER and the STD_BIOMETRIC_RECORD 

Expected 

Result(s)

T

signedAttrs of the SignerInfo is identical to that obtained after hashing the 

concaten ingerprint Object buffer, excluding the 

C CK. 

he value of the hash obtained from the message digest attribute of the 

ated contents of the F

BEFF_SIGNATURE_BLO

10.2.1.10Verify PIV signer distinguished name

Purpose Confir

DN at pears in the X.509 

c i

ms that the signedAttrs of the SignerInfo includes the pivSignertribute containing the subject name that ap

ertif cate for the entity that signed the biometrics. 

Reference(s) 1

2. AS06.02.13 

. FIPS201, Section 4.2.2 

 Page 88
Special Publication 800-85B PIV Data Model Testing Specification

Precondition 1

2 application and the

3 ation

which is accessible through card handle. 

4. A valid card holder fingerprint object is present on the PIV card. 

5. A valid CHUID object is present on the PIV card. 

. A valid PIV card is inserted into the contact reader. 

. A valid PC/SC connection exists between the test

contact reader. 

. The test application is currently connected to the card applic

Test Steps 1

2. 

(

3. C

•

4. Parse the SignerInfo-> signedAttrs field contents from 

6

of the CBEFF_SIGNATURE_BLOCK does not exist, then 

extract the certificates field contents from the 

of the CHUID

7. Extract the subject DN from the certificate obtained in 

. Set cardHandle := <<valid card handle>> 

Set OID := <<Card Holder Fingerprints

2.16.840.1.101.3.7.2.96.16)>>

all pivGetData w/

• (IN) cardHandle 

• (IN) OID

(OUT) data

the CBEFF_SIGNATURE_BLOCK to locate the pivSigner-DN 

attribute (OID=2.16.840.1.101.3.6.5) 

5. Extract the certificates field contents from the 

CBEFF_SIGNATURE_BLOCK 

. If a certificate extracted from the certificates field

asymmetric signature

the previous step 

Expected 

Result(s)

The value of the subject DN obtained from the certificate in the 

certificates field in the SignedData is identical to that obtained from the 

pivSigner-DN attribute of the signedAttrs of the SignerInfo. 

10.2.1.11 Verify FASC-N 

Purpose Co ignedAttrs of the SignerInfo includes the pivFASC-N 

of

nfirms that the s

attribute whose value matches the value of the FASC-N in the CHUID

the PIV card.

Reference(s) 1 FIPS201, Section 4.4.2 

2. AS06.02.14 

.

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and 

the contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card handle. 

4. A valid card holder fingerprint object is present on the PIV card. 

5. A valid CHUID object is present on the PIV card. 

 Page 89
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Set cardHandle := <<valid card handle>>

3. ith the following parameters

Handle

4. SignerInfo-> signedAttrs field contents from 

he pivFASC-N

3.6.6) and its

bute value

(2.16.840.1.103.3.7.2.48.0)>>

6. Data with the following parameters

Handle

7. and extract the FASC-N

2. Set OID := <<Card Holder Fingerprints 

(2.16.840.1.101.3.7.2.96.16)>>

Call pivGetData w

• (IN) card

• (IN) OID 

• (OUT) data 

Parse the

the CBEFF_SIGNATURE_BLOCK to locate t

attribute (OID=2.16.840.1.101.

corresponding attri

5. Set OID := <<CHUID

Call pivGet

• (IN) card

• (IN) OID 

• (OUT) data 

Parse the CHUID

Expected Result(s) A pivFASC-N attribute exists in the signedAttrs of the SignerInfo and 

its value matches the FASC-N present in the CHUID of the PIV card. 

10.2.1.12Verify signature algorithm in SignerInfo 

Purpose Confirms that the signatureAlgorithm field specified in the SignerInfo 

field is in accordance with Table 3-4 of SP80078 and based on the PIV card 

expiration date in accordance with Table 3-3 of SP80078. 

Reference(s) 1. , Section 3.2.1 

2. AS06.02.15 

SP80078

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the

contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card handle.

4. A valid card holder fingerprint object is present on the PIV card. 

5. A valid CHUID object is present on the PIV card.

 Page 90
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<CHUID (2.16.840.1.101.3.7.

3. Call pivGetData w/ 

2.48.0)>>

n date value from the CHUID (i.e.

5. Card Holder Fingerprints

1.3.7.2.96.16)>>

6. a w/

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the expiratio

Tag 0x35) 

Set OID := <<

(2.16.840.1.10

Call pivGetDat

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

7. Extract the SignerInfo->signatureAlgorithm field. 

Expected 

Result(s)

1. From Step 7: The signatureAlgorithm value is in accordance with 

Table 3-4 of SP80078

2. From Step 4: The expiration date value is earlier than or equal to

sunset date sp

the 

ecified in Table 3-3 of SP80078 for the algorithm from

Step 7. 

10.2.1.13Verify digital signature

Purpose Confir

b

ms that the signature in the SignerInfo corresponds to the signed 

iometric 

Reference(s) 1

2. AS06.02.07 

3

. FIPS201, Section 4.2.2

. AS06.02.16

Precondition 1

2

3. T currently connected to the card application 

4. A rd.

5

. A valid PIV card is inserted into the contact reader. 

. A valid PC/SC connection exists between the test application and the 

contact reader. 

he test application is

which is accessible through card handle.

valid card holder fingerprint object is present on the PIV ca

. A valid CHUID object is present on the PIV card.

 Page 91
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Set cardHandle := <<valid card handle>> 

. Set OID := <<Car

(2.16.840.1.101.

2 d Holder Fingerprints

3.7.2.96.16)>>

3. Extract the certificates field contents from the 

certificate from the CHUID signature

4. 

5

6 gital signature string from

7

CBEFF_SIGNATURE_BLOCK or the CHUID asymmetric signature, 

CBEFF_SIGNATURE_BLOCK. If this field is omitted then 

extract the

Set OID := <<CHUID (2.16.840.1.101.3.7.2.48.0)>> 

. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data

. Extract the di

CBEFF_SIGNATURE_BLOCK.

. Using the certificate extracted either from the

verify the signature on the biometric

Expected 

Result(s)

T e

ca e

certif Data

fo verify the

d

he c rtificates field in the SignedData contains a single certificate that 

n b used to verify the digital signature in the SignerInfo. If the

icates field is omitted, then the certificates field of the Signed

r the CHUID contains the certificate that can be used to

igital signature.

10.2.2 Embedded Certific

10.2.2.1 Verify extended k on

ate 

ey usage extensi

Purpose Confirms that the digital signature certificate used to sign the fingerp

etric asserts id-PIV-content-signing in the extendedKeyUsage 

rint

biom

extension. 

Reference(s) 1. 

2.

FIPS201, Section 4.2.2 

AS06.02.17

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and

the contact reader. 

3. The test application is currently connected to the card application

which is accessible through card handle. 

4. A valid card holder fingerprint I is present on the PIV card. 

Test Steps 1.

2.

handle>>

Set OID := <<Card Holder Fingerprints 

F_SIGNATURE_BLOCK. If the certificate field is

omitted, then stop execution of this test assertion.

5. Extract all KeyPurposeId fields from the extended key 

usage extension from the certificate obtained

Set cardHandle := <<valid card

(2.16.840.1.101.3.7.2.96.16)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the certificates field contents from the 

CBEF

 Page 92
Special Publication 800-85B PIV Data Model Testing Specification

Expected Result(s) A KeyPurposeId asserting id-PIV-content-signing exists in the extended 

key usage extension. 

10.2.2.2 Verify signer public key size 

Purpose Confirms that the size of the public key for digital signature used to sig

the biometrics is based on the expiration of the PIV card and is in 

accordance with Table 3-3 of SP80078. 

n

Reference(s) 1. SP80078, Section 3.1 

2. AS06.02.18

Precondition 1. A valid PIV card is inserted into the contact reader. 

2 A valid PC/SC connection exists between the test application and 

the contact reader. 

The test applic

.

.

3. ation is currently connected to the card application 

which is accessible through card handle. 

4. A valid card holder fingerprint I is present on the PIV card

Test Steps 1. Set cardHandle := <<valid card handle>>

2. Set OID := <<Card Holder Fingerprints 

(2.16.840.1.101.3.7.2.96.16)>> 

3. Call pivGetData w/

• (IN) cardHandle 

• (IN) OID

• (OUT) data

Extract the

)>>

7. Extract the expiration date from the CHUID (i.e. Tag 

8. Extract subjectPublicKeyInfo->algorithm->algorithm 

ate obtained

o size

e

4. certificates field contents from the

CBEFF_SIGNATURE_BLOCK. If the certificate field is 

omitted, then stop execution of this test assertion 

5. Set OID := <<CHUID (2.16.840.1.101.3.7.2.48.0

6. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

0x35) 

field value from the certificate obtained 

9. Extract the subjectPublicKeyInfo->subjectPublicKey 

from the certific

N te: - Since the ECDSA keys do not have any

r strictions based on dates, this test case does not apply

to these types of keys

Expected Result(s) Verify that the size of the key from Step 9, algorithm from Step 8 and

expiration date from Step 7 are consistent with entries in Table 3-3 of

SP80078. 

 Page 93
Special Publication 800-85B PIV Data Model Testing Specification

10.3 Facial Image

10.3.1 Signature B

10.3.1.1 Verify presence mmetric digital signature 

Biometric

lock Contents 

of CMS SignedData asy

Purpose Confirms that the CBEFF_SIGNATURE_BLOCK is implemented as a 

SignedData type and is encoded as a Cryptographic Message Syntax 

external digital signature as defined in RFC 3852 

Reference(s) 1. FIPS201, Section 4.4.2 

2. AS06.03.01 

3. AS06.03.02 

Precondition 1. A valid PIV card is inserted into the contact reader.

2. A valid PC/SC connection exists between the test application and the 

rrently connected to the card application 

esent on the PIV card.

contact reader. 

3. The test application is cu

which is accessible through card handle. 

4. A valid card holder facial image is pr

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Facial Image

101.3.7.2.96.48)>>

ents

from

5. Process the contents of the digital signature 

(2.16.840.1.

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Parse the obtained biometric and extract the cont

from the asymmetric digital signature field (i.e.

the CBEFF_SIGNATURE_BLOCK) 

Expected 

Result(s)

The CBEFF_SIGNATURE_BLOCK is present in the biometric CBEFF 

structure containing an asymmetric digital signature that is implemented 

as a SignedData type according to RFC 3852. 

10.3.1.2 Verify version in SignedData 

Purpose Confirms that the version of the SignedData content type is v1 or v3. 

Reference(s) 1. FIPS201, Section 4.4.2 

2. AS06.03.03 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the 

contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card handle. 

4. A valid card holder facial image is present on the PIV card. 

 Page 94
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Facial Image 

(2.16.840.1.101.3.7.2.96.48)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the version field contents from the 

CBEFF_SIGNATURE_BLOCK 

5. Extract the certificates field contents from the 

CBEFF_SIGNATURE_BLOCK (if present)

Expected 

Result(s)

The value of the version field

v3 if pr

of the SignedData is v1 if the certificates 

field is omitted and esent.

10.3.1.3 Verify digest Algorithm in SignedData 

Purpose Con ype is

in ac

firm that the digestAlgorithms field of the SignedData content t

cordance with Table 3-3 of SP80078. 

Reference(s) 1. SP80078, Section 3.2.1 

2. AS06.03.04

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the

contact reader. 

3. The test application is currently connected to the card application 

r facial image is present on the PIV card. 

5. A valid CHUID is present on the PIV card. 

which is accessible through card handle. 

4. A valid card holde

 Page 95
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Facial Image 

(2.16.840.1.101.3.7.2.96.48)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data

4. gestAlgorithms field contents from the

• (IN) cardHandle 

• (IN) OID 

ata

URE_BLOCK does not exist, then

cates field contents from the

the

ubjectPublicKeyInfo->subjectPublicKey

date,

n the

Extract the di

CBEFF_SIGNATURE_BLOCK 

5. Extract the certificates field contents from the 

CBEFF_SIGNATURE_BLOCK (if present) 

6. Set OID := <<CHUID (2.16.840.1.101.3.7.2.48.0)>> 

7. Call pivGetData w/ 

• (OUT) d

8. Extract the expiration date value from the CHUID (i.e. 

Tag 0x35) 

9. If a certificate extracted from the certificates field

of the CBEFF_SIGNAT

extract the certifi

asymmetric signature of the CHUID

10. From the certificate obtained (either from

CBEFF_SIGNATURE_BLOCK or the CHUID signature field), 

extract the s

11. Compute the size of the signer’s public key 

12. Match the digest algorithm obtained from step 4 with 

Table 3-3 of SP80078 based on the card expiration

and the public key algorithm and size used to sig

facial image biometric 

Expected 

Result(s)

The digestAlgorithms field value of the SignedData is in accordance with

Table 3-3 of SP80078. 

10.3.1.4 Verify contents of encapContentInfo

Purpose Confirms that the eContentType of the encapContentInf

biometricObject and the eContent field of the encapCon

o is id-PIVtentInfo is

omitted. 

Reference(s) 1. FIPS201, Section 4.4.2 

2. AS06.03.05 

3. AS06.03.06 

Precondition 1. A valid PIV card is inserted into the contact reader. 

application is currently connected to the card application 

ugh card handle.

lder facial image is present on the PIV card. 

2. A valid PC/SC connection exists between the test application and the 

contact reader. 

3. The test

which is accessible thro

4. A valid card ho

 Page 96
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Facial Image 

(2.16.840.1.101.3.7.2.96.48)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract and parse the encapContentInfo

from the CBEFF_SIGNATURE_BLOCK 

field contents

Expected 

Result(s)

The eContent field has been o

etricObject in encapCo

mitted and the eContentType asserts id-pivbiom ntentInfo.

10.3.1.5 Verify crls field omission

Purpose Confirm that the crls field from the SignedData content type is omitted.

Reference(s) 1. FIPS201, Section 4.4.2 

2. AS06.03.08 

Precondition 1. A valid PIV card is inserted into the contact reader. 

ction exists between the test application and the

ch is accessible through card handle.

ial image is present on the PIV card. 

2. A valid PC/SC conne

contact reader. 

3. The test application is currently connected to the card application 

whi

4. A valid card holder fac

Test Steps 1. Set cardHandle := <<valid card handle>>

2. Set OID := <<Card Holder Facial Image 

(2.16.840.1.101.3.7.2.96.48)>> 

3. Call pivGetData w/ 

• (IN) cardHandle

• (IN) OID 

• (OUT) data 

4. Extract the crls field contents from the

CBEFF_SIGNATURE_BLOCK 

Expected 

Result(s)

The crls field is omitted from the SignedData.

10.3.1.6 Verify contents of signerInfos 

Purpose Confirms that the signerInfos in the SignedData is populated with a single

SignerInfo. 

Reference(s) 1. FIPS201, Section 4.4.2 

2. AS06.03.09 

 Page 97
Special Publication 800-85B PIV Data Model Testing Specification

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and

contact reader. 

the

3. The test application is currently connected to the card application 

which is accessible through card handle. 

4. A valid card holder facial image is present on the PIV card. 

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Facial Image 

(2.16.840.1.101.3.7.2.96.48)>>

Call pivGetData w/ 

4. ignerInfos field contents from the

3. 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

Extract the S

CBEFF_SIGNATURE_BLOCK 

Expected 

Result(s)

The signerInfos field in the SignedData contains a single SignerInfo. 

10.3.1.7 Verify Signer Identifier in SignerInfo 

Purpose Confirms that the sid in the SignerInfo uses the issuerAndSerialNumber 

choice. 

Reference(s) 1. FIPS201, Section 4.4.2 

2. AS06.03.10 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the 

contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card handle. 

4. A valid card holder facial image is present on the PIV card. 

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Facial Image 

(2.16.840.1.101.3.7.2.96.48)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the signerInfo->sid field contents from the 

CBEFF_SIGNATURE_BLOCK 

5. Extract the certificates field contents from the 

CBEFF_SIGNATURE_BLOCK (if present) 

6. If a certificate extracted from the certificates field 

of the CBEFF_SIGNATURE_BLOCK does not exist, then 

extract the certificates field contents from the 

asymmetric signature of the CHUID 

7. Extract the issuer and serialNumber fields from the 

certificate obtained in the previous step 

 Page 98
Special Publication 800-85B PIV Data Model Testing Specification

Expected The sid in the SignerInfo uses the issuerAndSerialNumber choice which 

corresponds to the issuer and serialNumber fields found in the X.509

certificate of the signer. 

Result(s)

10.3.1.8 Verify Digest Algorithm in SignerInfo

Purpose Confirm that the digestAlgorithm field of the SignerInfo is in accordance

with Table 3-3 of SP80078. 

Reference(s) 1. SP80078, Section 3.2.1 

2. AS06.03.11 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. ion exists between the test application and the

3. on is currently connected to the card application 

A valid PC/SC connect

contact reader. 

The test applicati

which is accessible through card handle. 

4. A valid card holder facial image is present on the PIV card. 

5. A valid CHUID is present on the PIV card. 

 Page 99
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Facial Image 

(2.16.840.1.101.3.7.2.96.48)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the SignerInfo->digestAlgorithm

CBEFF_SIGNATURE_BLOCK 

field from the

tes field contents from the

CK (if present)

6. CHUID (2.16.840.1.101.3.7.2.48.0)>>

7. ta w/

dle

d

he

digest algorithm obtained from step 4 with

Table 3-3 of SP80078 based on the card expiration date, 

and the public key algorithm and size used to sign the 

tric

13. Extract the digestAlgorithms field contents from the 

5. Extract the certifica

CBEFF_SIGNATURE_BLO

Set OID := <<

Call pivGetDa

• (IN) cardHan

• (IN) OID 

• (OUT) data 

8. Extract the expiration date value from the CHUID (i.e. 

Tag 0x35) 

9. If a certificate extracted from the certificates fiel

of the CBEFF_SIGNATURE_BLOCK does not exist, then 

extract the certificates field contents from t

asymmetric signature of the CHUID 

10. From the certificate obtained (either from the 

CBEFF_SIGNATURE_BLOCK or the CHUID signature field), 

extract the subjectPublicKeyInfo->subjectPublicKey 

11. Compute the size of the signer’s public key

12. Match the

facial image biome

CBEFF_SIGNATURE_BLOCK 

Expected 

Result(s)

The digestAlgorithm field value of the SignerInfo is in accordance w

Table 3-3 of SP80078 and it matches the value presen

ith

t in the

digestAlgorithms field of the SignedData. 

10.3.1.9 Verify message digest signed attribute in SignerInfo 

Purpose Con nedAttrs of the SignerInfo includes a message digest 

CBE _RECORD 

firms that the sig

attribute containing the hash computed over the concatenated 

FF_HEADER and the STD_BIOMETRIC

Reference(s) 1. FIPS201, Section 4.2.2 

2. AS06.03.12 

 Page 100
Special Publication 800-85B PIV Data Model Testing Specification

Precondition 1. A valid PIV card is inserted into the contact reader.

t application and the

 connected to the card application 

ough card handle.

4. er facial image is present on the PIV card. 

2. A valid PC/SC connection exists between the tes

contact reader. 

3. The test application is currently

which is accessible thr

A valid card hold

Test Steps 1. := <<valid card handle>>

3. 

4. from

vious

CBEFF_HEADER and the STD_BIOMETRIC_RECORD 

Set cardHandle

2. Set OID := <<Card Holder Facial Image 

(2.16.840.1.101.3.7.2.96.48)>> 

Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

Parse the SignerInfo-> signedAttrs field contents

the CBEFF_SIGNATURE_BLOCK to locate the message digest 

attribute (OID=1.2.840.113549.1.9.4) and its 

corresponding attribute value 

5. Extract the SignerInfo->digestAlgorithm field contents

from the CBEFF_SIGNATURE_BLOCK 

6. Using the digest Algorithm obtained in the pre

step, compute the hash over the concatenated 

Expected 

Result(s)

The

signedAttrs of the SignerInfo

value of the hash obtained from the message digest attribute of the 

 is identical to that obtained after hashing the 

c

si

oncatenated contents of the CHUID, excluding the asymmetric digital 

gnature field.

10.3.1.10Verify PIV signer distinguished name

Purpose C i e pivSignerD t

certifi at signed the biometrics. 

onf rms that the signedAttrs of the SignerInfo includes th

N a tribute containing the subject name that appears in the X.509 

cate for the entity th

Reference(s) 1

2. A

. FIPS201, Section 4.2.2 

S06.03.13

Precondition 1

2

contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card handle. 

4. A valid card holder facial image is present on the PIV card. 

5. A valid CHUID is present on the PIV card. 

. A valid PIV card is inserted into the contact reader. 

. A valid PC/SC connection exists between the test application and the 

 Page 101
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1

2

3

•

•

•

4

a

5. Extract the certificates field contents from the 

6 field

of the CBEFF_SIGNATURE_BLOCK does not exist, then 

extract the certificates field contents from the 

asymmetric signature of the CHUID 

7. Extract the subject DN from the certificate obtained in 

. Set cardHandle := <<valid card handle>> 

. Set OID := <<Card Holder Facial Image 

(2.16.840.1.101.3.7.2.96.48)>>

. Call pivGetData w/ 

(IN) cardHandle

(IN) OID

(OUT) data

. Parse the SignerInfo-> signedAttrs field contents from 

the CBEFF_SIGNATURE_BLOCK to locate the pivSigner-DN 

ttribute (OID=2.16.840.1.101.3.6.5)

CBEFF_SIGNATURE_BLOCK 

. If a certificate extracted from the certificates

the previous step 

Expected 

Result(s)

T

p

he value of the subject DN obtained from the certificate in the

ertificates field in the SignedData is identical to that obtained from the 

ivSigner-DN attribute of the signedAttrs of the SignerInfo. 

c

10.3.1.11 Verify FASC-N 

Purpose Confirms that the signedAttrs of the SignerInfo includes the pivFASC-N 

attribute whose value matches the value of the FASC-N in the CHUID 

of the PIV card. 

Reference(s) 1. FIPS201, Sect

2. AS06.03.14

ion 4.4.2

Precondition 1 A valid PIV card is inserted into the contact reader. 

2 A valid PC/SC connection exists between the test application and 

.

.

.

. .

. .

the contact reader. 

3 The test application is currently connected to the card application

which is accessible through card handle.

4 A valid card holder facial image is present on the PIV card

5 A valid CHUID is present on the PIV card

 Page 102
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Set cardHandle := <<valid card handle>>

3. ith the following parameters

Handle

4. SignerInfo-> signedAttrs field contents from 

he pivFASC-N

3.6.6) and its

bute value

(2.16.840.1.103.3.7.2.48.0)>>

6. Data with the following parameters

Handle

2. Set OID := <<Card Holder Facial Image 

(2.16.840.1.101.3.7.2.96.48)>>

Call pivGetData w

• (IN) card

• (IN) OID 

• (OUT) data 

Parse the

the CBEFF_SIGNATURE_BLOCK to locate t

attribute (OID=2.16.840.1.101.

corresponding attri

5. Set OID := <<CHUID

Call pivGet

• (IN) card

• (IN) OID 

• (OUT) data 

7. Parse the CHUID and extract the FASC-N

Expected Result(s) A pivFASC-N attribute exists in the signedAttrs of the SignerInfo and 

its value matches the FASC-N present in the CHUID of the PIV card. 

10.3.1.12Verify signature algorithm in SignerInfo 

Purpose Confirms that the signatureAlgorithm field specified in the SignerInfo 

field is in accordance with Table 3-4 of SP80078 and based on the PIV card 

expiration date in accordance with Table 3-3 of SP80078. 

Reference(s) 1. SP80078, Section 3.2.1 

2. AS06.03.15 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the

contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card handle. 

4. A valid card holder facial image is present on the PIV card. 

5. A valid CHUID is present on the PIV card. 

 Page 103
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<CHUID (2.16.840.1.101.3.7.

3. Call pivGetData w/ 

2.48.0)>>

n date value from the CHUID (i.e.

5. Card Holder Facial Image

1.3.7.2.96.48)>>

6. a w/

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the expiratio

Tag 0x35) 

Set OID := <<

(2.16.840.1.10

Call pivGetDat

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

7. Extract the SignerInfo->signatureAlgorithm field 

contents. 

Expected 1. From Step 7: The signatureAlgorithm value is in accordance with

Table 3-4 of SP80078

2. From Step 4: The expiration date value is earlier than or equal to th

sunset date specified in T

Result(s)

e 

able 3-3 of SP80078 for the algorithm from

Step 7. 

10.3.1.13Verify digital signature

Purpose C

b

onfirms that the signature in the SignerInfo corresponds to the signed

iometric 

Reference(s) 1

2

3

. FIPS201, Section 4.2.2 

. AS06.03.07

. AS06.03.16

Precondition 1

2

co

3

w

4

5

. A valid PIV card is inserted into the contact reader. 

. A valid PC/SC connection exists between the test application and the 

ntact reader. 

. The test application is currently connected to the card application 

hich is accessible through card handle.

. A valid card holder facial image is present on the PIV card. 

. A valid CHUID is present on the PIV card. 

 Page 104
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Set cardHandle := <<valid card handle>> 

. Set OID := <<Car

(2.16.840.1.101.

2 d Holder Facial Image

3.7.2.96.48)>>

3. Extract the certificates field contents from the 

CBEFF_SIGNATURE_BLOCK. If this field is omitted then 

extract the certificate from the CHUID signature 

<<CHUID (2.16.840.1.101.3.7.2.48.0)>>

Data w/

6

re of the CHUID.

7 the

4. Set OID :=

5. Call pivGet

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

. Extract the certificates field contents from the 

asymmetric signatu

. Using the certificate extracted either from

CBEFF_SIGNATURE_BLOCK or the CHUID asymmetric signature, 

verify the signature on the biometric

Expected 

Result(s)

The certificates field in the SignedData contains a single certificate that 

c e

certifi field of the SignedData 

fo e e

d

an b used to verify the digital signature in the SignerInfo. If the 

cates field is omitted, then the certificates

r th CHUID contains the certificate that can be used to verify th

igital signature.

10.3.2 Embedded Ce

10.3.2.1 Verify extended k ion

rtificate 

ey usage extens

Purpose Con ital signature certificate used to sign the facial 

exte

firms that the dig

image biometric asserts id-PIV-content-signing in the 

ndedKeyUsage extension.

Reference(s) 1. FIPS201, Section 4.2.2 

2. AS06.03.17

Precondition 1. erted into the contact reader. 

2. connection exists between the test application and

r.

accessible through card handle.

A valid PIV ca

A valid PC/SC

rd is ins

the contact reade

3. The test application is currently connected to the card application 

which is

4. A valid card holder facial image is present on the PIV card. 

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Holder Facial Image 

(2.16.840.1.101.3.7.2.96.48)>>

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the certificates field contents from the 

CBEFF_SIGNATURE_BLOCK. If the certificate field is 

omitted, then stop execution of this test assertion.

5. Extract all KeyPurposeId fields from the extended key

usage extension from the certificate obtained

 Page 105
Special Publication 800-85B PIV Data Model Testing Specification

Expected Result(s) A KeyPurposeId asserting id-PIV-content-signing exists in the extended 

key usage extension. 

10.3.2.2 Verify signer public key size 

Purpose Co irms that the size of the

sed on th

nf public key for digital signature used to sign 

the biometrics is ba e expiration of the PIV card and is in

accordance with Table 3-3 of SP80078. 

Reference(s) 1. SP80078, Section 3.1 

2. AS06.03.18

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and

rough card handle.

IV card.

the contact reader. 

3. The test application is currently connected to the card application 

which is accessible th

4. A valid card holder facial image is present on the P

Test Steps 1. Set cardHandle := <<valid card

Set OID := <<Card Holder Facial

handle>>

Image

.96.48)>>

3. 

ndle

4. 

5. 

thm

field value from the certificate obtained 

9. Extract the subjectPublicKeyInfo->subjectPublicKey 

certificate obtained

ny size

2. 

(2.16.840.1.101.3.7.2

Call pivGetData w/

• (IN) cardHa

• (IN) OID 

• (OUT) data 

Extract the certificates field contents from the 

CBEFF_SIGNATURE_BLOCK. If the certificate field is

omitted, then stop execution of this test assertion 

Set OID := <<CHUID (2.16.840.1.101.3.7.2.48.0)>> 

6. Call pivGetData w/

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

7. Extract the expiration date from the CHUID (i.e. Tag

0x35) 

8. Extract subjectPublicKeyInfo->algorithm->algori

from the

Note: - Since the ECDSA keys do not have a

restrictions based on dates, this test case does not apply 

to these types of keys

Expected Result(s) Verify that the size of the key from Step 9, algorithm from Step 8 and

expiration date from Step 7 are consistent with entries in Table 3-3 of 

SP80078. 

 Page 106
Special Publication 800-85B PIV Data Model Testing Specification

10.4 Security Object 

10.4.1 Data Integrity

10.4.1.1 Verify integrity of data element hashes

Purpose Confirms the integrity of the hashes of the data elements of the PIV card

present in the security object. 

Reference(s) 1. 

2.

SP80073, Section 1.8.5 

AS06.04.01

Precondition 1. serted into the contact reader. 

2. connection exists between the test application and

er.

on

A valid PIV card is in

A valid PC/SC

the contact read

3. The test application is currently connected to the card applicati

which is accessible through card handle. 

4. A valid security object is present on the card. 

5. Valid objects whose hashes are referenced in the security object are 

present on the card. 

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Security Object

(2.16.840.1.101.3.7.2.144.0)>> 

3. Call pivGetData w/ 

dHandle

e various data elements that are part of

g of Data

ity Object Asymmetric Signature (i.e. TAG

6. data elements that

step 4

nd verify that

e

• (IN) car

• (IN) OID 

• (OUT) data 

4. Identify th

the security object by parsing the Mappin

Group (DG) to ContainerID (i.e. TAG 0xBA) 

5. Extract the ldsSecurityObject from the eContent field 

of the Secur

0xBB) 

Call pivGetData w/ for all those

are present in the mapping obtained from

7. Compute the hash for each data element a

it matches the hash value present in th

ldsSecurityObject 

Expected Result(s) The actual hash of the data e

the val

lements on the PIV card are identical to 

ir corresponding hash ues present in the security object. 

10.4.2 Signature Block 

10.4.2.1 Verify pres

Contents 

ence of CMS SignedData asymmetric digital signature 

Purpose Confirms that the security object buffer contains an asymmetric digital 

signature, implemented as a SignedData type in accordance with RFC 

3852 

Reference(s) 1. AS06.04.02 

2. AS06.04.03 

 Page 107
Special Publication 800-85B PIV Data Model Testing Specification

Precondition 1. A valid PIV card is inserted into the contact reader. 

ected to the card application 

ugh card handle.

object is present on the PIV card.

2. A valid PC/SC connection exists between the test application and the 

contact reader. 

3. The test application is currently conn

which is accessible thro

4. A valid security

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Security Object 

(2.16.840.1.101.3.7.2.144.0)>> 

3. Call pivGetData w/

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Parse the obtained security ob

contents from the asymmetric dig

ject and extract the

ital signature field

5. s of the digital signature

(i.e. TAG 0xBB) 

Process the content

Expected 

Result(s)

The s present in the security object buffer and contains an 

asym ture that is implemented as a SignedData type 

acco 2.

security object i

metric digital signa

rding to RFC 385

10.4.2.2 Verify version in SignedData 

Purpose Confirms that the version of the SignedData content type is 1. 

Reference(s) 1. AS06.04.04

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the

4. 

contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card handle. 

A valid security object is present on the PIV card.

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Security Object 

(2.16.840.1.101.3.7.2.144.0)>> 

Call pivGetData w/ 

• (IN) cardHandle

3. 

4. Extract the version field contents from the asymmetric 

ecurity Object (i.e. TAG 0xBB)

• (IN) OID 

• (OUT) data 

signature of the S

Expected The value of the version fi

Result(s)

eld of the SignedData is 1. 

 Page 108
Special Publication 800-85B PIV Data Model Testing Specification

10.4.2.3 Verify digest Algorithm in SignedData 

Purpose Confirm that the digestAlgorithms field of the SignedData content type is 

in accordance with Table 3-7 of SP80078. 

Reference(s) 1. SP80078, Section 3.2.1

2. AS06.04.05 

Precondition 1. ct reader.

pplication and the

ted to the card application 

.

A valid PIV card is inserted into the conta

2. A valid PC/SC connection exists between the test a

contact reader. 

3. The test application is currently connec

which is accessible through card handle

4. A valid security object is present on the PIV card.

Test Steps 1. e := <<valid card handle>>

2. Security Object

1.3.7.2.144.0)>>

4. Extract the digestAlgorithms field contents from the 

HUID (2.16.840.1.101.3.7.2.48.0)>>

N) OID

CHUID (i.e.

re

eyInfoey

step 4 with

card expiration date,

size used to sign the

Set cardHandl

Set OID := <<

(2.16.840.1.10

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

Security Object 

5. Set OID := <<C

6. Call pivGetData w/ 

• (IN) cardHandle 

• (I

• (OUT) data

7. Extract the expiration date value from the

Tag 0x35) 

8. Extract the certificates field contents from the 

asymmetric signature of the CHUID 

9. From the certificate obtained (from the CHUID signatu

field), extract the subjectPublicK

>subjectPublicKey 

10. Compute the size of the signer’s public k

11. Match the digest algorithm obtained from

Table 3-7 of SP80078 based on the

and the public key algorithm and

security object 

Expected 

Result(s)

The value of the SignedData is in accordance with 

Tab . 

digestAlgorithm

le 3-7 of SP80078

s field

10.4.2.4 Verify contents of encapContentInfo

Purpose Confirms that the eContentType of the encapContentInfo is id-icaoldsSecurityObject and the eContent field of the encapContentInfo 

contains the contents of the ldsSecurity object. 

 Page 109
Special Publication 800-85B PIV Data Model Testing Specification

Reference(s) 1. AS06.04.06 

2. AS06.04.07 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the

lication 

contact reader.

3. The test application is currently connected to the card app

which is accessible through card handle. 

4. A valid security object is present on the PIV card.

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Security Object 

(2.16.840.1.101.3.7.2.144.0)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract and parse the encapContentInfo field contents

from the security object

Expected 

Result(s)

The eContent field contains a correctly formatted ldsSecurityobject and 

the eContentType asserts id-icao-ldsSecurityObject in encapContentInfo. 

10.4.2.5 Verify certificates field omission 

Purpose Confirm that the certificates fi

tted.

eld from the SignedData content type is 

omi

Reference(s) 1. AS06.04.08

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the

4. 

contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card handle. 

A valid security object is present on the PIV card.. 

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Security Object 

(2.16.840.1.101.3.7.2.144.0)>> 

Call pivGetData w/ 

• (IN) cardHandle

3. 

the

• (IN) OID 

• (OUT) data 

4. Extract the certificates field contents from

security object 

Expected 

Result(s)

The certificates field is omitted from the SignedData. 

 Page 110
Special Publication 800-85B PIV Data Model Testing Specification

10.4.2.6 Verify Digest Algorithm in SignerInfo

Purpose Confirm that the digestAlgorithm field of the SignerInfo is in accordance 

with Table 3-7 of SP80078. 

Reference(s) 1. AS06.04.09 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and the

contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card handle. 

4. A valid security object is present on the PIV card.

5. A valid CHUID is present on the PIV card. 

Test Steps 1. Set cardHandle := <<valid card hand

2. Set OID := <<Security Object 

le>>

(2.16.840.1.101.3.7.2.144.0)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data

4. gnerInfo->digestAlgorithm field from the

security object 

Set OID :=

Extract the Si

5. <<CHUID (2.16.840.

6. Call pivGetData w/ 

• (IN) cardHandle 

1.101.3.7.2.48.0)>>

7. piration date value from the CHUID (i.e.

9. ature

btained from step 4 with

Table 3-7 of SP80078 based on the card expiration date, 

and the public key algorithm and size used to sign the 

y object

12. Extract the digestAlgorithms field contents from the 

• (IN) OID 

• (OUT) data

Extract the ex

Tag 0x35) 

8. Extract the certificates field contents from the

asymmetric signature of the CHUID 

From the certificate obtained (from the CHUID sign

field), extract the subjectPublicKeyInfo-

>subjectPublicKey 

10. Compute the size of the signer’s public key

11. Match the digest algorithm o

securit

security object’s SignedData 

Expected 

Result(s)

The digestAlgorithm field value of the SignerInfo is in accordance with

Table 3-7 of SP80078 and it matches the value present in the 

digestAlgorithms field of the SignedData. 

 Page 111
Special Publication 800-85B PIV Data Model Testing Specification

10.4.2.7 Verify signature algorithm in SignerInfo 

Purpose Confirms that the signatureAlgorithm field specified in the SignerInfo 

ard

pi SP80078

field is in accordance with Table 3-4 of SP80078 and based on the PIV c

ex ration date in accordance with Table 3-3 of . 

Reference(s) 1. SP80078, Section 3.2.1 

2. AS06.04.10 

Precondition 1. A valid PIV card is inserted into the contact reader.

en the test application and the

rrently connected to the card application 

ible through card handle.

4. bject is present on the PIV card.

5. s present on the PIV card.

2. A valid PC/SC connection exists betwe

contact reader. 

3. The test application is cu

which is access

A valid security o

A valid CHUID i

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<CHUID (2.16.840.1.101.3.7.2.48.0)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data

4. piration date value from the CHUID

Tag 0x35) 

Set OID := <<Security Object 

Extract the ex (i.e.

6. 

OUT) data

7. From the signature block (TAG 0xBB), match the 

SignerInfo5. 

(2.16.840.1.101.3.7.2.144.0)>> 

Call pivGetData w/ 

• (IN) cardHandle

• (IN) OID 

• (

>signatureAlgorithm field contents with Table 

3-4 of SP80078 based on the card expiration date 

Expected 

Result(s)

The signatureAlgorithm value in the SignerInfo field is in accordance 

with Table 3-4 of SP80078 and is based on the PIV card expiration date in 

accordance with Table 3-3 of SP80078. 

10.4.2.8 Verify digital signature

Purpose Confirms that the signature in the SignerInfo corresponds to the signed 

security object and that it is it signed with the certificate that is used to 

sign the CHUID. 

Reference(s) 1. SP80073, Section 1.8.5 

2. AS06.04.11 

3. AS06.04.12 

 Page 112
Special Publication 800-85B PIV Data Model Testing Specification

Precondition 1. A valid PIV card is inserted into the contact reader. 

xists between the test application and the

ation is currently connected to the card application 

ible through card handle.

ect is present on the PIV card.

5. A valid CHUID is present on the PIV card. 

2. A valid PC/SC connection e

contact reader. 

3. The test applic

which is access

4. A valid security obj

Test Steps 1. Set cardHandle := <<valid card handle>>

2. Set OID := <<Security Object 

3

4 ntents of the Security Object asymmetric

5

6

• (IN) cardHandle 

7. Extract the certificates field contents from the 

8

re of the

(2.16.840.1.101.3.7.2.144.0)>> 

. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID

• (OUT) data 

. Extract the co

signature (TAG 0xBB)

. Set OID := <<CHUID (2.16.840.1.101.3.7.2.48.0)>>

. Call pivGetData w/

• (IN) OID

• (OUT) data

asymmetric signature of the CHUID. 

. Using the certificate extracted from the CHUID

asymmetric signature block, verify the signatu

security object 

Expected 

Result(s)

The certificates field of the SignedData for the CHUID contains the 

certifi the digital signature on the security 

object

cate that can be

.

used to verify

 Page 113
Special Publication 800-85B PIV Data Model Testing Specification

11. PKI Certificate Profile Test Assertions

11.1 PIV Authentication Certificate 

11.1.1 SP 800-78 Alg

signat a

orithms Conformance 

11.1.1.1 Verify ure lgorithm

Purpose Confirms that the proper signature algorithm has been used to sign the 

certificate as specified in Table 3-4 of SP80078 based on the expiration 

date as specified in Table 3-3 of SP80078. 

Reference(s) 1. SP80078, Section 3.2.1 

2. AS07.01.01

3. AS07.01.02 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and

3. rrently connected to the card application 

ible through card handle.

4. tion key and corresponding certificate are present 

the contact reader. 

The test application is cu

which is access

A PIV authentica

on the PIV card. 

Test Steps 1. e := <<valid card handle>>

2. Set OID := <<PIV Authentication Certificate 

Set cardHandl

(2.16.840.1.101.3.7.2.1.1)>> 

Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

3. 

certificate

4. Extract signature->algorithm field value from the 

certificate 

5. Extract validity->notAfter->utcTime field value from 

the

Expected Result(s) 1. From Step 4: The signatureAlgorithm value is in accordance with 

Table 3-4 of SP80078

2. From Step 5: The certificate expiration date value is earlier than or 

equal to the sunset date specified in Table 3-3 of SP80078 for the 

ithm from Step 4. 

that

field is populated with SHA-256 (OID = 

2.16.840.1.101.3.4.2.1). For the other RSA algorithms, the 

pulated with NULL. For ECDSA, the 

d is absent.

algor

3. From Step 4: If the algorithm value is id-RSASSA-PSS, verify

the signature->parameters

parameters fiel

parameters fiel

d is po

 Page 114
Special Publication 800-85B PIV Data Model Testing Specification

11.1.1.2 Verify subject public key algorithm 

Purpose Confirms that the public key algorithm used for generating the keys is 

as specified in Table 3-5 of SP80078. 

Reference(s) 1. 

3.

SP80078, Section 3.2.1 

2. AS07.01.03 

AS07.01.04

Precondition 1. A valid PIV card is inserted into the contact reader.

2. A valid PC/SC connection exists between the test application and

rrently connected to the card application 

ible through card handle.

ion key and corresponding certificate are present 

the contact reader. 

3. The test application is cu

which is access

4. A PIV authenticat

on the PIV card. 

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<PIV Authentication Certificate 

(2.16.840.1.101.3.7.2.1.1)>> 

3. Call pivGetData w/

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract subjectPublicKeyInfo->algorithm->algorithm

is used and the OID is populated

-

parameters field may contain NULL to indicate that 

Note: - If the RSA algorithm is used, the 

cKeyInfo->algorithm->parameters field shall be

field value 

5. Match the algorithm value to the Table 3-5 of SP80078

6. If the algorithm is Elliptic Curve, ensure that one of 

the approved curves

in the subjectPublicKeyInfo->algorithm->parameters

>namedCurve field from Table 3-6 of SP80078. The 

parameters are inherited. 

 

subjectPubli

NULL 

Expected Result(s) The PIV authentication key is generated using the allowed asymmetric 

key algorithm. 

11.1.1.3 Verify public key size

Purpose Verifies that the key size requirements are adhered to based on the 

expiration date of certificate. 

Reference(s) 1. SP80078, Section 3.1 

2. AS07.01.10 

 Page 115
Special Publication 800-85B PIV Data Model Testing Specification

Precondition 1. A valid PIV card is inserted into the contact reader.

ation and

 connected to the card application 

ough card handle.

4. ation key and corresponding certificate are present 

2. A valid PC/SC connection exists between the test applic

the contact reader. 

3. The test application is currently

which is accessible thr

A PIV authentic

on the PIV card.

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<PIV Authentication Certificate

(2.16.840.1.101.3.7.2.1.1)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

 • (OUT) data 

m

ectPublicKeyInfo->algorithm->algorithm

ublicKey

ed from the step 3 and the date

restrictions based on dates, this test case does not apply 

• (IN) OID 

4. Extract validity->notAfter->utcTime field value fro

the certificate 

5. Extract subj

field value 

6. Extract the subjectPublicKeyInfo->subjectP

from the certificate 

7. Match the key size to Table 3-3 of SP80078 based on the

algorithm obtain

obtained from step 2 

Note: - Since the ECDSA keys do not have any size 

to these types of keys

Expected Result(s) The key sizes used adhere to the time period for use requirement. 

11.1.2 Data Integrity Chec

11.1.2.1 Verify key usage ex

ks

tension 

Purpose Confirms that the PIV authentication certificate asserts the appropriate

purpose of the key. 

Reference(s) 1. FIPS201, Section 5.4.2.1 

2. AS07.01.05 

Precondition 1. A valid PIV card is inserted i

2. A valid PC/SC connection exists between the test application and 

nto the contact reader.

rresponding certificate are present 

the contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card handle.

4. A PIV authentication key and co

on the PIV card. 

 Page 116
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<PIV Authentication Certificate 

(2.16.840.1.101.3.7.2.1.1)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the value of the keyUsage extension field from

the certificate 

Expected Result(s) The digitalSignature bit has been set. No other bits have been set.

11.1.2.2 Verify id-fpki-common-authentication OID 

Purpose Confirms that the PIV Authentication certificate asserts the id-fpkicommon-authentication OID. 

Reference(s) 1. AS07.01.06 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and

the contact reader. 

3. The test application is currently connected to the card application 

sible through card handle.

nt

which is acces

4. A PIV authentication key and corresponding certificate are prese

on the PIV card. 

Test Steps 1. Set cardHandle := <<valid card handle>>

<PIV Authentication Certificate

d values from the certificate

2. Set OID := <

(2.16.840.1.101.3.7.2.1.1)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract certificatePolicies->policyIdentifier 

extension fiel

Expected Result(s) A policyIdentifier field in the certificatePolicies extension asserts idfpki-common-authentication. 

11.1.2.3 Verify authority information access extension 

Purpose Confirms the authority information access extension is populated with 

the location to the OCSP Server that provides status information for this 

certificate. 

Reference(s) 1. FIPS201, Section 5.4.2.1 

2. AS07.01.07 

 Page 117
Special Publication 800-85B PIV Data Model Testing Specification

Precondition 1. A valid PIV card is inserted into the contact reader. 

urrently connected to the card application 

through card handle.

cation key and corresponding certificate are present 

2. A valid PC/SC connection exists between the test application and 

the contact reader. 

3. The test application is c

which is accessible

4. A PIV authenti

on the PIV card. 

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<PIV Authentication Certificate

(2.16.840.1.101.3.7.2.1.1)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the AuthorityInfoAccess->accessM

AuthorityInfoAccess->accessLocation exten

ethod and

sion fields

from the certificate

Expected Result(s) An accessMethod containing id-ad-ocsp is present. The accessLocation 

for this AccessMethod is of type uniformResourceIdentifier and that the 

scheme is “http” (not “https”). 

11.1.2.4 Verify interim status extension 

Purpose Confirms that the piv-interim extension is present in the certificate.

Reference(s) 1. 

2.

FIPS201, Appendix D 

AS07.01.09

Precondition 1. he contact reader.

2. sts between the test application and

pplication 

e present

A valid PIV card is inserted i

A valid PC/SC connection ex

nto t

i

the contact reader. 

3. The test application is currently connected to the card a

which is accessible through card handle. 

4. A PIV authentication key and corresponding certificate ar

on the PIV card. 

Test Steps 1. e := <<valid card handle>>

2. IV Authentication Certificate

 • (OUT) data 

Extract the piv-interim extension in the certificate

Set cardHandl

Set OID := <<P

(2.16.840.1.101.3.7.2.1.1)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

4. 

Expected Result(s) The piv-interim extension is present and contains the interim_indicator 

field which is of type BOOLEAN. 

 Page 118
Special Publication 800-85B PIV Data Model Testing Specification

11.1.2.5 Verify asymmetric key pair 

Purpose Confirms that the public key that exists in the certificate corresponds to 

the private key on the card. 

Reference(s) 1. FIPS201, Section 5 

2. AS07.01.11

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and

3. n is currently connected to the card application 

are present

the contact reader. 

The test applicatio

which is accessible through card handle. 

4. A PIV authentication key and corresponding certificate

on the PIV card. 

Test Steps 1. Take an arbitrary stream of data 

2. Hash the data using a hash algorithm

3. Set cardHandle := <<valid card handle>>

4. ators := <<valid authenticator>>

5. oCardApplication

for the cryptographic operation>>

8. Input := <<hashed data from Step 2>>

9. with the following parameters

rence

ation Certificate

11. Call pivGetData with the following parameters 

ectPublicKeyInfoom the certificate

Set authentic

Call pivLogInt

• (IN) cardHandle

• (IN) authenticators 

6. Set keyReference := <<key reference for PIV

Authentication Key i.e. 9A>> 

7. Set algorithmIdentifier := <<identifier of the

algorithm to be used

Set algorithm

Call pivCrypt

• (IN) keyRefe

• (IN) algorithmIdentifier 

• (IN) algorithmInput 

• (OUT) algorithmOutput 

10. Set OID := <<PIV Authentic

(2.16.840.1.101.3.7.2.1.1)>> 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

12. Verify the signature with subj

>subjectPublicKey fr

Expected Result(s) The private key corresponds to the public key contained in the 

certificate as the signature verification succeeds. 

11.1.2.6 Verify FASC-N 

Purpose Confirms that the subjectAltName extension contains the FASC-N of 

the card holder and that it matches to that present in the CHUID. 

 Page 119
Special Publication 800-85B PIV Data Model Testing Specification

Reference(s) 1. FIPS201, Section 5.4.2.1 

2. AS07.01.08 

3. AS07.01.12

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and

3. n is currently connected to the card application 

are present

card.

the contact reader. 

The test applicatio

which is accessible through card handle. 

4. A PIV authentication key and corresponding certificate

on the PIV card. 

5. A valid CHUID is present on the PIV

Test Steps 1. Set cardHandle := <<

Set OID := <<PIV Aut

valid card handle>>

2. hentication Certificate

01.3.7.2.1.1)>>

3. a with the following parameters

AltName

tificate

5. ferent GeneralName fields

6. HUID (2.16.840.1.103.3.7.2.48.0)>>

a with the following parameters

8. Parse the CHUID and extract the FASC-N

(2.16.840.1.1

Call pivGetDat

• (IN) cardHandle

• (IN) OID 

• (OUT) data 

4. Extract the GeneralNames field from the subject

extension in the cer

Parse the dif

Set OID := <<C

7. Call pivGetDat

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

Expected Result(s) A GeneralName field exists that contains an otherName with a type-id 

asserting the pivFASC-N OID. The value field of this otherName 

contains the FASC-N for the cardholder which matches the FASC-N 

obtained from parsing the CHUID. 

11.1.2.7 Verify expiration dates consistency

Purpose Confirms that the expiration date of the PIV authentication certificate is

not past the expiration date of the PIV card.

Reference(s) 1. FIPS201, Section 5.3.2.1 

2. AS07.01.13 

 Page 120
Special Publication 800-85B PIV Data Model Testing Specification

Precondition 1. A valid PIV card is inserted into the contact reader.

ation and

rrently connected to the card application 

ugh card handle.

4. ation key and corresponding certificate are present 

2. A valid PC/SC connection exists between the test applic

the contact reader. 

3. The test application is cu

which is accessible thro

A PIV authentic

on the PIV card.

5. A valid CHUID is present on the PIV card. 

Test Steps 1. id card handle>>

2. Set OID := <<PIV Authentication certificate 

Set cardHandle := <<val

(2.16.840.1.101.3.7.2.1.1)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract validity->notAfter->utcTime field value from 

the certificate 

5. Set OID := << CHUID (2.16.840.1.103.3.7.2.48.0)>> 

6. Call pivGetData with the following parameters 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

7. Parse the CHUID and extract the expiration date

Expected Result(s) The expiration date of the PIV authentication certificate is not beyond 

the expiration date of the CHUID i.e. the PIV card. 

11.1.2.8 Verify RSA exponent

Purpose For RSA keys, confirms that the exponent of the RSA asymmetric key 

for PIV authentication is greater than or equal to 65,537. 

Reference(s) 1. SP80078, Section 3.1 

2. AS07.01.14 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and 

the contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card handle. 

4. A PIV authentication key and corresponding certificate are present 

on the PIV card. 

 Page 121
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Set cardHandle := <<valid card handle>>

2. Set OID := <<PIV Authentication Certificate 

1.3.7.2.1.1)>>

3. Call pivGetData w/ 

ardHandle

fo->subjectPublicKey

from the extracted public key

(2.16.840.1.10

• (IN) c

• (IN) OID 

• (OUT) data 

4. Extract the subjectPublicKeyIn

from the certificate. 

5. Parse the exponent

Expected Result(s) The exponent of the RSA asymmetric key for PIV authentication is 

greater than or equal to 65,537.

 Page 122
Special Publication 800-85B PIV Data Model Testing Specification

11.2 Digital Signature Certificate 

11.2.1 SP 800-78 Alg

y signature algorithm

orithm Conformance 

11.2.1.1 Verif

Purpose Confirms that the proper signature algorithm has been used to sign the 

certificate as specified in Table 3-4 of SP80078 based on the expiration 

date as specified in Table 3-3 of SP80078. 

Reference(s) 1. SP80078, Section 3.2.1 

2. AS07.02.01 

3. AS07.02.02 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and 

the contact reader. 

3. The test application is currently connected to the card

which is accessible through card handle.

application 

4. A digital signature key and corresponding certificate are present on 

the PIV card.

Test Steps 1. e := <<valid card handle>>

2. igital Signature Certificate

1.3.7.2.1.0)>>

ndle

4. 

5. 

Set cardHandl

Set OID := <<D

(2.16.840.1.10

3. Call pivGetData w/ 

• (IN) cardHa

• (IN) OID 

• (OUT) data 

Extract signature->algorithm field value from the 

certificate 

Extract validity->notAfter->utcTime field value from

the certificate 

Expected Result(s) 1. From Step 4: The signatureAlgorithm value is in accordance with 

Table 3-4 of SP80078

2. From Step 5: The certificate expiration date value is earlier than or 

equal to the sunset date specified in Table 3-3 of SP80078 for the 

algorithm from Step 4. 

3. From Step 4: If the algorithm value is id-RSASSA-PSS, verify that 

gnature->parameters field is populated with SHA-256 (OID = 

.

the si

2.16.840.1.101.3.4.2.1). For the other RSA algorithms, the 

parameters field is populated with NULL. For ECDSA, the 

parameters field is absent

 Page 123
Special Publication 800-85B PIV Data Model Testing Specification

11.2.1.2 Verify subject public key algorithm 

Purpose Confirms that the public key algorithm used for generating the keys is 

as specified in Table 3-5 of SP80078. 

Reference(s) 1. 

3. AS07.02.04 

SP80078, Section 3.2.1 

2. AS07.02.03 

Precondition 1. A valid PIV card is inserted into the contact reader.

2. A valid PC/SC connection exists between the test application and

rrently connected to the card application 

ible through card handle.

key and corresponding certificate are present on 

the contact reader. 

3. The test application is cu

which is access

4. A digital signature

the PIV card.

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Digital Signature Certificate 

(2.16.840.1.101.3.7.2.1.0)>> 

3. Call pivGetData w/

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract subjectPublicKeyInfo->algorithm->algorithm

is used and the OID is populated

-

parameters field may contain NULL to indicate that 

he RSA algorithm is used, the

field value 

5. Match the algorithm value to the Table 3-5 of SP80078

6. If the algorithm is Elliptic Curve, ensure that one of 

the approved curves

in the subjectPublicKeyInfo->algorithm->parameters

>namedCurve field from Table 3-6 of SP80078. The 

parameters are inherited. 

Note: - If t

subjectPublicKeyInfo->algorithm->parameters field shall be 

NULL 

Expected Result(s) The digital signature key is generated using the allowed asymmetric key 

algorithm.

11.2.1.3 Verify public key size

Purpose Verifies that the key size requirements are adhered to based on the 

expiration date of certificate. 

Reference(s) 1. SP80078, Section 3.1 

2. AS07.02.06 

 Page 124
Special Publication 800-85B PIV Data Model Testing Specification

Precondition 1. A valid PIV card is inserted into the contact reader.

ication and

 connected to the card application 

ough card handle.

4. re key and corresponding certificate are present on 

2. A valid PC/SC connection exists between the test appl

the contact reader. 

3. The test application is currently

which is accessible thr

A digital signatu

the PIV card.

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Digital Signature Certificate

(2.16.840.1.101.3.7.2.1.0)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

D

 • (OUT) data 

ublicKeyInfo->algorithm->algorithm

subjectPublicKeyInfo->subjectPublicKey

t

to these types of keys

• (IN) OI

4. Extract validity->notAfter->utcTime field value from 

the certificate 

5. Extract subjectP

field value 

6. Extract the

from the certificate 

7. Match the key size to Table 3-3 of SP80078 based on the

algorithm obtained from the step 3 and the date 

obtained from step 2 

Note: - Since the ECDSA keys do not have any size 

res rictions based on dates, this test case does not apply

Expected Result(s) The key sizes used adhere to the time period for use requirement. 

11.2.2 Data Integrity Checks 

11.2.2.1 Verify key usage extension 

Purpose Confirms that the digital signature certificate asserts the appropriate 

purpose of the key contained in the certificate. 

Reference(s) 1. FIPS201, Section 5.4.2.1 

2. AS07.02.05 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and 

the contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card handle. 

4. A digital signature key and corresponding certificate are present on 

the PIV card.

 Page 125
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Set cardHandle := <<valid card handle>>

cate

from

2. Set OID := <<Digital Signature Certifi

(2.16.840.1.101.3.7.2.1.0)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the value of the keyUsage extension field

the certificate 

Expected Result(s) The digitalSignature and nonRepudiation bits have been set. 

11.2.2.2 Verify asymmetric key pair 

Purpose Con exists in the certificate corresponds to 

the p

firms that the public key that

rivate key on the card. 

Reference(s) 1. FIPS201, Section 5 

2. AS07.02.07

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. n exists between the test application and

er.

3. ion is currently connected to the card application 

nt on

A valid PC/SC connectio

the contact read

The test applicat

which is accessible through card handle. 

4. A digital signature key and corresponding certificate are prese

the PIV card.

 Page 126
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Take an arbitrary stream of data 

2. Hash the data using a hash algorithm 

3. Set cardHandle := <<valid card handle>>

4. Set authenticators := <<valid authenticator>>

5. pplication

ticators

>>

>>

9. he following parameters

erence

hmIdentifier

ficate

(2.16.840.1.101.3.7.2.1.0)>> 

11. Call pivGetData with the following parameters 

N) cardHandle

ature with subjectPublicKeyInfofrom the certificate

Call pivLogIntoCardA

• (IN) cardHandle

• (IN) authen

6. Set keyReference := <<key reference for Digital 

Signature Key i.e. 9C>> 

7. Set algorithmIdentifier := <<identifier of the 

algorithm to be used for the cryptographic operation

8. Set algorithmInput := <<hashed data from Step 2

Call pivCrypt with t

• (IN) keyRef

• (IN) algorit

• (IN) algorithmInput 

• (OUT) algorithmOutput 

10. Set OID := <<Digital Signature Certi

• (I

• (IN) OID 

• (OUT) data 

12. Verify the sign

>subjectPublicKey

Expected Result(s) The private key corresponds to the public key contained in the 

certificate as the signature verification succeeds. 

11.2.2.3 Verify expiration dates consistency

Purpose Confirms that the expiration date of the digital signature certificate is 

not past the expiration date of the PIV card. 

Reference(s) 1. FIPS201, Section 5.3.2.1 

2. AS07.02.08 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. n exists between the test application and

er.

3. ion is currently connected to the card application 

on

A valid PC/SC connectio

the contact read

The test applicat

which is accessible through card handle. 

4. A digital signature key and corresponding certificate are present

the PIV card.

5. A valid CHUID is present on the PIV card. 

 Page 127
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Set cardHandle := <<valid card handle>>

2. Set OID := <<PIV Digital Signature certificate 

1.3.7.2.1.0)>>

3. Call pivGetData w/ 

ardHandle

• (IN) OID 

cTime field value from

(2.16.840.1.103.3.7.2.48.0)>>

h the following parameters

andle

(2.16.840.1.10

• (IN) c

• (OUT) data 

4. Extract validity->notAfter->ut

the certificate 

5. Set OID := << CHUID

6. Call pivGetData wit

• (IN) cardH

• (IN) OID 

• (OUT) data 

7. Parse the CHUID and extract the expiration date

Expected Result(s) The expiration date of the digital signature certificate is not beyond the

expiration date of the CHUID i.e. the PIV card.

11.2.2.4 Verify RSA exponent

Purpose For RSA keys, confirms that

for digital signature is greater

the exponent of the RSA asymmetric key

than or equal to 65,537.

Reference(s) 1. 3.1

2.

SP80078, Section

AS07.02.09

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and

which is accessible through card handle. 

the contact reader. 

3. The test application is currently connected to the card application 

4. A digital signature key and corresponding certificate are present on

the PIV card.

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Digital Signature Certificate 

(2.16.840.1.101.3.7.2.1.0)>> 

3. Call pivGetData w/ 

4. y

5. Parse the exponent from the extracted public key

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

Extract the subjectPublicKeyInfo->subjectPublicKe

from the certificate.

Expected Result(s) The exponent of the RSA asymmetric key for digital signature is greater 

than or equal to 65,537. 

 Page 128
Special Publication 800-85B PIV Data Model Testing Specification

11.3 Key Management Certificate 

11.3.1 SP 800-78 Alg

y signature algorithm

orithm Conformance 

11.3.1.1 Verif

Purpose Confirms that the proper signature algorithm has been used to sign the 

certificate as specified in Table 3-4 of SP80078 based on the expiration 

date as specified in Table 3-3 of SP80078. 

Reference(s) 1. SP80078, Section 3.2.1

2. AS07.03.01 

3. AS07.03.02 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and

the contact reader. 

3. The test application is currently connected to the c

which is accessible through card han

ard application 

dle.

4. A key management key and corresponding certificate are present on 

the PIV card.

Test Steps 1. e := <<valid card handle>>

2. ey Management Certificate

ndle

4. 

5. 

Set cardHandl

Set OID := <<K

(2.16.840.1.101.3.7.2.1.2)>>

3. Call pivGetData w/ 

• (IN) cardHa

• (IN) OID 

• (OUT) data 

Extract signature->algorithm field value from the 

certificate 

Extract validity->notAfter->utcTime field value from

the certificate 

Expected Result(s) 1. From Step 4: The signatureAlgorithm value is in accordance w

Table 3-4 of SP80078

ith

r

rom Step 4. 

3. From Step 4: If the algorithm value is id-RSASSA-PSS, verify that 

gnature->parameters field is populated with SHA-256 (OID = 

.

2. From Step 5: The certificate expiration date value is earlier than o

equal to the sunset date specified in Table 3-3 of SP80078 for the 

algorithm f

the si

2.16.840.1.101.3.4.2.1). For the other RSA algorithms, the 

parameters field is populated with NULL. For ECDSA, the 

parameters field is absent

 129
Special Publication 800-85B PIV Data Model Testing Specification

11.3.1.2 Verify subject public key algorithm 

Purpose Confirms that the public key algorithm used for generating the keys is 

as specified in Table 3-5 of SP80078. 

Reference(s) 1. 

3. AS07.03.04 

SP80078, Section 3.2.1 

2. AS07.03.03 

Precondition 1. A valid PIV card is inserted into the contact reader.

pplication and

rrently connected to the card application 

ible through card handle.

esponding certificate are present on 

2. A valid PC/SC connection exists between the test a

the contact reader. 

3. The test application is cu

which is access

4. A key management key and corr

the PIV card.

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Key Management Certificate 

(2.16.840.1.101.3.7.2.1.2)>> 

3. Call pivGetData w/

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract subjectPublicKeyInfo->algorithm->algorithm

is populated

-

parameters field may contain NULL to indicate that 

he RSA public key algorithm is used, the

field value 

5. Match the algorithm value to the Table 3-5 of SP80078

6. If the algorithm is Elliptic Curve, ensure that one of 

the approved curves is used and the OID

in the subjectPublicKeyInfo->algorithm->parameters

>namedCurve field from Table 3-6 of SP80078. The 

parameters are inherited. 

Note: - If t

subjectPublicKeyInfo->algorithm->parameters field shall be 

NULL 

Expected Result(s) The key management key is generated using the allowed asymmetric 

key algorithm. 

11.3.1.3 Verify public key size

Purpose Verifies that the key size requirements are adhered to based on the 

expiration date of certificate. 

Reference(s) 1. SP80078, Section 3.1 

2. AS07.03.07 

 Page 130
Special Publication 800-85B PIV Data Model Testing Specification

Precondition 1. A valid PIV card is inserted into the contact reader.

pplication and

 connected to the card application 

ough card handle.

4. ent key and corresponding certificate are present on 

2. A valid PC/SC connection exists between the test a

the contact reader. 

3. The test application is currently

which is accessible thr

A key managem

the PIV card.

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Key Management Certificate

(2.16.840.1.101.3.7.2.1.2)>> 

3. Call pivGetData w/

Extract validity->notAfter->utcTime field value from 

the certificate 

5. Extract subjectPublicKeyInfo->algorithm->algorithm 

he subjectPublicKeyInfo->subjectPublicKey

rom the step 3 and the date

obtained from step 2 

size

es not apply

• (IN) cardHandle 

• (IN) OID 

 • (OUT) data 

4. 

field value 

6. Extract t

from the certificate 

7. Match the key size to Table 3-3 of SP80078 based on the

algorithm obtained f

Note: - Since ECDH or ECC MQV do not have any

restrictions based on dates, this test case do

to keys generated using these algorithms.

Expected Result(s) The key sizes used adhere to the time period for use requirement. 

11.3.2 Data Integrity c

11.3.2.1 Verify key usage extension 

Che ks

Purpose Confirms that the digital signature certificate asserts the appropriate 

purpose of the key contained in the certificate. 

Reference(s) 1. AS07.03.05 

2. AS07.03.06 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and 

the contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card handle. 

4. A key management key and corresponding certificate are present on 

the PIV card.

 Page 131
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Set cardHandle := <<valid card handle>>

2. Set OID := <<Key Management Certificate

(2.16.840.1.101.3.7.2.1.2)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the value of the keyUsage extension field from 

the certificate 

5. Extract subjectPublicKeyInfo->algorithm->algorithm 

field value 

6. Match the algorithm value to Table 3-5 of SP80078 

Expected Result(s) If the public key algorithm is RSA, then the keyUsage extension shall

only the algorithm is Elliptic Curve 

key, only assert the keyAgreement 

bit. 

assert the keyEncipherment bit. If

then the keyUsage extension shall

11.3.2.2 Verify asymmetric key pair 

Purpose Confirms that the public key that exists in the certificate corresponds to 

the private key on the card.

Reference(s) 1. FIPS201, Section 5

2. AS07.03.08 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test applicatio

the contact reader. 

n and

3. The test application is currently connected to the card application 

which is accessible through card handle. 

y management key and corresponding certificate are present on 

the PIV card.

4. A ke

 Page 132
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Take an arbitrary stream of data 

2. Hash the data using a hash algorithm 

3. Set cardHandle := <<valid card handle>>

4. Set authenticators := <<valid authenticator>>

5. pplication

ticators

nt

on>>

following parameters

• (IN) keyReference 

• (IN) algorithmIdentifier 

• (IN) algorithmInput 

• (OUT) algorithmOutput 

10. Set OID := <<Key Management Certificate 

(2.16.840.1.101.3.7.2.1.2)>> 

11. Call pivGetData with the following parameters 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

12. Verify the signature with subjectPublicKeyInfo-

>subjectPublicKey from the certificate

Call pivLogIntoCardA

• (IN) cardHandle

• (IN) authen

6. Set keyReference := <<key reference for Key Manageme

Key i.e. 9D>> 

7. Set algorithmIdentifier := <<identifier of the 

algorithm to be used for the cryptographic operati

8. Set algorithmInput := <<hashed data from Step 2>>

9. Call pivCrypt with the

Expected Result(s) The private key corresponds to the public key contained in the 

certificate as the signature verification succeeds. 

11.3.2.3 Verify RSA exponent

Purpose For RSA keys, confirms that the exponent of the RSA asymmetric key 

for digital signature is greater than or equal to 65,537. 

Reference(s) 1. SP80078, Section 3.1 

2. AS07.03.09 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and 

the contact reader. 

3. The test application is currently connected to the card application 

which is accessible through card handle. 

4. A digital signature key and corresponding certificate are present on 

the PIV card.

 Page 133
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Key Management Certificate

(2.16.840.1.101.3.7.2.1.2)>> 

ivGetData w/

• (IN) cardHandle 

4. 

cate.

exponent from the extracted public key

3. Call p

• (IN) OID 

• (OUT) data 

Extract the subjectPublicKeyInfo->subjectPublicKey 

from the certifi

5. Parse the

Expected Result(s) The exponent of the RSA asymmetric key for key management is 

greater than or equal to 65,537.

 Page 134
Special Publication 800-85B PIV Data Model Testing Specification

11.4 Card Authentication Certificate (if the Card uses asymmetric key)

11.4.1 SP 800-78 Alg

y signat a

orithm Conformance 

11.4.1.1 Verif ure lgorithm

Purpose Con r signature algorithm has been used to sign the 

e

firms that the prope

certificate as specified in Table 3-4 of SP80078 based on the expiration 

dat as specified in Table 3-3 of SP80078. 

Reference(s) 1. SP80078, Section 3.2.1

2. AS07.04.01 

3. AS07.04.02 

Precondition 1. 

2. tion

A valid PIV card is inserted into the contact reader.

exists between the test application and

3. tion is currently connected to the card application 

le through card handle.

nt

A valid PC/SC connec

the contact reader. 

The test applica

which is accessib

4. A card authentication key and corresponding certificate are prese

on the PIV card.

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Authentication Certificate 

(2.16.840.1.101.3.7.2.5.0)>> 

Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

3. 

4. Extract signature->algorithm field value from the

certificate 

5. Extract validity->notAfter->utcTime field value from

the certificate 

Expected Result(s) 1. From Step 4: The signatureAlgorithm value is in accordance with 

Table 3-4 of SP80078

 Step 5: The certificate expiration date value is earlier than or 

equal to the sunset date specified in Table 3-3 of SP80078 for the 

thm value is id-RSASSA-PSS, verify that 

eters field is populated with SHA-256 (OID = 

.3.4.2.1). For the other RSA algorithms, the 

A, the

2. From

algorithm from Step 4. 

3. From Step 4: If the algori

the signature->param

2.16.840.1.101

parameters field is populated with NULL. For ECDS

parameters field is absent. 

11.4.1.2 Verify subject public key algorithm 

Purpose Confirms that the public key algorithm used for generating the keys is 

as specified in Table 3-5 of SP80078. 

 Page 135
Special Publication 800-85B PIV Data Model Testing Specification

Reference(s) 1. SP80078, Section 3.2.1 

2. AS07.04.03 

3. AS07.04.04 

Precondition 1. A valid PIV card is insert

connec

ed into the contact reader. 

2. tion exists between the test application and

.

n is currently connected to the card application 

A valid PC/SC

the contact reader

3. The test applicatio

which is accessible through card handle. 

4. A card authentication key and corresponding certificate are present 

on the PIV card. 

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Authentication Certificate 

(2.16.840.1.101.3.7.2.5.0)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

078

6. If the algorithm is Elliptic Curve, ensure that one of 

the approved curves is used and the OID is populated 

the subjectPublicKeyInfo->algorithm->parametersSP80078. The 

s field may contain NULL to indicate that

A algorithm is used, the

• (OUT) data 

4. Extract subjectPublicKeyInfo->algorithm->algorithm 

field value 

5. Match the algorithm value to the Table 3-5 of SP80

in

>namedCurve field from Table 3-6 of 

parameter

parameters are inherited. 

Note: - If the RS

subjectPublicKeyInfo->algorithm->parameters field shall be 

NULL 

Expected Result(s) The card authentication key is generated using the allowed a

key algorithm. 

symmetric 

11.4.1.3 Verify public key size

Purpose Verifies that the key size requirements are adhered to based on the 

expiration date of certificate. 

Reference(s) 1. SP80078, Section 3.1 

2. AS07.04.11 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. ion exists between the test application and

er.

3. on is currently connected to the card application 

A valid PC/SC connect

the contact read

The test applicati

which is accessible through card handle. 

4. A card authentication key and corresponding certificate are present 

on the PIV card. 

 Page 136
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Set cardHandle := <<valid card handle>>

2. Set OID := <<Card Authentication Certificate 

 based on the 

e

keys do not have any size

restrictions based on dates, this test case does not apply 

to these types of keys

(2.16.840.1.101.3.7.2.5.0)>> 

3. Call pivGetData w/

• (IN) cardHandle

• (IN) OID 

 • (OUT) data 

8. Extract validity->notAfter->utcTime field value from 

the certificate

9. Extract subjectPublicKeyInfo->algorithm->algorithm 

field value 

10. Extract the subjectPublicKeyInfo->subjectPublicKey 

from the certificate 

11. Match the key size to Table 3-3 of SP80078

algorithm obtained from the step 3 and the dat

obtained from step 2 

Note: - Since the ECDSA

Expected Result(s) The key sizes used adhere to the time period for use requirement. 

11.4.2.1 Verify key usage ex

11.4.2 Data Integrity Checks

tension 

Purpose Confirms that the card au

purpose of the key. 

thentication certificate asserts the appropriate 

Reference(s) 1. FIPS201, Section 5.4.2.1 

2. AS07.04.05 

Precondition 1. A valid PIV card is inserted into the contact reader. 

connection exists between the test application and

through card handle.

t

2. A valid PC/SC

the contact reader. 

3. The test application is currently connected to the card application 

which is accessible

4. A card authentication key and corresponding certificate are presen

on the PIV card. 

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Authentication Certificate

(2.16.840.1.101.3.7.2.5.0)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the value of the keyUsage extension field from

the certificate

Expected Result(s) The digitalSignature bit has been set. No other bits have been set. 

 Page 137
Special Publication 800-85B PIV Data Model Testing Specification

11.4.2.2 Verify id-fpki-common-cardAuth OID 

Purpose Confirms that the card authentication certificate asserts the id-fpkicommon-cardAuth OID. 

Reference(s) 1. AS07.04.06 

Precondition 1. A valid PIV card is inserted into the contact reader. 

2. A valid PC/SC connection exists between the test application and 

the contact reader.

rrently connected to the card application 

gh card handle.

te are present

3. The test application is cu

which is accessible throu

4. A PIV authentication key and corresponding certifica

on the PIV card. 

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Authentication Certificate

(2.16.840.1.101.3.7.2.5.0)>> 

3. Call pivGetData w/ 

olicyIdentifier

s from the certificate

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract certificatePolicies->p

extension field value

Expected Result(s) A po e certificatePolicies extension asserts idfpki-common-cardAuth. licyIdentifier field in th

11.4.2.3 Verify extended key usage extension

Purpose Confirms that the card authentication certificate asserts the appropriate 

purpose of the key in the extended key usage extension. 

Reference(s) 1. FIPS201, Section 5.4.2.1 

2. AS07.04.07 

Precondition 1. A valid PIV card is inserted into the contact reader. 

connection exists between the test application and

the contact reader. 

n

ough card handle.

cation key and corresponding certificate are present 

2. A valid PC/SC

3. The test application is currently connected to the card applicatio

which is accessible thr

4. A card authenti

on the PIV card. 

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Authentication Certificate 

(2.16.840.1.101.3.7.2.5.0)>> 

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract all KeyPurposeId fields from the extended key 

usage extension from the certificate

 Page 138
Special Publication 800-85B PIV Data Model Testing Specification

Expected Result(s) A KeyPurposeId asserting id-PIV-cardAuth exists in the extended key

usage extension. 

11.4.2.4 Verify authority information access extension 

Purpose Confirms the authority information access extension is populated with 

the location to the OCSP Server that provides status information for this

certificate. 

Reference(s) 1. FIPS201, Section 5.4.2.1 

2. AS07.04.08 

Precondition 1. A valid PIV card is inserted into the contact reader. 

/SC connection exists between the test application and

ugh card handle.

on key and corresponding certificate are present 

.

2. A valid PC

the contact reader. 

3. The test application is currently connected to the card application 

which is accessible thro

4. A card authenticati

on the PIV card

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Authentication Certificate 

(2.16.840.1.101.3.7.2.5.0)>>

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

ssMethod and

sion fields

4. Extract the AuthorityInfoAccess->acce

AuthorityInfoAccess->accessLocation exten

from the certificate

Expected Result(s) An accessMethod containing id-ad-ocsp is p

r th type uniformRes

resent. The accessLocation

fo is AccessMethod is of ourceIdentifier and that the 

scheme is “http” (not “https”). 

11.4.2.5 Verify interim status extension 

Purpose Confirms that the piv-interim extension is present in the certificate.

Reference(s) 1. 

2.

FIPS201, Appendix D 

AS07.04.10

Precondition 1. to the contact reader.

tion and

lication 

gh card handle.

4. tion key and corresponding certificate are present 

A valid PIV card is inserted in

2. A valid PC/SC connection exists between the test applica

the contact reader. 

3. The test application is currently connected to the card app

which is accessible throu

A card authentica

on the PIV card. 

 Page 139
Special Publication 800-85B PIV Data Model Testing Specification

Test Steps 1. Set cardHandle := <<valid card handle>> 

Set OID := <<Card Authentication Certificate 

(2.16.840.1.101.3.7.2.5.0)>> 

piv-interim extension in the certificate

2.

3. Call pivGetData w/ 

• (IN) cardHandle 

• (IN) OID 

 • (OUT) data 

4. Extract the

Expected Result(s) The piv-interim extension is present and contains the interim

field which is of type BOOLEAN. 

_indicator 

11.4.2.6 Verify asymmetric key pair 

Purpose Confirms that the public key that exists in the certificate corresponds to 

the private key on the card.

Reference(s) 1. FIPS201, Section 5 

2. AS07.04.12 

Precondition 1. A valid PIV card is inserted into the contact reader.

2. A valid PC/SC connection exists between the test application and

3. tion is currently connected to the card application 

le through card handle.

the contact reader. 

The test applica

which is accessib

4. A card authentication key and corresponding certificate are present 

on the PIV card. 

Test Steps 1. Take an arbitrary stream of data 

2. Hash the data using a hash algorithm 

3. Set cardHandle := <<valid card handle>> 

4. Set authenticators := <<valid authenticator>>

5. toCardApplication

andle

ticators

card

on>>

• (IN) algorithmIdentifier 

• (IN) algorithmInput 

UT) algorithmOutput

10. Set OID := <<Card Authentication Certificate 

signature with subjectPublicKeyInfo-

>subjectPublicKey from the certificate

Call pivLogIn

• (IN) cardH

• (IN) authen

6. Set keyReference := <<key reference for

Authentication Key i.e. 9E>> 

7. Set algorithmIdentifier := <<identifier of the 

algorithm to be used for the cryptographic operati

8. Set algorithmInput := <<hashed data from Step 2>> 

9. Call pivCrypt with the following parameters 

• (IN) keyReference 

• (O

(2.16.840.1.101.3.7.2.5.0)>> 

11. Call pivGetData with the following parameters

• (IN) cardHandle 

• (IN) OID 

• (OUT) data

12. Verify the

Expected Result(s) The private key corresponds to the public key contained in the 

certificate as the signature verification succeeds. 

 Page 140
Special Publication 800-85B PIV Data Model Testing Specification

11.4.2.7 Verify FASC-N 

Purpose Confirms that the subjectAltName extension contains the FASC-N of 

the card holder and that it matches to that present in the CHUID. 

Reference(s) 1. FIPS201, Section 5.4.2.1

2. AS07.04.09 

3. AS07.04.13 

Precondition 1. contact reader.

n exists between the test application and

3. tion is currently connected to the card application 

le through card handle.

nt

A valid PIV card is inserted into the

2. A valid PC/SC connectio

the contact reader. 

The test applica

which is accessib

4. A card authentication key and corresponding certificate are prese

on the PIV card. 

5. A valid CHUID is present on the PIV card. 

Test Steps 1. Set cardHandle := <<valid card handle>> 

2. Set OID := <<Card Authe

(2.16.840.1.101.3.7.2.5

ntication Certificate

.0)>>

3. Call pivGetData with the following parameters 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

4. Extract the GeneralNames field from the subjectAltName 

extension in the certificate 

5. Parse the different GeneralName fields 

6. Set OID := <<CHUID (2.16.840.1.103.3.7.2.48.0)>> 

7. Call pivGetData with the following parameters 

• (IN) cardHandle 

• (IN) OID 

• (OUT) data 

8. Parse the CHUID and extract the FASC-N

Expected Result(s) A GeneralName field exists that contains an otherName with a type-id 

asserting the pivFASC-N OID. The value field of this otherName 

contains the FASC-N for the cardholder which matches the FASC-N 

obtained from parsing the CHUID. 

11.4.2.8 Verify RSA exponent

Purpose For RSA keys, confirms that the exponent of the RSA asymmetric key 

for card authentication is greater than or equal to 65,537. 

Reference(s) 1. SP80078, Section 3.1 

2. AS07.04.14 

 Page 141
Special Publication 800-85B PIV Data Model Testing Specification

Precondition 1. A valid PIV card is inserted into the contact reader.

2. A valid PC/SC connection exists between the test application and 

which is accessible through card handle. 

4. A card authentication key and corresponding certificate are present 

on the PIV card. 

the contact reader. 

3. The test application is currently connected to the card application 

Test Steps 1. Set cardHandle := <<valid card handle>>

.10

ll pivGetData w/

• (OUT) data 

subjectPublicKeyInfo->subjectPublicKey

om the certificate.

xponent from the extracted public key

2. Set OID := <<Card Authentication Certificate 

(2.16.840.1

3. Ca

• (IN) cardHandle 

1.3.7.2.5.0)>>

• (IN) OID

4. Extract the

fr

5. Parse the e

Expected Result(s) The exponent of

gr

the RSA asymmetric key for card authentication is 

eater than or equal to 65,537.

 Page 142
Special Publication 800-85B PIV Data Model Testing Specification

Appendix A—DTRs to Test Assertion Mapping

The followin

Sections 4,

g ta tion red Test Procedures in DTRs in 

5, 6, that can be electronically tested) and the test assertions in Sections 8, 9, 

A.1 BER-TLV

ble provides an associta

and 7 (those

between the Requi

10, and 11. 

Mapping

DTR from 

Section 4 

Test Assertion from

Section 8 

DTR Description 

TE04.01.01.01

n” Data 

on” 

rtificate for 

ent” Data

” Data 

The tester shall validate that the formatting, encoding 

and the content of all the elements in each data 

8.3 “X.509 Certificate for

PIV Authenticatio

Object 

8.5 “Printed Informati

Data Object 

8.7 “X.509 Ce

Digital Signature” Data 

Object 

8.8 “X.509 Certificate for 

Key Managem

Object 

8.9 “X.509 Certificate for 

Card Authentication

Object 

container conforms to SP80073.

TE04.02.01.01 8.1 “Card Capabilities 

Container” Data Object

The tester shall validate the format and the content of 

all the elements in CCC data container on the card.

TE04.02.01.02 

t

The tester shall validate that the Registered Data 

Model value is 0x10. 

8.1 “Card Capabilities 

Container” Data Objec

TE04.03.01.01 8.2 “Card Holder Unique

Identifier” Data Object 

The tester shall validate the format and the content o

all the elements in CHUID data container on the car

f

d.

TE04.04.01.01 8.4 “Card Holder The tester shall validate that the fingerprint data 

Fingerprint” Data Object follows the tag value 0xBC within the container. 

TE04.04.02.01 8. d Holder hat the length value after the 

tag 0xBC is less than 4000 bytes. 

4 “Car

Fingerprint” Data Object

The tester shall validate t

TE04.05.01.01 8.6 “Card Holder Facial The tester shall validate that the facial image follows

Image” Data Object the tag value 0xBC within the container. 

TE04.05.02.01

Image” Data Object 

e 

an 12,704 bytes. 

8.6 “Card Holder Facial The tester shall validate that the length value after th

tag 0xBC is less th

TE04.06.01.01 8.10 “Security Object” Data

Object present in the security object 

are identical to the message digest of the data object 

itself. 

The tester shall validate that the message digests for 

the various data objects

 Page A-1
Special Publication 800-85B PIV Data Model Testing Specification

A.2 Biometric Data Mapping 

DTR from 

Section 5 

Test Assertion from 

Section 9 

DTR Description 

TE05.01.01.01 r EFF structure is

implemented in accordance with Table 7 of SP800-76. 

9.1.1 CBEFF Structure fo

Fingerprint Template

9.2.1 CBEFF Structure for 

Facial Image 

The tester shall verify that the CB

TE05.01.02.01

EFF Header for 

9.1.2 CBEFF Header for n Format 

Fingerprint Template

9.2.2 CB

Facial Image 

The tester shall verify the length of the Patro

header. 

TE05.01.02.02 9.1.2 CBEFF Header for are consistent with 

Fingerprint Template

9.2.2 CBEFF Header for 

Facial Image 

The tester shall verify the values

Table 8 requirements of SP800-76. 

TE05.01.03.01 9.1.1 CBEFF Structure for 

r 

mage 

ader

mance 

rmance 

ainst the 

Fingerprint Template stored data. 

9.2.1 CBEFF Structure fo

Facial I

9.3.1 General Record He

Confor

9.3.2 View Header

Confo

The tester shall compare value provided ag

TE05.01.04.01 9.1.2.1 Patron Header

Version 

9.2.2.1 Patron Head

Version 

er

The tester shall verify that the Patron Header Version 

value is 0x03. 

TE05.03.05.01 n

H Security Option

The tester shall verify that the SBH security option 

value is b00001101. 

9.1.2.2 SBH Security Optio

9.2.2.2 SB

TE05.03.06.01 9.1.2.3 BDB Format Owner 

Values 

9.2.2.3 BDB Format Owner 

Values 

The tester shall verify that the BDB Format Owner 

field contains 0x001B. 

TE05.03.07.01 9.1.2.4 BDB Format Type 

9.2.2.4 BDB Format Type 

The tester shall verify that the BDB Format Type field

is 0x0201 for Fingerprint Template and 0x0501 for 

Facial Image. 

TE05.03.08.01 ric Creation 

ric Creation 

9.1.2.5 Biomet shall verify the date field is in compliance 

Date 

9.2.2.5 Biomet

Date 

The tester

with the assertion. 

TE05.03.09.01 9.1.2.6 Validity Period Dates headers contain two 

9.2.2.6 Validity Period Dates

The tester shall verify that the 

dates in compliance with the assertion.

 Page A-2
Special Publication 800-85B PIV Data Model Testing Specification

DTR from 

Section 5 

Test Assertion from 

Section 9 

DTR Description 

TE05.03.10.01 9.1.2.7 Biometric Type 

Values 

9.2.2.7 Biometric Type 

eld

plates 

Values 

The tester shall verify that the Biometric Type fi

contains 0x000008 for fingerprint images or tem

and 0x000002 for facial images. 

TE05.03.11.01 ric Data Type tester shall verify that the Biometric Data Type 

templates and b001xxxxx for facial image. 

9.1.2.8 Biomet

9.1.2.8 Biometric Data Type 

The

value is b100xxxxx for processed fingerprint 

TE05.03.12.01 9.1.2.9 Biometric D

Quality 

ata The tester shall verify that the value of Biometric Data

Quality is between -2 and 100. 

TE05.03.12.02 9.2.2.9 Biometric D

Quality 

ata The tester shall verify that the value of Biometric Data

Quality is -2 for a facial image. 

TE05.03.13.01 9.1.2.10 Creator Fie

9.2.2.10 Creator

ld Value

 Field Value

The tester shall verify the Creator field value. 

TE05.03.14.01 9.1.2.11 FASC-N Value

9.2.2.11 FASC-N Value 

The tester shall verify the FASC-N value. 

TE05.03.15.01 Reserved Field 

ed Field 

9.1.2.12 the “Reserved for future use” 

Value 

9.2.2.12 Reserv

Value 

The tester shall verify

field is 0x00000000. 

TE05.02.01.01 nt Minutiae The tester shall parse the biometric data container to

r. 

9.3.3 Fingerpri

Data verify both fingerprint templates are in one containe

TE05.02.02.01 ecord Header

Conformance 

nt Minutiae 

compliance with Table 3 of SP80076. 

9.3.1 General R

Conformance 

9.3.2 View Header

The tester shall verify that the resultant template is in

9.3.3 Fingerpri

Data 

TE05.02.03.01 9.3.1 General Record Header hat the Format Identifier value 

Conformance 

The tester shall verify t

is 0x464D5200. 

TE05.02.04.01 9.3.1 General Record Header

Conformance 

The tester shall verify that the Version Number is 

0x20323000. 

TE05.02.05.01

Conformance 

s

mits specified in SP 800-73-1. 

9.3.1 General Record Header The tester shall verify that the size of the container i

within the li

TE05.02.06.01 9.3.1 General Record Header

Conformance 

The tester shall verify that the values are present and 

accurate. 

TE05.02.07.01 9.3.1 General Record Header The tester shall verify the values specified in the 

Conformance documentation.

TE05.02.08.01 9.3.1 General Record Header rify the Capture Equipment 

Conformance 

The tester shall ve

Compliance value is 1000b. 

TE05.02.09.01 er

Conformance 

9.3.1 General Record Head The tester shall verify the Capture Equipment ID is in

accordance with vendor reporting. 

 Page A-3
Special Publication 800-85B PIV Data Model Testing Specification

DTR from 

Section 5 

Test Assertion from 

Section 9 

DTR Description 

TE05.02.10.01 9.3.1 General Record Heade

Conformance 

r

e Size of

rection. 

The tester shall verify the larger size of the two 

fingerprint templates is recorded in th

Scanned Image in X and Y Di

TE05.02.11.01 9.3.1 General Record Heade

Conformance 

r The tester shall verify the Number of Views values is 

2. 

TE05.02.12.01 9.3.1 General Record He

Conforma

ader

nce 

The tester shall verify the Reserved Byte value is 0. 

TE05.02.13.01 9.3.2 View Header ber value of the 

Conformance 

The tester shall verify the View Num

Single Finger View Record is 0. 

TE05.02.14.01 9.3.2 View Header 0 or 2 and is 

Conformance 

The tester shall verify the value is either 

consistent with vendor reporting. 

TE05.02.16.01 9.3.2 View Header the Number of Minutiae is 

Conformance 

The tester shall verify that

between 0 and 128. 

TE05.02.17.01

Data 

9.3.3 Fingerprint Minutiae The tester shall verify minutia type is either 00b, 01b,

or 10b. 

TE05.02.19.01 9.3.3 Fingerprint Minutia

Data 

e The tester shall verify that the value of Extended Data

Block Length is zero. 

TE05.03.01.01 9.4.1 Facial Image Header

Conformance 

9.4.2 Facial Image Data

to verify

Conformance 

The tester shall review the documentation 

compliance with the assertion. 

TE05.03.02.01 r

9.4.2 Facial Image Data 

9.4.1 Facial Image Heade is

Conformance 

Conformance 

The tester shall verify that the size of the record

such that it will be in compliance with the assertion.

A.3 CHUID Mapping 

DTR from 

Section 6 

Test Assertion from 

Section 10 

DTR Description 

TE06.01.01.01 10.1.1.1 Verify presence of

ture 

ata buffer 

CMS SignedData 

asymmetric digital signa

The tester shall validate that the CHUID d

contains a digital signature and has been formatted 

correctly as a CMS external signature as defined in 

RFC 3852. 

TE06.01.02.01 10.1.1.1 Verify presence of

CMS SignedData

asymmetric digital signature 

The tester shall validate that the CMS external digital

signature has been implemented as a SignedData type. 

TE06.01.03.01 10.1.1.2 Verify version in

SignedData

The tester shall validate the version of the SignedData

type is version 3. 

TE06.01.04.01 10.1.1.3 Verify digest

Algorithm in SignedData 

The tester shall validate that the digest algorithm is 

based on the expiration date of the PIV card and is in

accordance with Table 3-3 of SP 800-78. 

 Page A-4
Special Publication 800-85B PIV Data Model Testing Specification

DTR from 

Section 6 

Test Assertion from 

Section 10 

DTR Description 

TE06.01.05.01

fo

that eContentType of the

encapContentInfo asserts the id-PIV10.1.1.4 Verify contents ofencapContentIn

The tester shall validate

CHUIDSecurityObject OID. 

TE06.01.06.01 ents of

encapContentInfo 

10.1.1.4 Verify cont The tester shall validate that the eContent field has 

been omitted from the encapContentInfo.

TE06.01.07.01 10.2.1.13 Verify digital

signature 

The tester shall validate that there is a single X.509 

certificate in the certificates field that can verify the 

digital signature in the SignerInfo. 

TE06.01.08.01 10.1.1.5 Verify crls field

omission 

The tester shall validate that the crls field has been

omitted from the SignedData.

TE06.01.09.01 10.1.1.6 Verify contents

signerInfos 

 of The tester shall validate that only a single SignerInfo 

exists in the SignedData. 

TE06.01.10.01 10.1.1.7 Verify Signer

Identifier in SignerInfo e

The tester shall validate that the 

issuerAndSerialNumber choice has been used for th

SignerIdentifier. 

TE06.01.11.01 10.1.1.8 Verify Digest ter shall validate that the digest algorithm is 

Algorithm in SignerInfo 

The tes

based on the expiration date of the PIV card and is in

accordance with Table 3-3 of SP 800-78. 

TE06.01.12.01 10.1.1.9 Verify message

digest signed attribute in

SignerInfo

The tester shall validate the presence of a 

MessageDigest attribute in the signed attributes. 

TE06.01.12.02 10.1.1.9 Verify message

digest signed attribute in

SignerInfo

The tester shall validate the value of the 

MessageDigest attribute against the hash of the 

concatenated content of the CHUID, excluding the 

asymmetric signature field. 

TE06.01.13.01 10.1.1.10 Verify PIV signer

distinguished name

The tester shall validate the presence of a pivSignerDN attribute in the signed attributes 

TE06.01.13.02 10.1.1.10 Verify PIV signer

distinguished name

The tester shall validate the value of the pivSigner-DN

attribute is the same as the subject name that appears

in the certificate that signed the CHUID 

TE06.01.14.01 10.1.1.11 Verify signature 

algorithm in SignerInfo 

The tester shall validate that the signature algorithm is

based on the expiration date of the certificate and is in

accordance with Table 3-4 of SP 800-78. 

TE06.01.15.01 10.1.1.12 Verify digital

signature 

The tester shall validate that the SignedData content 

type includes the digital signature corresponding to 

the CHUID 

TE06.01.16.01 10.1.2.1 Verify extended k

usage extension 

ey that was 

tThe tester shall validate that the certificateused to sign the CHUID asserts the id-PIV-conten

signing OID in the extended key usage extension.

TE06.01.17.01 10.1.2.2 Verify signer publ

key size

ic The tester shall validate that the public key size is in

accordance with Table 3-3 of SP 800-78. 

 Page A-5
Special Publication 800-85B PIV Data Model Testing Specification

A.4 Biometric Fingerprint Mapping

DTR from 

Section 6 

Test Assertion from 

Section 10 

DTR Description 

TE06.02.01.01 10.2.1.1: Verify presence of

CMS SignedData EFF_SIGNATURE_BLOCK has been

The tester shall validate that the digital signature in

the CB

formatted correctly as a CMS external signature as 

defined in RFC 3852. 

TE06.02.02.01 10.2.1.1: Verify presence of

CMS SignedData 

The tester shall validate that the CMS external digital

signature has been implemented as a SignedData type.

TE06.02.03.01 10.2.1.2: Verify version in ll validate the version of the SignedData

SignedData 

The tester sha

type is version 1 or version 3 depending on whether

the certificates field is omitted. 

TE06.02.04.01 10.2.1.3:Verify digest rithm is

Algorithm in SignedData n

The tester shall validate that the digest algo

based on the expiration date of the PIV card and is i

accordance with Table 3-3 of SP 800-78. 

TE06.02.05.01 10.2.1.4: Verify contents of ContentType of the

encapContentInfo t

The tester shall validate that e

encapContentInfo asserts the id-PIV-biometricObjec

OID. 

TE06.02.06.01 10.2.1.4: Verify contents of 

encapContentInfo 

s 

 the encapContentInfo.

The tester shall validate that the eContent field ha

been omitted from

TE06.02.07.01 10.2.1.13: Verify digital

signature verify the 

digital signature in the SignerInfo. 

The tester shall validate that there is a single X.509 

certificate in the certificates field that can 

TE06 .07.02 10.2.1.13: Verify d

signature 

.02 igital If the certificates field is omitted, the tester shall 

validate that the certificate in the SignedData for the 

CHUID can verify the digital signature in the 

SignerInfo. 

TE06.02.08.01 10.2.1.5: Verify crls field The tester shall validate that the crls field has been

omission omitted from the SignedData.

TE06.02.09.01 s of

signerInfos 

10.2.1.6: Verify content The tester shall validate that only a single SignerInfo 

exists in the SignedData.

TE06.02.10.01 10.2.1.7: Verify Signer

Identifier in SignerInfo 

The tester shall validate that the 

issuerAndSerialNumber choice has been used for the

SignerIdentifier. 

TE06.02.11.01 10.2.1.8: Verify Digest

Algorithm in SignerInfo 

th Table 3-3 of SP 

The tester shall validate that the digest algorithm in

the SignerInfo is based on the expiration date of the 

PIV card and is in accordance wi

800-78. 

TE06.02.12.01

digest signed attribute in tes. 

10.2.1.9: Verify message

SignerInfo 

The tester shall validate the presence of a 

MessageDigest attribute in the signed attribu

TE06.02.12.02 ssage 

digest signed attribute in gest attribute against the hash of the 

10.2.1.9: Verify me

SignerInfo 

The tester shall validate the value of the 

MessageDi

concatenated CBEFF_HEADER and the

STD_BIOMETRIC_RECORD. 

TE06.02.13.01 10.2.1.10: Verify PIV sig

distinguishe

ner 

d name

The tester shall validate the presence of a pivSignerDN attribute in the signed attributes. 

 Page A-6
Special Publication 800-85B PIV Data Model Testing Specification

DTR from 

Section 6 

Test Assertion from 

Section 10 

DTR Description 

TE06.02.13.02 10.2.1.10: Verify PIV sig

distinguishe

ner 

d name

rtricThe tester shall validate the value of the pivSigne

DN attribute is the same as the subject name that 

appears in the certificate that signed the biome

data. 

TE06.02.14.01 10.2.1.11: Verify FASC-N N 

.

The tester shall validate the presence of a pivFASCattribute in the signed attributes

TE06.02.14.02 10.2.1.11: Verify FASC-N The tester shall validate the value of the pivFASC-N 

attribute is the same as the FASC-N that is present in 

the CHUID. 

TE06.02.15.01 re

algorithm in SignerInfo ion date of the PIV card and is in

10.2.1.12: Verify signatu The tester shall validate that the signature algorithm is

based on the expirat

accordance with Table 3-4 of SP 800-78. 

TE06.02.16.01

signature 

d biometric data. 

10.2.1.13: Verify digital The tester shall validate that the SignedData content 

type includes the digital signature corresponding to 

the signe

TE06.02.17.01 10.2.2.1: Verify extended

key usage extension 

The tester shall validate that the certificate

used to sign the fingerprint biometric data asserts

that was 

the 

id-PIV-content-signing OID in the extended key 

usage extension. 

TE06.02.18.01 10.2.2.2:Verify signer public s in

key size 

The tester shall validate that the public key size i

accordance with Table 3-3 of SP 800-78. 

A.5 Biometric Facial Image

DTR from 

Section 6 

Test Assertion from 

Section 10 

DTR Description 

TE06.03.01.01 10.3.1.1: Verify presence of ster shall validate that the digital signature in

CMS SignedData 

The te

the CBEFF_SIGNATURE_BLOCK has been

formatted correctly as a CMS external signature as 

defined in RFC 3852. 

TE06.03.02.01 10.3.1.1: Verify presence of validate that the CMS external digital 

CMS SignedData .

The tester shall

signature has been implemented as a SignedData type

TE06.03.03.01 10.3.1.2: Verify version in

SignedData n 1 or version 3 depending on whether

The tester shall validate the version of the SignedData

type is versio

the certificates field is omitted. 

TE06.03.04.01 10

Algorithm in SignedData d and is in

.3.1.3: Verify digest The tester shall validate that the digest algorithm is

based on the expiration date of the PIV car

accordance with Table 3-3 of SP 800-78. 

TE06.03.05.01 rify contents of 

encapContentInfo he id-PIV-biometricObject 

10.3.1.4: Ve The tester shall validate that eContentType of the

encapContentInfo asserts t

OID. 

TE06.03.06.01 ents of 

encapContentInfo 

10.3.1.4: Verify cont The tester shall validate that the eContent field has 

been omitted from the encapContentInfo.

TE06.03.07.01 10.3.1.13: Verify digital

signature 

The tester shall validate that there is a single X.509 

certificate in the certificates field that can verify the 

digital signature in the SignerInfo. 

 Page A-7
Special Publication 800-85B PIV Data Model Testing Specification

DTR from 

Section 6 

Test Assertion from

Section 10 

DTR Description 

TE06.03.07.02 s omitted, the tester shall 

validate that the certificate in the SignedData for the 

10.3.1.13: Verify digital

signature 

If the certificates field i

CHUID can verify the digital signature in the 

SignerInfo. 

TE06.03.08.01 10.3.1.5: Verify crls field

omission om the SignedData.

The tester shall validate that the crls field has been

omitted fr

TE06.03.09.01 10.3.1.6: Verify contents of 

signerInfos 

The tester shall validate that only a single SignerInfo 

exists in the SignedData. 

TE06.03.10.01 10.3.1.7: Verify Signer

Identifier in SignerInfo 

The tester shall validate that the 

issuerAndSerialNumber choice has been used for the

SignerIdentifier. 

TE06.03.11.01 10.3.1.8: Verify Digest

Algorithm in SignerInfo 

The tester shall validate that the digest algorithm in

the SignerInfo is based on the expiration date of the 

PIV card and is in accordance with Table 3-3 of SP 

800-78. 

TE06.03.12.01

digest signed attribute in butes. 

10.3.1.9: Verify message

SignerInfo 

The tester shall validate the presence of a 

MessageDigest attribute in the signed attri

TE06.03.12.02 ssage 

digest signed attribute in

he 

against the hash of the 

10.3.1.9: Verify me

SignerInfo 

The tester shall validate the value of t

MessageDigest attribute

concatenated CBEFF_HEADER and the

STD_BIOMETRIC_RECORD. 

TE06.03.13.01 10.3.1.10: Verify PIV signer date the presence of a pivSignerdistinguished nameThe tester shall vali

DN attribute in the signed attributes. 

TE06.03.13.02 10.3.1.10: Verify PIV signer the pivSignerdistinguished nameThe tester shall validate the value of

DN attribute is the same as the subject name that 

appears in the certificate that signed the biometric 

data. 

TE06.03.14.01 10.3.1.11: Verify FASC-N The tester shall validate the presence of a pivFASC-N 

attribute in the signed attributes. 

TE06.03.14.02 10.3.1.11: Verify FASC-N The tester shall validate the value of the pivFASC-N 

attribute is the same as the FASC-N that is present in

the CHUID. 

TE06.03.15.01 10.3.1.12: Verify signatu

algorithm in SignerInfo

re m is 

 in

The tester shall validate that the signature algorith

based on the expiration date of the PIV card and is

accordance with Table 3-4 of SP 800-78. 

TE06.03.16.01 10.3.1.13: Verify digital

signature 

The tester shall validate that the SignedData content 

type includes the digital signature corresponding to 

the signed biometric data. 

TE06.03.17.01 10 hat the certificate that was 

mage biometric data asserts 

the id-PIV-content-signing OID in the extended key 

usage extension. 

.3.2.1: Verify extended 

key usage extension 

The tester shall validate t

used to sign the facial i

TE06.03.18.01 10.3.2.2: Verify signer 

public key size 

The tester shall validate that the public key size is in

accordance with Table 3-3 of SP 800-78. 

 Page A-8
Special Publication 800-85B PIV Data Model Testing Specification

A.6 Security Object

DTR from 

Section 6 

Test Assertion from 

Section 10 

DTR Description 

TE06.04.01.01 10.4.1.1: Verify integrity

data element hashes 

 of The tester shall validate that the message digests for

the various data objects present in the security object

are identical to the message digest of the data object 

itself. 

TE06.04.02.01 10.4.2.1: Verify presence o

CMS SignedData 

f

asymmetric digital signature 

The tester shall validate that the digital signature has 

been formatted correctly as a CMS signature as 

defined in RFC (3852). 

TE06.04.03.01 10.4.2.1: Verify presence of

CMS SignedData

asymmetric digital signature 

S digital 

.

The tester shall validate that the CM

signature has been implemented as a SignedData type

TE06.04.04.01 10.4.2.2: Verify version i

SignedData 

n The tester shall validate the version of the SignedData

type is version 1. 

TE06.04.05.01 10.4.2.3: Verify digest

Algorithm in SignedData piration date of the PIV card and is in

The tester shall validate that the digest algorithm is 

based on the ex

accordance with Table 3-7 of SP 800-78. 

TE06.04.06.01

encapContentInfo 

10.4.2.4: Verify contents of The tester shall validate that eContentType of the

encapContentInfo asserts the id-icaoldsSecurityObject OID. 

TE06.04.07.01 10.4.2.4: Verify contents of 

encapContentInfo 

The tester shall validate that eContent of the 

encapContentInfo contains the contents of the 

ldsSecurity object. 

TE06.04.08.01 10.4.2.5: Verify certificates 

field omission 

The tester shall validate that the certificates field has 

been omitted from the SignedData. 

TE06.04.09.01 10.4.2.6: Verify Digest

Algorithm in SignerInfo 

The tester shall validate that the digest algorithm in

the SignerInfo is based on the expiration date of the 

PIV card and is in accordance with Table 3-7 of SP 

800-78. 

TE06.04.10.01 .7: Verify signature 

thm in SignerInfo 

algorithm is 

e and is in

10.4.2

algori

The tester shall validate that the signature

based on the expiration date of the certificat

accordance with Table 3-4 of SP 800-78. 

TE06.04.11.01 10.4.2.8: Verify digital

signature 

The tester shall validate that the SignedData content 

type includes the digital signature corresponding to 

the signed security object. 

TE06.04.12.01 10.4.2.8: Verify digital 

signature 

The tester shall validate that the certificate in the

SignedData for the CHUID can verify the digital 

signature in the SignerInfo.

A.7 PIV Authentication Key

DTR from 

Section 7 

Test Assertion from

Section 11 

DTR Description 

TE07.01.01.01 11.1.1.1: Verify signature 

algorithm

The tester shall validate that the signature algorithm is 

based on the expiration date of the certificate and is in

accordance with Table 3-4 of SP 800-78. 

 Page A-9
Special Publication 800-85B PIV Data Model Testing Specification

DTR from 

Section 7 

Test Assertion from

Section 11 

DTR Description 

TE07.01.02.01 that the correctness of the 

values of the AlgorithmIdentifier fields. 

11.1.1.1: Verify signature

algorithm

The tester shall validate

TE07.01.03.01 11.1.1.2: Verify subject 

public key algorithm

The tester shall validate that the algorithm used to

generate PIV authentication keys are in accordance 

with Table 3-5 of SP 800-78. 

TE07.01.04.01 11.1.1.2: Verify subject 

public key algorithm

ues

ithm of the 

ion

The tester shall validate the correctness of the val

of the parameters field of the algor

subjectPublicKeyInfo field in the PIV authenticat

certificate issued by the vendor. 

TE07.01.05.01 11.1.1.3: Verify key usage he assertion of the 

extension 

The tester shall validate t

digitalSignature bit in the keyUsage extension in the 

PIV authentication certificate issued by the vendor. 

TE07.01.06.01 11.1.1.4: Verify id-fpkicommon-authentication OID e certificatePolicies 

e issued 

The tester shall validate the presence of the id-fkicommon-authentication OID in th

extension in the PIV authentication certificat

by the vendor.

TE07.01.07.01 11.1.1.5: Verify authority 

information access extension thorityInfoAccess extension in

he 

The tester shall validate the presence of an id-ad-ocsp 

accessMethod in the au

the PIV authentication certificate issued by the 

vendor. The tester shall also validate that t

accessLocation for this accessMethod uses the URI 

name form and points to an HTTP accessible OCSP 

server. 

TE07.01.08.01 11.1.2.3: Verify FASC-N The tester shall validate the presence of the FASC-N 

in the subjectAltName extension in the PIV 

authentication certificate issued by the vendor. 

TE07.01.09.01 11.1.1.6: Verify interim

status extension 

sion 

ed 

The tester shall validate that the piv-interim exten

is present in the PIV authentication certificate issu

by the vendor.

TE07.01.10.01 11.1.2.1: Verify public key The tester shall validate that the public key size is in

size accordance with Table 3-1 of SP 800-78. 

TE07.01.11.01 11.1.2.2: Verify asymmetric The tester shall validate that the public key present in

certificate is part of the key 

pair corresponding to the private key on the PIV card. 

key pair the PIV authentication

TE07.01.12.01 11.1.2.3: Verify FASC-N The tester shall validate that the FASC-N in the 

subjectAltName field in the PIV authentication 

certificate is the same as the FASC-N present in the 

CHUID in the PIV card.

TE07.01.13.01 11.1.2.4: Verify expiration

dates consistency e expiration 

The tester shall validate that the expiration of the PIV 

authentication certificate is not beyond th

of the CHUID in the PIV card. 

TE07.01.14.01 11

exponent qual to 65,537. 

.1.2.5: Verify RSA The tester shall validate that the RSA public key 

exponent size is greater than or e

 Page A-10
Special Publication 800-85B PIV Data Model Testing Specification

A.8 Digital Signature Key

DTR from 

Section 7 

Test Assertion from 

Section 11

DTR Description 

TE07.02.01.01 11.2.1.1: Verify signature 

algorithm

The tester shall validate that the signature

based on the expiration date of the certificate and is i

accordance with Table 3-4 of SP 800-78. 

algorithm is 

n

TE07.02.02.01 11.2.1.1: Verify signature

algorithm

The tester shall validate that the correctness of the 

values of the AlgorithmIdentifier fields. 

TE07.02.03.01 11.2.1.2: Verify subject 

public key algorithm

The tester shall validate that the algorithm used to

generate digital signature keys are in accordance with

Table 3-5 of SP 800-78.

TE07.02.04.01 11.2.1.2: Verify subjec

public key algorithm

t lues

the

ure 

certificate issued by the vendor. 

The tester shall validate the correctness of the va

of the parameters field of the algorithm of

subjectPublicKeyInfo field in the digital signat

TE07.02.05.01 11.2.1.3: Verify key usage

extension 

The tester shall validate the assertion of the 

digitalSignature bit and the nonRepudiation bit in the 

ke digital signature certificate 

issu

yUsage extension in the

ed by the vendor. 

TE07.02.06.01 Th

ac

11.2.2.1: Verify public key

size 

e tester shall validate that the public key size is in

cordance with Table 3-1 of SP 800-78. 

TE07.02.07.01 11.2.2.2: Verify asymmetric Th esent in

the

co

key pair

e tester shall validate that the public key pr

digital signature certificate is part of the key pair

rresponding to the private key on the PIV card. 

TE07.02.08.01 Th

dig

ex

11.2.2.3: Verify expiration

dates consistency 

e tester shall validate that the expiration of the 

ital signature certificate is not beyond the 

piration of the CHUID in the PIV card. 

TE07.02.09.01 11.2.2.4: Verify RSA 

exponent 

Th

ex

e tester shall validate that the RSA public key 

ponent size is greater than or equal to 65,537. 

A.9 Key Management Key

DTR from 

Section 7 

Test Assertion from

Section 11 

DTR Description

TE07.03.01.01 11.3.1.1: Verify signature

algorithm

Th

ba

accorda

e tester shall validate that the signature algorithm is 

sed on the expiration date of the certificate and is in

nce with Table 3-4 of SP 800-78. 

TE07.03.02.01 11.3.1.1: Verify signature 

algorithm

Th

valu

e tester shall validate that the correctness of the

es of the AlgorithmIdentifier fields. 

TE07.03.03.01 11.3.1.2: Verify subject 

public key algorithm

Th

ge

wi

e tester shall validate that the algorithm used to

nerate key management keys are in accordance 

th Table 3-5 of SP 800-78. 

TE07.03.04.01 11.3.1.2: Verify subject 

public key algorithm

Th

of

su licKeyInfo field in the key management

certificate issued by the vendor. 

e tester shall validate the correctness of the values

the parameters field of the algorithm of the 

bjectPub

 Page A-11
Special Publication 800-85B PIV Data Model Testing Specification

DTR from 

Section 7 

Test Assertion from 

Section 11 

DTR Description

TE07.03.05.01 11.3.1.3: Verify key usage

extension 

Th

co

ke

e tester shall validate that certificates 

rresponding to RSA keys assert only the 

yEncipherment bit in the keyUsage extension. 

TE07.03.06.01 Th

co

ke in the keyUsage extension. 

11.3.1.3: Verify key usage

extension 

e tester shall validate that certificates 

rresponding to elliptic curve keys assert only the 

yAgreement bit

TE07.03.07.01

size 

h

ac

11.3.2.1: Verify public key T e tester shall validate that the public key size is in

cordance with Table 3-1 of SP 800-78. 

TE07.03.08.01 11.3.2.2: Verify asymmetric

key pair

Th

the

co

e tester shall validate that the public key present in

key management certificate is part of the key pair

rresponding to the private key on the PIV card. 

TE07.03.09.01

exponent 

Th

ex

11.3.2.3: Verify RSA e tester shall validate that the RSA public key 

ponent size is greater than or equal to 65,537. 

A.10 Card Authentication Key

DTR from

Section 7

Test Assertion from 

Section 11 

DTR Description 

TE07.04.01.01 11.4.1.1: Verify signature 

algorithm

The tester shall validate that the signature algorithm is 

based on the expiration date of the certificate and is in

accordance with Table 3-4 of SP 800-78. 

TE07.04.02.01 11.4.1.1: Verify signature 

algorithm

The tester shall validate that the correctness of the

values of the AlgorithmIdentifier fields. 

TE07.04.03.01 11.4.1.2: Verify subject public

key algorithm

The tester shall validate that the algorithm used to

generate card authentication keys are in accordance 

with Table 3-5 of SP 800-78. 

TE07.04.04.01 11.4.1.2: Verify subject public

key algorithm

The tester shall validate the correctness of the values

of the parameters field of the algorithm of the 

subjectPublicKeyInfo field in the card authentication

certificate issued by the vendor. 

TE07.04.05.01 11.4.1.3: Verify key usage

extension 

The tester shall validate the assertion of the 

digitalSignature bit in the keyUsage extension in the 

card authentication certificate issued by the vendor. 

TE07.04.06.01 11.4.1.4: Verify id-fpkicommon-cardAuth OID The tester shall validate the policyIdentifier field in

certificatePolicies has asserted the id-fpki-commoncardAuth OID.

TE07.04.07.01 11.4.1.5: Verify extended key

usage extension 

The tester shall validate the extKeyUsage asserts the 

id-PIV-cardAuth OID as a critical extension. 

TE07.04.08.01 11.4.1.6: Verify authority 

information access extension 

The tester shall validate the presence of an id-ad-ocsp 

accessMethod in the authorityInfoAccess extension in

the card authentication certificate issued by the 

vendor. The tester shall also validate that the 

accessLocation for this accessMethod uses the URI 

name form and points to an HTTP accessible OCSP 

server. 

 Page A-12
Special Publication 800-85B PIV Data Model Testing Specification

DTR from 

Section 7 

Test Assertion from 

Section 11 

DTR Description 

TE07.04.09.01: 11.4.2.3: Verify FASC-N The tester shall validate the presence of the FASC-N 

in the subjectAltName extension in the card 

authentication certificate issued by the vendor. 

TE07.04.10.01 11.4.1.7: Verify interim status The tester shall validate that the piv-interim extension 

by the vendor.

extension is present in the card authentication certificate issued 

TE07.04.11.01 11.4.2.1: Verify public key size The tester shall validate that the public key size is in

accordance with Table 3-1 of SP 800-78. 

TE07.04.12.01 ymmetric The tester shall validate that the public key present in

the card authentication certificate is part of the key 

11.4.2.2: Verify as

key pair

pair corresponding to the private key on the PIV card.

TE07.04.13.01 ASC-N The tester shall validate that the FASC-N in the 

subjectAltName field in the card authentication 

CHUID in the PIV card.

11.4.2.3: Verify F

certificate is the same as the FASC-N present in the 

TE0 

exponent size is greater than or equal to 65,537. 

7.04.14.01 11.4.2.4: Verify RSA exponent The tester shall validate that the RSA public key 

 

 

 Page A-13
Special Publication 800-85B PIV Data Model Testing Specification

Appendix B—Bibliography

Citation

Code 

Document 

SP80073 NIST Special Publication 800-73 Revision 1, Interfaces for Personal Identity Verification. 

SP80076 NIST Special Publication 800-76, Biometric Data Specification for Personal Identity Verification. 

SP80078 NIST Spec

Verificatio

ial Publication 800-78, Cryptographic Algorithms and Key Sizes for Personal Identity 

n, 2005. 

SP80085A NIST Special Publication 800-85A, PIV Card Application and Middleware Interface Test 

Guidelines, 2006. 

FIPS201 FIPS 201-1, Personal Identity Verification, National Institute of Standards and Technology, 2005. 

FINGSTD INCITS 38 erican National Standard for Information Technology - Finger Image-Based 

Data Interchange Format. 

1-2004, Am

MINUSTD INCITS 37

Format for

8-2004, American National Standard for Information Technology - Finger Minutiae 

Data Interchange.

FACESTD INCITS 385-2004, American National Standard for Information Technology - Face Recognition 

Format for Data Interchange.

CBEFF INCITS 39

Exchange ework (CBEFF). 

8-2005, American National Standard for Information Technology - Common Biometric 

Formats Fram

EFTS Crim

IAFIS-DO

inal J

2, 2005. 

The material at http://www.fbi.gov/hq/cjisd/iafis/efts71/cover.htm

C-01078-7.1 CJIS-RS-0010 (V7.1) – Electronic Fingerprint Transmission Specification, 

ustice Information Services, Federal Bureau of Investigation, Department of Justice, May

may not be fully up to date. 

Implementers should request the full EFTS documentation, including Appendix N, from the FBI.

ISO7816 ISO/IEC 7 ), Information technology — Identification cards — Integrated

circuit(s) cards with contacts. 

816 (Parts 4, 5, 6, 8, and 9

X509 X.509 Certificate Policy. 

X509 X.509 Certificate and Certificate Revocation L

Extensions Providers (SSP) Program, Febr

ist (CRL) Extensions Profile for the Shared Service 

uary 6, 2006. 

 Page B-1
Special Publication 800-85B PIV Data Model Testing Specification

Appendix C—Glossary of Terms and Acronyms 

C.1 Glossary of Terms 

Term Meaning 

Offline T numbers of competing products. They institute a level-playing fiel

of an algorithm. This style o

est

ptured images as inputs to core biometric implementations. 

le and can readily be scaled to very large populations and large 

d and produce robust

f testing is particularly 

fingerprint template (see [ISOSWAP]). 

Offline tests use previously ca

Such tests are repeatab

estimates of the core biometric power 

suited to interoperability testing of a

Scenario Te

institute controls on the proce

population to transact with bi st 

tional application and simultaneously 

dures. Scenario testing requires members of a human test 

ometric sensors. Scenario tests are appropriate for capturing 

ractions human users have with biometric sensors and 

Scenario testing is intended to mimic an opera

and assessing the effects of inte

interfaces. 

Operation

human test population to tra

al Test 

deployed system and are usually conducted to measure in-the-

-system interaction effects. Such tests require the members of a 

nsact with biometric sensors. False acceptance rates may not 

ending on the controls instituted.

Operational tests involve a

field performance and user

be measurable, dep

Interoperab

templates by N en

ility Test 

re the performance associated with the use of standardized

multiple vendor environment. It involves the production of the 

rollment products and authentication of these against images processed

Interoperability tests measu

biometric data records in a

by M others. 

Template Matcher 

In the PIV context a matcher is a software library pro

conformant to FINGSTD and templates conformant t

viding for the comparison of images 

o MINUSTD. The output of the 

matcher, a similarity score, will be the basis of accept or reject decision. 

Template Gen rator conversion of imag

storage on the PIV 

e

ntext a template generator is a software library providing facilities for the 

es conformant to FINGSTD to templates conformant to MINUSTD for 

card. 

In the PIV co

C.2 Acronyms 

ANSI American National Standards Institute 

BDB Biometric Data Block

BER-TLV Basic Encoding Rules Tag-Length-Value 

CBEFF Common Biometric Exchange Formats Framework 

CCC Card Capability Container 

CHUID Cardholder Unique Identifier 

CMS Cryptographic Message Syntax 

CRL Certificate Revocation List 

DTR Derived Test Requirement 

 Page C-1
Special Publication 800-85B PIV Data Model Testing Specification

 Page C-2

ECDSA Elliptic Curve Digital Signature Algorithm 

FICC Federal Identity Credentialing Committee 

FIPS Federal Information Processing Standards 

FISMA Federal Information Security Management Act 

GUID Global Unique Identification Number 

HSPD Homeland Security Presidential Directive 

HTTP Hypertext Transfer Protocol 

INCITS International Committee for Information Technology Standards 

ITL Information Technology Laboratory 

NIST National Institute of Standards and Technology 

OCSP Online Certificate Status Protocol 

OMB Office of Management and Budget 

PC/SC Personal Computer/Smart Card 

PIN Personal Identification Number 

PIV Personal Identity Verification 

PKI Public Key Infrastructure 

PSS Probabilistic Signature Scheme

RSA Rivest Shamir Adleman

SBH Signature Block Header 

SCEPACS Smart Card Enabled Physical Access Control System 

SHA Secure Hash Algorithm

SP Special Publication 

SSP Shared Service Providers 

TIG Technical Implementation Guidance 

URI Uniform Resource Identifier