NIST Special Publication 800-73-2 Interfaces for Personal Identity 

Verification – Part 2: End-Point 

PIV Card Application Card 

Command Interface

September 2008

U.S. Department of Commerce

Carlos M. Gutierrez, Secretary

I N F O R M A T I O N S E C U R I T Y

National Institute of Standards and Technology

Ramaswamy Chandramouli

James F. Dray

Hildegard Ferraiolo

Scott B. Guthery

William MacGregor

Ketan Mehta

Information Technology Laboratory

National Institute of Standards and Technology

Gaithersburg, MD, 20899-8930

James M. Turner, Deputy Director
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

Reports on Computer Systems Technology 

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology 

(NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s 

measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of 

concept implementations, and technical analyses to advance the development and productive use of 

information technology. ITL’s responsibilities include the development of management, administrative, 

technical, and physical standards and guidelines for the cost-effective security and privacy of non-national 

security-related information in Federal information systems. This special publication 800-series reports 

on ITL’s research, guidelines, and outreach efforts in information system security, and its collaborative 

activities with industry, government, and academic organizations. 

National Institute of Standards and Technology Special Publication 800-73-2, Part 2, 

 29 pages (September 2008) 

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an 

experimental procedure or concept adequately. Such identification is not intended to imply recommendation or 

endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, 

materials, or equipment are necessarily the best available for the purpose. 

NIST makes no representation as to whether or not one or more implementations of SP 800-73-2 is/are covered by 

existing patents. 
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

Acknowledgements 

The authors (Ramaswamy Chandramouli, James Dray, Hildegard Ferraiolo, William MacGregor of NIST, 

Ketan Mehta of Mehta Inc. and Scott Guthery of Mobile Mind Inc.) wish to thank their colleagues who 

reviewed drafts of this document and contributed to its development. Special thanks to the Government 

Smart Card Interagency Advisory Board (GSC-IAB) and InterNational Committee for Information 

Technology Standards (INCITS) for providing detailed technical inputs to the SP 800-73-2 development 

process. The authors also gratefully acknowledge and appreciate the many contributions from the public 

and private sectors whose thoughtful and constructive comments improved the quality and usefulness of 

this publication. 
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

Table of Contents 

1. INTRODUCTION ..............................................................................................................................................1

1.1 AUTHORITY......................................................................................................................................................1

1.2 PURPOSE ..........................................................................................................................................................1

1.3 SCOPE ..............................................................................................................................................................2

1.4 AUDIENCE AND ASSUMPTIONS.........................................................................................................................2

1.5 CONTENT AND ORGANIZATION ........................................................................................................................2

2. OVERVIEW: END-POINT CONCEPTS AND CONSTRUCTS...................................................................3

2.1 UNIFIED CARD COMMAND INTERFACE ............................................................................................................3

2.1.1 Platform Requirements..........................................................................................................................3

2.2 NAMESPACES OF THE PIV CARD APPLICATION................................................................................................4

2.3 CARD APPLICATIONS .......................................................................................................................................4

2.3.1 Default Selected Card Application ........................................................................................................4

2.4 SECURITY ARCHITECTURE ...............................................................................................................................4

2.4.1 Access Control Rule...............................................................................................................................5

2.4.2 Security Status .......................................................................................................................................5

2.4.3 Authentication of an Individual .............................................................................................................5

2.5 CURRENT STATE OF THE PIV CARD APPLICATION...........................................................................................6

3. END-POINT PIV CARD APPLICATION CARD COMMAND INTERFACE...........................................7

3.1 PIV CARD APPLICATION CARD COMMANDS FOR DATA ACCESS .....................................................................7

3.1.1 SELECT Card Command.......................................................................................................................7

3.1.2 GET DATA Card Command ..................................................................................................................9

3.2 PIV CARD APPLICATION CARD COMMANDS FOR AUTHENTICATION .............................................................10

3.2.1 VERIFY Card Command .....................................................................................................................10

3.2.2 CHANGE REFERENCE DATA Card Command.................................................................................11

3.2.3 RESET RETRY COUNTER Card Command .......................................................................................13

3.2.4 GENERAL AUTHENTICATE Card Command....................................................................................14

3.3 PIV CARD APPLICATION CARD COMMANDS FOR CREDENTIAL INITIALIZATION AND ADMINISTRATION .......15

3.3.1 PUT DATA Card Command ................................................................................................................15

3.3.2 GENERATE ASYMMETRIC KEY PAIR Card Command....................................................................16

List of Appendices 

APPENDIX A— EXAMPLES OF THE USE OF GENERAL AUTHENTICATE.............................................18

A.1 AUTHENTICATION OF THE PIV CARD APPLICATION ADMINISTRATOR ......................................................18

A.2 VALIDATION OF THE PIV CARD APPLICATION ..........................................................................................18

APPENDIX B— TERMS, ACRONYMS, AND NOTATION ...............................................................................20

B.1 TERMS.......................................................................................................................................................20

B.2 ACRONYMS ...............................................................................................................................................21

B.3 NOTATION.................................................................................................................................................22

APPENDIX C— REFERENCES.............................................................................................................................24
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

List of Tables 

Table 1. State of the PIV Card Application ..................................................................................6

Table 2. PIV Card Application Card Commands..........................................................................7

Table 3. Data Objects in the PIV Card Application Property Template (Tag '61')........................9

Table 4. Data Objects in a Coexistent Tag Allocation Authority Template (Tag '79')...................9

Table 5. Data Objects in the Data Field of the GET DATA Card Command..............................10

Table 6. Data Objects in the Dynamic Authentication Template (Tag '7C') ...............................14

Table 7. Data Objects in the Data Field of the PUT DATA Card Command for the Discovery 

 Object...........................................................................................................................16

Table 8. Data Objects in the Data Field of the PUT DATA Card Command for all other PIV Data 

 Objects.........................................................................................................................16

Table 9. Data Objects in the Template (Tag 'AC') .....................................................................17

Table 10. Data Objects in the Template (Tag '7F49') ................................................................17

Table 11. Authentication of PIV Card Application Administrator................................................18

Table 12. Validation of the PIV Card Application Using GENERAL AUTHENTICATE..............19
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

1. Introduction 

The Homeland Security Presidential Directive 12 (HSPD-12) called for a common identification standard 

to be adopted governing the interoperable use of identity credentials to allow physical and logical access 

to Federal government locations and systems. The Personal Identity Verification (PIV) of Federal 

Employees and Contractors, Federal Information Processing Standard 201 (FIPS 201) [1] was developed 

to establish standards for identity credentials. Special Publication 800-73-2 (SP 800-73-2) specifies 

interface requirements for retrieving and using the identity credentials from the PIV Card1 and is a 

companion document to FIPS 201. 

1.1 Authority 

This document has been developed by the National Institute of Standards and Technology (NIST) in 

furtherance of its statutory responsibilities under the Federal Information Security Management Act 

(FISMA) of 2002, Public Law 107-347. 

NIST is responsible for developing standards and guidelines, including minimum requirements, for 

providing adequate information security for all agency operations and assets, but such standards and 

guidelines shall not apply to national security systems. This recommendation is consistent with the 

requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), Securing 

Agency Information Systems, as analyzed in A-130, Appendix IV: Analysis of Key Sections. 

Supplemental information is provided A-130, Appendix III. 

This recommendation has been prepared for use by federal agencies. It may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright though attribution is 

desirable. Nothing in this document should be taken to contradict standards and guidelines made 

mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority. Nor 

should this recommendation be interpreted as altering or superseding the existing authorities of the 

Secretary of Commerce, Director of the Office of Management and Budget (OMB), or any other Federal 

official. 

1.2 Purpose 

FIPS 201 defines procedures for the PIV lifecycle activities including identity proofing, registration, PIV 

Card issuance, and PIV Card usage. FIPS 201 also specifies that the identity credentials must be stored 

on a smart card. SP 800-73-2 contains technical specifications to interface with the smart card to retrieve 

and use the identity credentials. The specifications reflect the design goals of interoperability and PIV 

Card functions. The goals are addressed by specifying a PIV data model, card edge interface, and 

application programming interface. Moreover, the specifications enumerate requirements where the 

standards include options and branches. SP 800-73-2 goes further by constraining implementers' 

interpretations of the normative standards. Such restrictions are designed to ease implementation, 

facilitate interoperability, and ensure performance, in a manner tailored for PIV applications. 

 

1

 A physical artifact (e.g., identity card, “smart” card) issued to an individual that contains stored identity credentials (e.g., 

photograph, cryptographic keys, biometric data) so that the claimed identity of the cardholder can be verified against the 

stored credentials by another person (human readable and verifiable) or an automated process (computer readable and 

verifiable). 

 Page 1 
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

 Page 2 

1.3 Scope 

SP 800-73-2 specifies the PIV data model, Application Programming Interface (API) and card interface 

requirements necessary to comply with the use cases, as defined in Section 6 of FIPS 201 and further 

elaborated in Appendix B of SP 800-73-2 Part 1. Interoperability is defined as the use of PIV identity 

credentials such that client-application programs, compliant card applications, and compliant integrated 

circuits cards (ICC) can be used interchangeably by all information processing systems across Federal 

agencies. 

This Part, SP 800-73-2 Part 2 – End-Point PIV Card Application Interface contains the technical 

specifications of the PIV Card command interface to the PIV Card. The specification defines the set of 

commands surfaced by the PIV Card Application at the card edge of the ICC. 

1.4 Audience and Assumptions 

This document is targeted at Federal agencies and implementers of PIV systems. Readers are assumed to 

have a working knowledge of smart card standards and applications. 

1.5 Content and Organization 

All sections in this document are normative (i.e., mandatory for compliance) unless specified as 

informative (i.e., non-mandatory). Following is the structure of Part 2: 

 Section 1, Introduction, provides the purpose, scope, audience, and assumptions of the document 

and outlines its structure. 

 Section 2, Overview: End-Point Concept and Construct, describes the model of computation of 

the PIV Card Application and the PIV client-application programming interface including 

information processing concepts and data representation constructs. 

 Section 3, End-Point PIV Card Application Card Command Interface, describes the set of 

commands accessible by the PIV middleware to communicate with the PIV Card Application. 

 Appendix A, Examples of the Use of GENERAL AUTHENTICATE, demonstrates the GENERAL 

AUHTENTICATE command. This section is informative.

 Appendix B, Terms, Acronyms, and Notation, contains the list of Terms and Acronyms used in 

this document and explains the notation in use. This section is informative. 

 Appendix C, References, contains the lists of documents used as references by this document. 

This section is informative. 
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

2. Overview: End-Point Concepts and Constructs 

SP 800-73-2 Part 2 and Part 3 define two interfaces to an ICC that contains the Personal Identity 

Verification card application: a low-level PIV Card Application card command interface (Part 2, card 

edge) and a high-level PIV client-API (Part 3). 

The information processing concepts and data constructs on both interfaces are identical and may be 

referred to generically as the information processing concepts and data constructs on the PIV interfaces

without specific reference to the client-application programming interface or the card command interface. 

The client-application programming interface provides task-specific programmatic access to these 

concepts and constructs and the card command interface provides communication access to concepts and 

constructs. The client-application programming interface is used by client applications using the PIV 

Card Application. The card command interface is used by software implementing the client-application 

programming interface (middleware). 

The client-application programming interface is thought of as being at a higher level than the card 

command interface because access to a single entry point on the client-application programming interface 

may cause multiple card commands to traverse the card command interface. In other words, it may 

require more than one card command on the card command interface to accomplish the task represented 

by a single call on an entry point of the client-application programming interface. 

The client-application programming interface is a program execution, call/return style interface whereas 

the card command interface is a communication protocol, command/response style interface. Because of 

this difference, the representation of the PIV concepts and constructs as bits and bytes on the clientapplication program interface may be different from the representation of these same concepts and 

constructs on the card command interface. 

2.1 Unified Card Command Interface 

The card command interface of the PIV Card Application is a unification of the two card command 

interfaces found in Government Smart Card Interoperability Specification (GSC-IS) [2]. 

This unification is accomplished by adopting the object-oriented model of computation of the GSC-IS 

virtual machine card edge and realizing its technical details using the data structures and operations found 

in the international ICC standards [3] underpinning the GSC-IS file system card edge. This brings the 

PIV Card Application into conformance with those standards with minimal impact on existing GSC-IS 

deployments. 

As a result of this unification, the behavior of the PIV Card Application and the client-applications 

accessing it is independent of the ICC platform on which the PIV Card Application is installed. 

2.1.1 Platform Requirements 

The following are the requirements that the PIV Card Application places on the ICC platform on which it 

is implemented or installed: 

+ global security status that includes the security status of a global cardholder PIN 

+ application selection using a truncated Application Identifier (AID) 

 Page 3 
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

 

+ ability to reset the security status of an individual application 

+ indication to applications as to which physical communication interface – contact versus 

contactless – is in use 

+ support for the default selection of an application upon warm or cold reset 

2.2 Namespaces of the PIV Card Application 

AID, Names, Tag Length Value (BER-TLV) [4] tags, ASN.1 [5] Object Identifiers (OIDs) and 

Proprietary Identifier Extensions (PIXes) of the NIST Registered Application Provider Identifier (RID) 

used on the PIV interfaces are specified in Part 1. Part 1 also specifies the use of all unspecified names, 

BER-TLV tags, OID, and values of algorithm identifiers, key reference, and cryptographic mechanism 

identifiers. 

2.3 Card Applications 

Each command that appears on the card command interface shall be implemented by a card application

that is resident on the ICC. The card command enables operations on and with the data objects to which 

the card application has access. 

Each card application shall have a globally unique name called its Application Identifier (AID) [3, Part 4]. 

Except for the default applications, access to the card commands and data objects of a card application 

shall be gained by selecting the card application using its application identifier2

. The PIX of the AID 

shall contain an encoding of the version of the card application. The AID of the Personal Identity 

Verification card application (PIV Card Application) is defined in Part 1. 

The card application whose commands are currently being used is called the currently selected 

application. 

2.3.1 Default Selected Card Application 

The card platform shall support a default selected card application. In other words, there shall be a 

currently selected application immediately after a cold or warm reset. This card application is the default 

selected card application. The default card application may be the PIV Card Application, or it may be 

another card application. 

2.4 Security Architecture 

The security architecture of an ICC is the means by which the security policies governing access to each 

data object stored on the card are represented within the card. 

The software in the ICC applies these security policy representations to all card commands thereby 

ensuring that the prescribed data policies for the card applications are enforced. 

The following subsections describe the security architecture of the PIV Card Application. 

2

 Access to the default application (and its commands and objects), occurs immediately after a warm or cold card reset without an 

explicit SELECT command. 

 Page 4 
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

2.4.1 Access Control Rule 

An access control rule shall consist of an access mode and a security condition. The access mode is an 

operation that can be performed on a data object. A security condition is a Boolean expression using 

variables called security statuses that are defined below. 

According to an access control rule, the action described by the access mode can be performed on the data 

object if and only if the security condition evaluates to TRUE for the current values of the security 

statuses. If there is no access control rule with an access mode describing a particular action, then that 

action shall never be performed on the data object. 

2.4.2 Security Status 

Associated with each authenticatable entity shall be a set of one or more Boolean variables each called a 

security status indicator of the authenticatable entity. Each security status indicator, in turn, is associated 

with a credential that can be used to authenticate the entity. The security status indicator of an 

authenticatable entity shall be TRUE if the credentials associated with the security status indicator of the 

authenticatable entity have been authenticated and FALSE otherwise. 

A successful execution of an authentication protocol shall set the security status indicator associated with 

the credential used in the protocol to TRUE. An aborted or failed execution of an authentication protocol 

shall set the security status indicator associated with the credential used in the protocol to FALSE. 

As an example, the credentials associated with two security status indicators of the cardholder might be: 

PIN and fingerprint. Demonstration of knowledge of the PIN is the authentication protocol for the first 

security status indicator wherein the PIN is the credential. Comparison of the fingerprint template on the 

card with a fingerprint acquired from the cardholder is the authentication protocol for the second security 

status indicator wherein the fingerprint is the credential. A security condition using these two security 

status indicators might be (PIN AND fingerprint). 

A security status indicator shall be said to be a global security status indicator if it is not changed when 

the currently selected application changes from one application to another. 

A security status indicator is said to be an application security status indicator if it is set to FALSE when 

the currently selected application changes from one application to another. Every security status indicator 

is either a global security status indicator or an application security status indicator. 

The term global security status refers to the set of all global security status indicators. The term 

application security status refers to the set of all application security status indicators for a specific 

application. 

2.4.3 Authentication of an Individual 

Knowledge of a PIN is the means by which an individual can be authenticated to the PIV Card 

Application. 

Personal identification numbers presented to the card command interface shall be 8 bytes long. If the 

actual PIN length is less than 8 bytes it shall be padded to 8 bytes with 'FF'. The 'FF' padding bytes shall 

be appended to the actual PIN. The bytes comprising the PIN shall not include 'FF'. For example, 

 Page 5 
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

 Page 6 

+ Actual PIN: “123456” or '31 32 33 34 35 36' 

+ Padded PIN presented to the card command interface: '31 32 33 34 35 36 FF FF' 

Note that the FIPS 201 PIN requirements only apply to the PIV Application PIN. However, the above 

length and padding requirement for the PIV card edge interface applies to both the PIV application PIN 

and Global PIN (if implemented). 

2.5 Current State of the PIV Card Application 

The elements of the current state of the PIV Card Application when the PIV Card Application is the 

currently selected application are described in Table 1. 

Table 1. State of the PIV Card Application 

State 

Name 

Always 

Defined Comment 

Location of 

State 

Global 

security status Yes Contains security status indicators that span all card applications on the platform. PIV Platform 

Currently 

selected 

application 

Yes 

The platform shall support the selection of 

a card application using the full application 

identifier or by providing the righttruncated version and there shall always 

be a currently selected application. 

PIV Platform 

Application 

security status Yes Contains security status indicators local to the PIV Card Application. 

PIV Card 

Application 
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

3. End-Point PIV Card Application Card Command Interface 

Table 2 lists the card commands surfaced by the PIV Card Application at the card edge of the ICC when it 

is the currently selected card application. All PIV Card Application card commands shall be supported by 

a PIV Card Application. Card commands indicated with a 'Yes' in the Command Chaining column shall 

support command chaining for transmitting a data string too long for a single command as defined in 

ISO/IEC 7816-4 [3]. 

Table 2. PIV Card Application Card Commands 

Type Name Contact 

Interface 

Contactless 

Interface 

Security Condition 

for Use 

Command 

Chaining 

PIV Card SELECT Yes Yes Always No 

Application Card 

Commands for 

Data Access GET DATA Yes Yes Data Dependent. See 

Table 1, Part 1. 

No 

VERIFY Yes No Always No 

CHANGE 

REFERENCE DATA Yes No PIN No 

RESET RETRY 

COUNTER Yes No PIN Unblocking Key No 

PIV Card 

Application Card 

Commands for 

Authentication 

GENERAL 

AUTHENTICATE Yes Yes (See 

Note) 

Key Dependent. See 

Table 3, Part 1. 

Yes 

PUT DATA Yes No PIV Card Application 

Administrator 

PIV Card Yes 

Application Card 

Commands for 

Credential 

Initialization and 

Administration 

GENERATE 

ASYMMETRIC KEY 

PAIR 

Yes No PIV Card Application 

Administrator 

Yes 

The PIV Card Application shall return the status word of '6A81' (Function not supported) when it receives 

a card command on the contactless interface marked “No” in the Contactless Interface column in Table 2. 

Note: Cryptographic protocols using private/secret keys requiring ”PIN" security condition shall not be 

used on the contactless interface. 

3.1 PIV Card Application Card Commands for Data Access 

3.1.1 SELECT Card Command 

The SELECT card command sets the currently selected application. The PIV Card Application shall be 

selected by providing its application identifier (see Part 1, Section 2.2), in the data field of the SELECT 

command. 

 Page 7 
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

There shall be at most one PIV Card Application on any ICC. The PIV Card Application can also be 

made the currently selected application by providing the right-truncated version (see Part 1, Section 2.2); 

that is, without the two-byte version number in the data field of the SELECT command. 

The complete AID, including the two-byte version, of the PIV Card Application that became the currently 

selected card application upon successful execution of the SELECT command (using the full or righttruncated PIV AID) shall be returned in the application property template. 

If the currently selected application is the PIV Card Application when the SELECT command is given 

and the AID in the data field of the SELECT command is either the AID of the PIV Card Application or 

the right-truncated version thereof, then the PIV Card Application shall continue to be the currently 

selected card application and the setting of all security status indicators in the PIV Card Application shall 

be unchanged. 

If the currently selected application is the PIV Card Application when the SELECT command is given 

and the AID in the data field of the SELECT command is not the PIV Card Application (nor the righttruncated version thereof), but a valid AID supported by the ICC, then the PIV Card Application shall be 

deselected and all the PIV Card Application security status indicators in the PIV Card Application shall 

be set to FALSE. 

If the currently selected application is the PIV Card Application when the SELECT command is given 

and the AID in the data field of the SELECT command is an invalid AID not supported by the ICC, then 

the PIV Card Application shall remain the current selected card application and all PIV Card Application 

security status indicators shall remain unchanged. 

Command Syntax 

CLA '00' 

INS 'A4' 

P1 '04' 

P2 '00' 

Lc Length of application identifier 

Data Field AID of the PIV Card Application, using the full AID or by providing the 

right-truncated AID (See Section 2.2, Part 1) 

Le Length of application property template 

Response Syntax 

Data Field Application property template (APT). See Table 3 below 

SW1-SW2 Status word 

Upon selection, the PIV Card Application shall return the application property template described in 

Table 3. 

 Page 8 
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

Table 3. Data Objects in the PIV Card Application Property Template (Tag '61') 

Description Tag M/O Comment 

Application identifier of application '4F' M 

The PIX of the AID includes the encoding of 

the version of the PIV Card Application. See 

Section 2.2, Part 1. 

Coexistent tag allocation authority '79' M Coexistent tag allocation authority template. 

See Table 4. 

Application label ' ‘50' O Text describing the application; e.g. for use 

on a man-machine interface. 

Uniform resource locator '5F50' O Reference to the specification describing the 

application. 

Table 4. Data Objects in a Coexistent Tag Allocation Authority Template (Tag '79') 

Description Tag M/O Comment 

Application identifier '4F' M See Section 2.2, Part 1 

SW1 SW2 Meaning 

'6A' '82' Application not found 

'90' '00' Successful execution 

3.1.2 GET DATA Card Command 

The GET DATA card command retrieves the data content of the single data object whose tag is given in 

the data field. 

Command Syntax 

CLA '00' 

INS 'CB' 

P1 '3F' 

P2 'FF' 

Lc Length of data field*

Data Field See Table 5 

Le Number of data content bytes to be retrieved. 

* The Lc value is '05' for all PIV data objects except for the 0x7E interindustry tag (Discovery Object), 

and the Application Property Template (APT), which have a Lc value of '03'. 

 Page 9 
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

Table 5. Data Objects in the Data Field of the GET DATA Card Command 

Name Tag M/O Comment 

Tag list '5C' M 

BER-TLV tag of the data 

object to be retrieved. See 

Table 2, Part 1. 

Response Syntax 

For the (optional) 0x7E Discovery Object (if present): 

Data Field 

BER-TLV of the 0x7E Discovery data object (see Section 3.2.6, Part 

1 for an example of the Discovery Object’s structure returned in the 

data field). 

SW1-SW2 Status word 

For all other PIV data objects: 

Data Field BER-TLV with the tag '53' containing in the value field of the 

requested data object. 

SW1-SW2 Status word 

SW1 SW2 Meaning 

'61' 'xx' Successful execution where SW2 encodes the number of response 

data bytes still available 

'69' '82' Security status not satisfied 

'6A' '82' Data object not found 

'90' '00' Successful execution 

3.2 PIV Card Application Card Commands for Authentication 

3.2.1 VERIFY Card Command 

The VERIFY card command initiates the comparison in the card of the reference data indicated by the 

key reference with authentication data in the data field of the command. 

Key reference '80' specific to the PIV Card Application (i.e., local key references) and, optionally, the 

Global PIN with key reference '00' are the only key references that may be verified by the PIV Card 

Application’s VERIFY command. 

Key reference '80' shall be verified by the PIV Card Application VERIFY command. 

If the PIV Card Application contains the Discovery Object as described in Part 1, and the first byte of the 

PIN Usage Policy value is 0x60, then key reference '00' shall be verified by the PIV Card Application 

VERIFY command. 

 Page 10 
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

If the current value of the retry counter associated with the key reference is zero, then the comparison 

shall not be made, and the PIV Card Application shall return the status word '69 83'. 

If the authentication data in the command data field does not satisfy the criteria in Section 2.4.3, then the 

card command shall fail, and the PIV Card Application shall return the status word '6A 80'. 

If the authentication data in the command data field does not match reference data associated with the key 

reference then the card command shall fail. 

If the card command fails, then the security status of the key reference shall be set to FALSE and the retry 

counter associated with the key reference shall be decremented by one. 

If the card command succeeds, then the security status of the key reference shall be set to TRUE and the 

retry counter associated with the key reference shall be set to the reset retry value associated with the key 

reference. 

The initial value of the retry counter and the reset retry value associated with the key reference; i.e. the 

number of successive failures (retries) before the retry counter associated with the key reference reaches 

zero, are issuer dependent. 

Command Syntax 

CLA '00' 

INS '20' 

P1 '00' 

P2 Key reference. See Part 1, Table 3. 

Lc '00'3

 or '08' 

Data Field Absent4

 or PIN reference data as described in Section 2.4.3 

Le Empty 

Response Syntax 

SW1 SW2 Meaning 

'63' 'CX' Verification failed, X indicates the number of further allowed retries 

'69' '83' Authentication method blocked 

'6A' '80' Incorrect parameter in command data field 

'6A' '88' Key reference not found 

'90' '00' Successful execution 

 

3.2.2 CHANGE REFERENCE DATA Card Command 

The CHANGE REFERENCE DATA card command initiates the comparison of the verification data with 

the current value of the reference data and if this comparison is successful, replaces the reference data 

with new reference data. 

 

3

 If Lc=0x00 and the command data field is empty, the command can be used to retrieve the number of further retries allowed ('63 

CX'), or to check whether verification is not needed ('90 00'). 

 Page 11 
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

Only reference data associated with key reference '80' and '81' specific to the PIV Card Application (i.e. 

local key reference) and optionally the Global PIN with key reference '00' may be changed by the PIV 

Card Application CHANGE REFERENCE DATA command. 

Key reference '80' reference data shall be changed by the PIV Card Application CHANGE REFERENCE 

DATA command. 

If the current value of the retry counter associated with the key reference is zero, then the reference data 

associated with the key reference shall not be changed and the PIV Card Application shall return the 

status word '69 83'. 

If the card command succeeds, then the security status of the key reference shall be set to TRUE and the 

retry counter associated with the key reference shall be set to the reset retry value associated with the key 

reference. 

If the card command fails, then the security status of the key reference shall be set to FALSE and the retry 

counter associated with the key reference shall be decremented by one. 

The initial value of the retry counter and the reset retry value associated with the key reference; i.e., the 

number of successive failures (retries) before the retry counter associated with the key reference reaches 

zero, is issuer dependent. 

If either the current reference data or the new reference data in the command field of the command does 

not satisfy the criteria in Section 2.4.3, the PIV Card Application shall not change the reference data 

associated with the key reference and shall return the status word '6A 80'. 

Command Syntax 

CLA '00' 

INS '24' 

P1 '00' 

P2 Key reference. See Part 1, Table 3 

Lc '10' 

Data Field Current PIN reference data concatenated without delimitation with the 

new PIN reference data, both PINs as described in Section 2.4.3 

Le Empty 

Response Syntax 

SW1 SW2 Meaning 

'63' 'CX' Reference data change failed, X indicates the number of further 

allowed retries or resets 

'69' '83' Reference data change operation blocked 

'6A' '80' Incorrect parameter in command data field 

'6A' '88' Key reference not found 

'90' '00' Successful execution 

 Page 12 
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

3.2.3 RESET RETRY COUNTER Card Command 

The RESET RETRY COUNTER card command resets the retry counter of the key reference to its initial 

value and changes the reference data associated with the key reference. The command enables recovery of 

the PIV card application PIN in the case that the cardholder has forgotten a PIV Card Application PIN. 

Only retry counters associated with key references specific to the PIV Card Application; i.e. local key 

references may be reset by the PIV Card Application RESET RETRY COUNTER command. 

If the current value of the reset counter associated with the key reference is zero, then retry counter 

associated with the key reference shall not be reset and the PIV Card Application shall the status word '69 

83'. 

If the card command succeeds, then the retry counter associated with the key reference shall be set to the 

reset retry value associated with the key reference. The security status of the key reference shall not be 

changed. 

If the card command fails, then the security status of the key reference shall be set to FALSE and the reset 

counter associated with the key reference shall be decremented by one. 

The initial reset counter associated with the key reference; i.e. the number of failures of the RESET 

RETRY COUNTER command before the reset counter associated with the key reference reaches zero, is 

issuer dependent. 

If either the reset retry counter reference data (PUK) or the new reference data (PIN) in the command 

field of the command does not satisfy the criteria in Section 2.4.3, the PIV Card Application shall not 

reset the retry counter associated with the key reference and shall return the status word '6A 80'. 

Command Syntax 

CLA '00' 

INS '2C' 

P1 '00' 

P2 Key reference. See Part 1, Table 3 

Lc '10' 

Data Field 

Reset retry counter reference data (PUK) concatenated without 

delimitation with the new reference data (PIN), both PUK and PIN as 

described in 2.4.3 

Le Empty 

Response Syntax 

SW1 SW2 Meaning 

'63' 'CX' Reset failed, X indicates the number of further allowed resets 

'69' '83' Reset operation blocked 

'6A' '80' Incorrect parameter in command data field 

'6A' '88' Key reference not found 

'90' '00' Successful execution 

 Page 13 
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

 

3.2.4 GENERAL AUTHENTICATE Card Command 

The GENERAL AUTHENTICATE card command performs a cryptographic operation such as an 

authentication protocol using the data provided in the data field of the command and returns the result of 

the cryptographic operation in the response data field. 

The GENERAL AUTHENTICATE command shall be used to authenticate the card or a card application 

to the client-application (INTERNAL AUTHENTICATE), to authenticate an entity to the card 

(EXTERNAL AUTHENTICATE), and to perform a mutual authentication between the card and an entity 

external to the card (MUTUAL AUTHENTICATE). 

The GENERAL AUTHENTICATE command shall be used to realize the signing functionality on the 

PIV client-application programming interface. Data sent to the card is expected to be hashed off-card. 

The GENERAL AUTHENTICATE command supports command chaining to permit the uninterrupted 

transmission of long command data fields to the PIV Card Application. If a card command other than the 

GENERAL AUTHENTICATICATE command is received by the PIV Card Application before the 

termination of a GENERAL AUTHENTICATE chain, the PIV Card Application shall rollback to the 

state it was in immediately prior to the reception of the first command in the interrupted chain. In other 

words, an interrupted GENERAL AUTHENTICATE chain has no effect on the PIV Card Application. 

Command Syntax 

CLA '00' or '10' indicating command chaining. 

INS '87' 

P1 Algorithm reference. See Table 6-2, SP 800-78 [7]. 

P2 Key reference. See Table 6-1, SP 800-78. 

Lc Length of data field 

Data Field See Table 6. 

Le Absent or length of expected response 

Table 6. Data Objects in the Dynamic Authentication Template (Tag '7C') 

Name Tag M/O Description 

Witness '80' C Demonstration of knowledge of a fact without revealing 

the fact. An empty witness is a request for a witness. 

Challenge '81' C One or more random numbers or byte sequences to be 

used in the authentication protocol. 

Response '82' C A sequence of bytes encoding a response step in an 

authentication protocol. 

The data objects that appear in the dynamic authentication template (tag '7C') in the data field of the 

GENERAL AUTHENTICATE card command depend on the authentication protocol being executed. 

The Witness (80) contains encrypted data (unrevealed fact). This data is decrypted by the card. The 

Challenge (81) contains clear data (byte sequence) which is encrypted by the card. The Response (tag 

'82') contains either the decrypted data from tag '80' or the encrypted data from tag '81'. Note that the 

 Page 14 
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

empty tags (i.e., tags with no data) return the same tag with content (they can be seen as “requests for 

requests”): 

+ '80 00' Returns '80 TL <encrypted random>' (as per definition) 

+ '81 00' Returns '81 TL <random>' (as per external auth example) 

Response Syntax 

Data Field Absent or authentication-related data 

SW1-SW2 Status word 

SW1 SW2 Meaning 

'61' 'xx' Successful execution where SW2 encodes the number of response 

data bytes still available 

'69' '82' Security status not satisfied 

'6A' '80' Incorrect parameter in command data field 

'6A' '86' Incorrect parameter in P1 or P2 

'90' '00' Successful execution 

3.3 PIV Card Application Card Commands for Credential Initialization and 

Administration 

3.3.1 PUT DATA Card Command 

The PUT DATA card command completely replaces the data content of a single data object in the PIV 

Card Application with new content. 

Command Syntax 

CLA '00' or '10' indicating command chaining 

INS 'DB' 

P1 '3F' 

P2 'FF' 

Lc Length of data field 

Data Field See Table 7 

Le Empty 

 Page 15 
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

Table 7. Data Objects in the Data Field of the PUT DATA Card Command for the Discovery Object 

For the 0x7E Discovery Object (if present): 

Tag M/O Description 

'7E' M BER-TLV of tag '7E' as illustrated in Section 3.2.6, 

Part 1 

 

 

Table 8. Data Objects in the Data Field of the PUT DATA Card Command for all other PIV Data Objects 

For all other PIV Data objects: 

Name Tag M/O Description 

Tag list '5C' M Tag of the data object whose data content is 

to be replaced. See Table 2, Part 1. 

Data '53' M Data with tag '53' as an unstructured byte 

sequence. 

Response Syntax 

Data Field Absent 

SW1-SW2 Status word 

SW1 SW2 Meaning 

'69' '82' Security status not satisfied 

'6A' '84' Not enough memory 

'90' '00' Successful execution 

 

3.3.2 GENERATE ASYMMETRIC KEY PAIR Card Command 

The GENERATE ASYMMETRIC KEY PAIR card command initiates the generation and storing in the 

card of the reference data of an asymmetric key pair, i.e., a public key and a private key. The public key 

of the generated key pair is returned as the response to the command. If there is reference data currently 

associated with the key reference, it is replaced in full by the generated data. 

Command Syntax 

CLA '00' or '10' indicating command chaining. 

INS '47' 

P1 '00' 

P2 See SP 800-78 Table 6-1 for a list of the PIV Key References 

 Page 16 
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

 Page 17 

Lc Length of data field 

Data Field Control reference template. See Table 9 

Le Length of public key of data object template 

Table 9. Data Objects in the Template (Tag 'AC') 

Name Tag M/O Description 

Cryptographic mechanism identifier '80' M See Part 1, Table 4 

Parameter '81' C Specific to the cryptographic 

mechanism 

Response Syntax 

Data Field Data objects of public key of generated key pair. See Table 10 

SW1-SW2 Status word 

Table 10. Data Objects in the Template (Tag '7F49') 

Name Tag 

Public key data objects for RSA 

Modulus '81' 

Public exponent '82' 

Public key data objects for ECDSA 

Point '86' 

SW1 SW2 Meaning 

'61' 'xx' Successful execution where SW2 encodes the number of response 

data bytes still available 

'69' '82' Security status not satisfied 

'6A' '80' Incorrect parameter in command data field; e.g. unrecognized 

cryptographic mechanism 

'6A' '86' 

Incorrect parameter P2; cryptographic mechanism of reference data 

to be generated different than cryptographic mechanism of reference 

data of given key reference 

'90' '00' Successful execution 
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

Appendix A—Examples of the Use of GENERAL AUTHENTICATE 

A.1 Authentication of the PIV Card Application Administrator 

The PIV Card Application Administrator is authenticated by the PIV Card Application using a 

challenge/response protocol. A challenge retrieved from the PIV Card Application is encrypted by the 

client-application and returned to the PIV Card Application associated with key reference '9B', the key 

reference to the Card Management Key4

. The PIV Card Application decrypts the response using this 

reference data and the algorithm associated with the key reference; that is 3 Key Triple DES – ECB 

(algorithm identifier '00'). If this decrypted value matches the previously provided challenge, then the 

security status indicator of the PIV Card Application Administrator is set to TRUE within the PIV Card 

Application. 

Table 11 shows the GENERAL AUTHENTICATE card commands sent to the PIV Card Application to 

realize this particular challenge/response protocol. 

Table 11. Authentication of PIV Card Application Administrator 

Command Response Comment 

'00 87 00 00 04 7C 02 81 

00' 

Client-application requests a 

challenge from the PIV Card 

Application 

'7C 0A 81 08 01 02 03 04 

05 06 07 08' 

Challenge returned to clientapplication by the PIV Card 

Application 

'00 87 00 9B 0C 7C 0A 82 

08 88 77 66 55 44 33 22 11' 

Client-application returns the 

encryption of the challenge ('88 

77 66 55 44 33 22 11') 

referencing algorithm '00' and 

key reference '9B'. See Tables 

6.1 and 6.2 of SP 800-78. 

'9000' PIV Card Application indicates 

successful authentication of PIV 

Card Application Administrator 

after decrypting '88 77 66 55 44 

33 22 11' using the referenced 

algorithm and key and getting '01 

02 03 04 05 06 07 08' 

A.2 Validation of the PIV Card Application 

The PIV Card Application is validated by first retrieving the X.509 Certificate of the PIV Authentication 

Key (OID 2.16.840.1.101.3.7.2.1.1) and verifying the signature on this certificate. Assuming the 

certificate is valid and current, the client-application requests the PIV Card Application to encrypt a 

challenge using the private key associated with this certificate; i.e., key reference '9A', algorithm 

 

4

 The Card Management key is the PIV Card Application Administration Key used for managing the PIV card application. 

 Page 18 
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

identifier '06'. The response is decrypted using the public key in the certificate. If the decrypted response 

matches the challenge, then the PIV Card Application is validated. 

Table 12 shows the GENERAL AUTHENTICATE card commands sent to the PIV Card Application to 

realize the validation of the PIV Card Application. 

Table 12. Validation of the PIV Card Application Using GENERAL AUTHENTICATE 

Command Response Comment 

'00 87 06 9A 0E 7C 0C 82 00 81 

08 01 02 03 04 05 06 07 08' 

Client-application sends a 

challenge to the PIV Card 

Application indicating the 

reference data associated with 

key reference '9A' is to be used 

with algorithm '06'. See Tables 

6.1 and 6.2 in SP 800-78. 

'7C 0A 82 08 88 77 66 55 44 33 

22 11' 

PIV Card Application returns the 

encryption of the challenge ('88 

77 66 55 44 33 22 11') using the 

indicated key reference data and 

algorithm. 

The same use of GENERAL AUTHENTICATE can be used to achieve a signing of a byte sequence such 

as a hash by the PIV Card Application. One needs only to indicate which algorithm and which key are to 

be used by setting the values of the P1 and the P2 parameters respectively. 

Note: For exposition purposes, this example uses only an 8-byte challenge and response with a 1024-bit 

RSA key. In actual usage, a challenge and response more appropriate for this cryptographic algorithm 

would be used. 

 Page 19 
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

Appendix B—Terms, Acronyms, and Notation 

B.1 Terms 

Application Identifier A globally unique identifier of a card application as defined in ISO/IEC 7816-4. 

Algorithm Identifier A PIV algorithm identifier is a one-byte identifier that specifies a cryptographic 

algorithm and key size. For symmetric cryptographic operations, the algorithm 

identifier also specifies a mode of operation (i.e., CBC or ECB). 

Authenticatable Entity An entity that can successfully participate in an authentication protocol with a 

card application. 

BER-TLV Data Object A data object coded according to ISO/IEC 8825-2.

Card An integrated circuit card. 

Card Application A set of data objects and card commands that can be selected using an 

application identifier. 

Client Application A computer program running on a computer in communication with a card 

interface device. 

Data Object An item of information seen at the card command interface for which are 

specified a name, a description of logical content, a format and a coding. 

Key Reference A PIV key reference is a one-byte identifier that specifies a cryptographic key 

according to its PIV Key Type. The identifier is part of cryptographic material 

used in a cryptographic protocol such as an authentication or a signing protocol. 

Object Identifier A globally unique identifier of a data object as defined in ISO/IEC 8824-2. 

Reference Data Cryptographic material used in the performance a cryptographic protocol such as 

an authentication or a signing protocol. The reference data length is the 

maximum length of a password or PIN. For algorithms, the reference data length 

is the length of a key. 

Status Word Two bytes returned by an integrated circuit card after processing any command 

that signify the success of or errors encountered during said processing. 

Template A (constructed) BER-TLV data object whose value field contains specific BERTLV data objects. 

 Page 20 
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

B.2 Acronyms 

AID Application Identifier 

APDU Application Protocol Data Unit 

API Application Programming Interface 

ASN.1 Abstract Syntax Notation 

BER Basic Encoding Rules 

CLA Class (first) byte of a card command 

DES Data Encryption Standard 

DNS Domain Name Server 

ECDSA Elliptic Curve Digital Signature Algorithm 

FIPS Federal Information Processing Standards 

FISMA Federal Information Security Management Act 

GSC-IAB Government Smart Card Interagency Advisory Board 

GSC-IS Government Smart Card Interoperability Specification 

HSPD Homeland Security Presidential Directive 

ICC Integrated Circuit Card 

IEC International Electrotechnical Commission 

IETF Internet Engineering Task Force 

INS Instruction (second) byte of a card command 

INCITS InterNational Committee for Information Technology Standards 

ISO International Standards Organization 

ITL Information Technology Laboratory 

LSB Least Significant Bit 

MSB Most Significant Bit 

NIST National Institute of Standards and Technology 

OID Object Identifier 

 Page 21 
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

OMB Office of Management and Budget 

P1 First parameter of a card command 

P2 Second parameter of a card command 

PIN Personal Identification Number 

PIV Personal Identity Verification 

PIX Proprietary Identifier extension 

PUK PIN Unblocking Key 

RFU Reserved for Future Use 

RID Registered application provider Identifier 

RFU Reserved for Future Use 

RSA Rivest, Shamir, Adleman 

SP Special Publication 

SW1 First byte of a two-byte status word 

SW2 Second byte of a two-byte status word 

TLV Tag-Length-Value 

B.3 Notation 

The sixteen hexadecimal digits shall be denoted using the alphanumeric characters 0, 1, 2..., A, B, C, D, 

E, and F. A byte consists of two hexadecimal digits, for example, '2D'. A sequence of bytes may be 

enclosed in single quotation marks, for example 'A0 00 00 01 16' rather than given as a sequence of 

individual bytes, 'A0' '00' '00' '01' '16'. 

A byte can also be represented by bits b8 to b1, where b8 is the most significant bit (MSB) and b1 is the 

least significant bit (LSB) of the byte. In textual or graphic representations, the leftmost bit is the MSB. 

Thus, for example, the most significant bit, b8, of '80' is 1 and the least significant bit, b1, is 0. 

All bytes specified as RFU shall be set to '00' and all bits specified as reserved for future use shall be set 

to 0. 

All lengths shall be measured in number of bytes unless otherwise noted. 

Data objects in templates are described as being mandatory (M), optional (O) or conditional (C). 

'Mandatory' means the data object shall appear in the template. 'Optional' means the data object may 

appear in the template. In the case of 'conditional' data objects, the conditions under which they are 

required are provided in a footnote to the table. 

 Page 22 
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

In other tables the M/O column identifies properties of the PIV Card Application that shall be present (M) 

or may be present (O). 

BER-TLV data object tags are represented as byte sequences as described above. Thus, for example, '4F' 

is the interindustry data object tag for an application identifier and '7F 60' is the interindustry data object 

tag for the biometric information template. 

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", 

"SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this standard are to be 

interpreted as described in IETF RFC 2119, Key Words for Use in RFCs to Indicate Requirement Levels 

[6].

 Page 23 
Special Publication 800-73-2 Interfaces for Personal Identity Verification Part 2: 

 End-Point PIV Card Application Card Command Interface

 Page 24 

Appendix C—References 

[1] Federal Information Processing Standard 201-1, Change Notice 1, Personal Identity Verification (PIV) 

of Federal Employees and Contractors, March 2006. (See http://csrc.nist.gov) 

[2] Government Smart Card Interoperability Specification, Version 2.1, NIST Interagency Report 6887 – 

2003 Edition, July 16, 2003. 

[3] ISO/IEC 7816 (Parts 4, 5, 6, 8, and 9), Information technology — Identification cards — Integrated 

circuit(s) cards with contacts. 

[4] ISO/IEC 8825-1:2002, Information technology — ASN.1 encoding rules: Specification of Basic 

Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER). 

[5] ISO/IEC 8824-2:2002, Information technology -- Abstract Syntax Notation One (ASN.1): Information 

object specification. 

[6] IETF RFC 2119, Key Words for Use in RFCs to Indicate Requirement Levels, March, 1997. 

[7] NIST Special Publication 800-78-1, Cryptographic Algorithms and Key Sizes for Personal Identity 

Verification, August 2007. (See http://csrc.nist.gov)