FIPS 201 CIV Profiles (Third-Party Applets)

Note: These profiles are deprecated and can no longer be used to create new device policies. They are included for legacy purposes.

Device Profile Name

Profile Description

Unique Identifier
(stored in the card)

Supported Devices

Supported Pre-Issuance IDs

Comments

CIV - IDEMIA ID-One PIV 2.4.1 - 2048

CIV Profile with IDEMIA End-Point applets v2.4.10

N/A

IDEMIA ID-One PIV 2.4.1 on Cosmo v8.1

5_IDEMIA_PIV_241_TEST_OPSC_1
5_IDEMIA_PIV_241_PROD_OPSC_1
100_IDEMIA_PIV_241_PROD_OPSC_1

Deprecated: Cannot be used to create a new device policy but existing profile policies are still supported.
Replaced by PIV / CIV FIPS201 F2F Java Card - IDEMIA ID-One PIV 2.4.X - 2048 profile.

 

Card with IDEMIA PIV applet v2.4.1
Note: This profile is deprecated and can no longer be used to create new device policies. It is included for legacy purposes.

  • Profile aligned with NIST SP 800-73-4, for Commercial Identity Verification (CIV) cards: similar card edge as PIV for US Government employees, but for the commercial world, without any trust to the US Federal bridge.

  • The profile supports SP 800-73-4 objects, including PIV Discovery, Iris, Key History and Key Management Key objects. It can accommodate 2048-bit PKI keys and the full set of PIV objects is loaded by ActivID CMS (PIV mandatory and optional objects).

  • CHUID, Printed Information, PKI AUTHENTICATE objects are mandatory. All other objects are optional.

  • Compatible with Apple Mac TokenD

  • The profile is only for IDEMIA PIV cards with PIV applet v2.4.1.

  • PIN Numeric Only

  • In addition to the card pre-issuance keys, the following keys must be present in the HSM for profile issuance. As these keys are post-issuance keys, they should be generated in the HSM:

    • For the pre-issuance Card AES 128: MK_CM_ACE_AES_16_OPSC_1_ENC, _MAC, _KEK, PIV_CARD_ADMINISTRATOR_KEY_9B_AES_16 (16-byte AES keys)

    • For the pre-issuance Card AES 256: MK_CM_ACE_AES_32_OPSC_1_ENC, _MAC, _KEK, PIV_CARD_ADMINISTRATOR_KEY_9B_AES_32 (32-byte AES keys)