FIPS 201 CIV Profiles (ActivID Applets)

Device Profile Name

Profile Description

Unique Identifier
(stored in the card)

Supported Devices

Supported Pre-Issuance IDs

Comments

CIV – AI 1024-2048 C1100

 

CIV profile for C1100

2011FD000000000000000003

HID Crescendo C1100 (JCOP v2.4.1 R3)

HID_CRESC_C1100_GEN_TEST_OPSC_1
HID_CRESC_C1100_GEN_PROD_OPSC_1

Based on ActivID Applet 2.7.

CIV – AI 1024-2048 C1100 (2)

CIV profile for C1100 with Asynchronous SKI

201100000000000000000146

HID Crescendo C1100 (JCOP v2.4.1 R3)

HID_CRESC_C1100_GEN_TEST_OPSC_1
HID_CRESC_C1100_GEN_PROD_OPSC_1

Based on ActivID Applet 2.7.

CIV – AI 1024-2048 pivCLASS

CIV profile for pivCLASS

2011FD000000000000000006

HID pivCLASS v1.0 (JCOP v2.4.2 R0)

HID_CRESC_JCOP_242_PIV_TEST_OPSC_1_APP271
HID_CRESC_JCOP_242_PIV_PROD_OPSC_1_APP271

Based on ActivID Applet 2.7.1.

CIV – AI 1024-2048 pivCLASS (2)

CIV profile for pivCLASS

20110000000000000000012C

HID pivCLASS v1.0 (JCOP v2.4.2 R0)

HID_CRESC_JCOP_242_PIV_TEST_OPSC_1_APP271
HID_CRESC_JCOP_242_PIV_PROD_OPSC_1_APP271

Based on ActivID Applet 2.7.1.

More flexible card content with addition of client managed certificates.

CIV – AI 2048 Crescendo 144K FIPS

CIV profile, with extended PKI, for Crescendo 144K FIPS

201100000000000000000130

Crescendo 144K FIPS (G&D SCE 7.0 144K) preloaded with ActivID Applet

HID_CRESC_144K_FIPS_DEFAULT
HID_CRESC_144K_FIPS_CUSTOM

Cards with ActivID Applets v2.7.3 packages preloaded (ASClib, ACA, GC/PKI, PIV and SMA V3). Profile based on ActivID Applet 2.7.3.

CIV – AI 2048 Crescendo PIV

CIV profile, with extended PKI, for Crescendo PIV

201100000000000000000136

Crescendo PIV (G&D SCE 7.0 144K) preloaded with ActivID Applet

HID_CRESC_PIV_DEFAULT
HID_CRESC_PIV_CUSTOM

Cards with ActivID Applets v2.7.5 packages preloaded (ASClib, ACA, GC/PKI, PIV and SMA V3). Profile based on ActivID Applet 2.7.5.

Enterprise - Crescendo

Enterprise profile compatible with devices that contain SEOS and FIDO applet

201100000000000000000151

Crescendo C2300 (JCOP 3 SecID P60 CS) preloaded with ActivID Applet 3.0.3

 

Crescendo Key (JCOP 3 SecID P60 CS) preloaded with ActivID Applet 3.0.3

 

Crescendo C2300 iCLASS (JCOP 3 SecID P60 CS) preloaded with ActivID Applet 3.0.3

HID_CRESC_2300_DEFAULT_2

 

HID_CRESC_KEY_DEFAULT_2

 

HID_CRESC_2300_ICLASS_DEFAULT

Devices with ActivID Applets v3.0.3 packages preloaded (SEOS, ASClib, ACA, HMAClib, PIVEXT, OATH and FIDO). Profile based on ActivID Applets 3.0.3.

Enterprise - Crescendo (No FIDO)

Enterprise profile compatible with devices containing SEOS applet

201100000000000000000152

Crescendo C2300 (JCOP 3 SecID P60 CS) preloaded with ActivID Applet 3.0.3

 

Crescendo Key (JCOP 3 SecID P60 CS) preloaded with ActivID Applet 3.0.3

 

Crescendo C2300 iCLASS (JCOP 3 SecID P60 CS) preloaded with ActivID Applet 3.0.3

HID_CRESC_2300_DEFAULT_2

 

HID_CRESC_KEY_DEFAULT_2

 

HID_CRESC_2300_ICLASS_DEFAULT

Devices with ActivID Applets v3.0.3 packages preloaded (SEOS, ASClib, ACA, HMAClib, PIVEXT and OATH). Profile based on ActivID Applets 3.0.3.

Enterprise - Crescendo (No SEOS)

Enterprise profile compatible with devices containing FIDO applet and no SEOS

20110000000000000000014F

Crescendo C2300 (JCOP 3 SecID P60 CS) preloaded with ActivID Applet 3.0.3

 

Crescendo Key (JCOP 3 SecID P60 CS) preloaded with ActivID Applet 3.0.3

 

Crescendo C2300 iCLASS (JCOP 3 SecID P60 CS) preloaded with ActivID Applet 3.0.3

HID_CRESC_2300_DEFAULT_2

HID_CRESC_KEY_DEFAULT_2

HID_CRESC_2300_ICLASS_DEFAULT

 

  • Profile aligned with NIST SP 800-73-3, for Commercial Identity Verification (CIV) cards: similar card edge as PIV for US Government employees, but for the commercial world, without any trust to the US Federal bridge.

  • 6 1024/2048-bit keys PIV PKI Objects (PIV Authentication, PIV Digital Signature, PIV Key Management Key, PIV Card Authentication, 2 Retired Key Management Keys) loaded by ActivID CMS

  • PIV EP Buffer Objects, including Iris, Key History

  • Synchronous SKI Object: Download by the server

  • Offline / Online Unlock done via XAUTH

  • Compatible with Apple Mac TokenD

  • CHUID Card Holder Unique Identifier, Printed Information, PKI AUTHENTICATE objects are mandatory. All other objects are optional.

  • Profile aligned with NIST SP 800-73-3, for Commercial Identity Verification (CIV) cards: similar card edge as PIV for US Government employees, but for the commercial world, without any trust to the US Federal bridge.

  • 6 1024/2048-bit keys PIV PKI Objects (PIV Authentication, PIV Digital Signature, PIV Key Management Key, PIV Card Authentication, 2 Retired Key Management Keys) loaded by ActivID CMS

  • PIV EP Buffer Objects, including Iris, Key History

  • Asynchronous SKI Object: Download by the server

  • Offline / Online Unlock done via XAUTH

  • Compatible with Apple Mac TokenD

  • CHUID, Printed Information, PKI AUTHENTICATE objects are mandatory. All other objects are optional.

  • Profile aligned with NIST SP 800-73-3, for Commercial Identity Verification (CIV) cards: similar card edge as PIV for US Government employees, but for the commercial world, without any trust to the US Federal bridge.

  • 20 1024/2048-bit keys PIV PKI Objects (PIV Authentication, PIV Digital Signature, PIV Key Management Key, PIV Card Authentication, 16 Retired Key Management Keys) loaded by ActivID CMS

  • PIV EP Buffer Objects, including Iris, Key History

  • Synchronous SKI Object: Download by the server

  • Offline / Online Unlock done via XAUTH

  • FIPS 140-2 L2 Compliant Profile

  • Compatible with Apple Mac TokenD

  • CHUID, Printed Information, PKI AUTHENTICATE objects are mandatory. All other objects are optional.

  • Profile aligned with NIST SP 800-73-3, for Commercial Identity Verification (CIV) cards: similar card edge as PIV for US Government employees, but for the commercial world, without any trust to the US Federal bridge.

  • 12 1024/2048-bit keys PIV PKI Objects (PIV Authentication, PIV Digital Signature, PIV Key Management Key, PIV Card Authentication, 8 Retired Key Management Keys) loaded by ActivID CMS.

  • 4 1024/2048-bit keys PKI Objects loaded by ActivID CMS – additional certificates for flexible usage (authentication, digital signature or encryption).

  • 4 1024/2048-bit keys PKI Objects loaded by end user (PIN protected) – additional certificates for flexible usage (authentication, digital signature or encryption).

  • PIV EP Buffer Objects, except Iris.

  • Synchronous SKI Object: Download by the server

  • Offline / Online Unlock done by XAUTH

  • Profile is not FIPS 140 compliant due to the 4 PIN-protected PKI

  • Compatible with Apple Mac TokenD

  • CHUID, Printed Information, PKI AUTHENTICATE objects are mandatory. All other objects are optional.

  • Profile aligned with NIST SP 800-73-3, for Commercial Identity Verification (CIV) cards: similar card edge as PIV for US Government employees, but for the commercial world, without any trust to the US Federal bridge.

  • 4 2048-bit keys PIV PKI Objects (PIV Authentication, PIV Digital Signature, PIV Key Management Key, PIV Card Authentication, 5 Retired Key Management Keys) loaded by ActivID CMS

  • 7 2048-bit keys PKI Objects loaded by ActivID CMS

  • PIV EP Buffer Objects, except Iris

  • PIV AUTHENTICATION, CHUID and Printed Information objects are mandatory. All other objects are optional.

  • In addition to the card pre-issuance keys, the following keys must be present in the HSM A Hardware Security Module (HSM) securely stores secret key material. They are similar to large-storage, multisession smart cards. However, unlike smart cards, they are used mainly on the server side of a system. for profile issuance. As these keys are post-issuance keys, they should be generated in the HSM:

    • MK_CM_ACE_AES_16_OPSC_1_ENC, _MAC, _KEK (16-byte AES keys)

    • MK_ID_ACE_UNLCK_1_TRIPLE (24-byte DES keys)

Note: This device profile does not provide One-Time Password capability compatible with current versions of HID authentication servers. Do not use an SKI application in your device policy. Contact HID Global for additional information.

  • Profile aligned with NIST SP 800-73-3, for Commercial Identity Verification (CIV) cards: similar card edge as PIV for US Government employees, but for the commercial world, without any trust to the US Federal bridge.

  • 9 2048-bit keys PIV PKI Objects (PIV Authentication, PIV Digital Signature, PIV Key Management Key, PIV Card Authentication, 5 Retired Key Management Keys) loaded by ActivID CMS

  • 7 2048-bit keys PKI Objects loaded by ActivID CMS

  • PIV EP Buffer Objects, except Iris

  • PIV AUTHENTICATION, CHUID and Printed Information objects are mandatory. All other objects are optional.

  • PIN Numeric Only

  • In addition to the card pre-issuance keys, the following keys must be present in the HSM for profile issuance. As these keys are post-issuance keys, they should be generated in the HSM:

    • MK_CM_ACE_AES_16_OPSC_1_ENC, _MAC, _KEK (16-byte AES keys)

    • MK_ID_ACE_UNLCK_1_TRIPLE (24-byte DES keys)

  • 4 2048-bit keys PIV PKI Objects (PIV Authentication, PIV Digital Signature PIN Once, PIV Encryption, 1 Retired Key Management Keys) loaded by ActivID CMS.

  • PIV EP Buffer Objects: Discovery Object, CHUID, CCC, Printed Information, Key History Object

  • FIDO Applet (CTAP2 / U2F support) (*)

  • PIN can be shared between PIV and FIDO applet.

  • Minimum PIN length: 4 / Maximum PIN Length: 25

    Note: If the Maximum PIN Length is set to a value greater than 8, then the card will not be usable with the Microsoft PIV Minidriver, whatever the PIN-shared configuration, nor with FIDO when the PIN is shared between PIV and FIDO. To manage PINs with more than 8 characters, this profile requires ActivClient 7.4.1 (or higher) and HID Crescendo 2300 Mini Driver 1.2 (or higher).

  • PIN can be configured to be Alphanumeric or Numeric Only.

    Note: If the Maximum PIN Length is set to a value greater than 8, then the PIN cannot be configured as Numeric Only.

  • Contactless firewall can be enabled / disabled in the policy (when disabled, the PIV / OATH operations can be done with a contactless reader).

    Note: For Crescendo C2300 iCLASS CL cards, the contactless firewall must be disabled.

  • OATH HOTP, TOTP and OCRA support

  • In addition to the card pre-issuance keys, the following keys must be present in the HSM for profile issuance. As these keys are post-issuance keys, they should be generated in the HSM:

    • MK_CM_ACE_AES_16_OPSC_1_ENC, _MAC, _KEK, PIV_CARD_ADMINISTRATOR_KEY_9B_AES_16 (16-byte AES keys)

(*) During a recycle operation (that is, card re-issuance), the FIDO credentials are reset.

  • 7 2048-bit keys PIV PKI Objects (PIV Authentication, PIV Digital Signature PIN Once, PIV Encryption, 4 Retired Key Management Keys) loaded by ActivID CMS.

  • PIV EP Buffer Objects: Discovery Object, CHUID, CCC, Printed Information, Key History Object

  • Minimum PIN length: 4 / Maximum PIN Length: 25

    Note: If the Maximum PIN Length is set to a value greater than 8, then the card will not be usable with the Microsoft PIV Minidriver. To manage PINs with more than 8 characters, this profile requires ActivClient 7.4.1 (or higher) and HID Crescendo 2300 Mini Driver 1.2 (or higher).

  • PIN can be configured to be Alphanumeric or Numeric Only.

    Note: If the Maximum PIN Length is set to a value greater than 8, then the PIN cannot be configured as Numeric Only.

  • Contactless firewall can be enabled / disabled in the policy (when disabled, the PIV / OATH operations can be done with a contactless reader).

  • OATH HOTP, TOTP and OCRA support

  • In addition to the card pre-issuance keys, the following keys must be present in the HSM for profile issuance. As these keys are post-issuance keys, they should be generated in the HSM:

    • MK_CM_ACE_AES_16_OPSC_1_ENC, _MAC, _KEK, PIV_CARD_ADMINISTRATOR_KEY_9B_AES_16 (16-byte AES keys)

Note: Devices issued with this profile that are recycled cannot be issued with the other Enterprise - Crescendo profiles.

  • This profile is compatible with the HID Crescendo C2300 Mini Driver v1.2.

  • 10 2048-bit keys PIV PKI Objects (PIV Authentication, PIV Digital Signature PIN Once, PIV Encryption, 7 Retired Key Management Keys) loaded by ActivID CMS.

  • PIV EP Buffer Objects: Discovery Object, CHUID, CCC, Printed Information, Key History Object.

  • FIDO Applet (CTAP2 / U2F support) (*)

  • PIN can be shared between PIV and FIDO applet.

  • Minimum PIN length: 4 / Maximum PIN Length: 25

    Note: If the Maximum PIN Length is set to a value greater than 8, then the card will not be usable with the Microsoft PIV Minidriver, whatever the PIN-shared configuration, nor with FIDO when the PIN is shared between PIV and FIDO. To manage PINs with more than 8 characters, this profile requires ActivClient 7.4.1 (or higher) and HID Crescendo 2300 Mini Driver 1.2 (or higher).

  • PIN can be configured to be Alphanumeric or Numeric Only.

    Note: If the Maximum PIN Length is set to a value greater than 8, then the PIN cannot be configured as Numeric Only.

  • Contactless firewall can be enabled / disabled in the policy (when disabled, the PIV / OATH operations can be done with a contactless reader).

  • OATH HOTP, TOTP and OCRA support

  • In addition to the card pre-issuance keys, the following keys must be present in the HSM for profile issuance. As these keys are post-issuance keys, they should be generated in the HSM:

    • MK_CM_ACE_AES_16_OPSC_1_ENC, _MAC, _KEK, PIV_CARD_ADMINISTRATOR_KEY_9B_AES_16 (16-byte AES keys)

(*) During a recycle operation (that is, card re-issuance), the FIDO credentials are reset.