FIPS 201 PIV Profiles (Third-Party Applets, Face to Face)
These profiles are deprecated and can no longer be used to create new device policies. They are included for legacy purposes.
-
For Gemalto PIV profile (that is, the card with Gemalto PIV applet v1.20), it is necessary to obtain a Gemalto PIV card with configuration “USG 010”.
-
For Oberthur PIV profile, ActivID CMS 4.0 SP2 expects Cosmo card with BAP# 81758.
-
For Oberthur PIV profiles with Oberthur PIV applet 2.3.2, use BAP #087282.
-
For Oberthur PIV profiles with Oberthur PIV applet 2.3.5, use BAP #087420 / #087424 / #087465.
-
For Oberthur PIV profiles with Oberthur PIV applet 2.4.0, use BAP #087434.
-
For IDEMIA PIV profiles with IDEMIA PIV applet 2.4.1, use BAP #087484.
-
For IDEMIA PIV profiles with IDEMIA PIV applet 2.4.2, use BAP #087584.
PIV FIPS201 F2F Java Card – Gemalto
PIV2 Profile with Gemalto SafesITe applets v1.20
This profile is deprecated and can no longer be used to create new device policies. It is included for legacy purposes.
-
Can accommodate 1024 and 2048-bit PKI keys and the full set of PIV objects is loaded by ActivID CMS (PIV mandatory and optional objects).
-
Only for Gemalto PIV cards.
|
Supported Devices |
Supported Pre-Issuance IDs |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
 5_GEM_PIV_TEST_OPSC_1
5_GEM_PIV_PROD_OPSC_1
100_GEM_PIV_PROD_OPSC_1
5_GEM_PIV_SDK_OPSC_1
|
PIV FIPS201 F2F Java Card – Gemalto 1.55 – 2048
PIV2 Profile with Gemalto applets V1.55 (SP 800-73-3)
This profile is deprecated and can no longer be used to create new device policies. It is included for legacy purposes.
-
Supports SP 800-73-3 objects, including PIV Discovery, Iris, Key History and Key Management Key objects. It can accommodate 2048-bit keys and the full set of PIV objects is loaded by ActivID CMS (PIV mandatory and optional objects).
-
Only for Gemalto PIV cards with PIV applet v1.55.
|
Supported Devices |
Supported Pre-Issuance IDs |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Gemalto TOP DL GX4 FIPS v1 |
5_GEM_PIV_1_55_TEST_OPSC_1
5_GEM_PIV_1_55_PROD_OPSC_1
100_GEM_PIV_1_55_PROD_OPSC_1
|
PIV FIPS201 F2F Java Card – OCS
PIV2 Profile with OCS End-Point applets v1.08
This profile is deprecated and can no longer be used to create new device policies. It is included for legacy purposes.
-
Can accommodate 1024-bit PKI keys and the full set of PIV objects is loaded by ActivID CMS (PIV mandatory and optional objects).
-
Only for Oberthur PIV cards.
|
Supported Devices |
Supported Pre-Issuance IDs |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Oberthur ID-One Cosmo v5.2D 64K Fast ATR with PIV application SDK |
5_OCS_PIV_TEST_OPSC_1
5_OCS_PIV_PROD_OPSC_1
100_OCS_PIV_PROD_OPSC_1
5_OCS_PIV_SDK_OPSC_1
|
PIV FIPS201 F2F Java Card – OCS 1024-2048
PIV2 Profile with OCS End-Point applets v1.08
This profile is deprecated and can no longer be used to create new device policies. It is included for legacy purposes.
-
Can accommodate 1024 and 2048-bit PKI keys and the full set of PIV objects is loaded by ActivID CMS (PIV mandatory and optional objects).
-
Only for Oberthur PIV cards.
|
Supported Devices |
Supported Pre-Issuance IDs |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Oberthur ID-One Cosmo v5.2D 64K Fast ATR with PIV application SDK |
5_OCS_PIV_TEST_OPSC_1
5_OCS_PIV_PROD_OPSC_1
100_OCS_PIV_PROD_OPSC_1
5_OCS_PIV_SDK_OPSC_1
|
PIV FIPS201 F2F Java Card – OCS 2048
PIV2 Profile with OCS End-Point applets v1.08
This profile is deprecated and can no longer be used to create new device policies. It is included for legacy purposes.
-
Can accommodate 2048-bit PKI keys and the full set of PIV objects is loaded by ActivID CMS (PIV mandatory and optional objects).
-
Only for Oberthur PIV cards.
|
Supported Devices |
Supported Pre-Issuance IDs |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Oberthur ID-One Cosmo v5.2D 64K Fast ATR with PIV application SDK |
5_OCS_PIV_TEST_OPSC_1
5_OCS_PIV_PROD_OPSC_1
100_OCS_PIV_PROD_OPSC_1
5_OCS_PIV_SDK_OPSC_1
|
PIV FIPS201 F2F Java Card - IDEMIA ID-One PIV 2.4.1 - 2048
PIV2 Profile with IDEMIA End-Point applets v2.4.1 (SP800-73-4)
This profile is deprecated and can no longer be used to create new device policies. It is included for legacy purposes.
-
Supports SP 800-73-3 objects, including PIV Discovery, Iris, Key History and Key Management Key objects. It can accommodate 2048-bit PKI keys and the full set of PIV objects is loaded by ActivID CMS (PIV mandatory and optional objects).
-
Only for IDEMIA PIV cards with PIV applet v2.4.1.
-
Replaced by PIV FIPS201 F2F Java Card - IDEMIA ID-One PIV 2.4.X - 2048 profile.
-
PIN is numeric only.
-
In addition to the card pre-issuance keys, the following keys must be present in the HSM for profile issuance. As these keys are post-issuance keys, they should be generated in the HSM:
-
For the pre-issuance Card AES 128: MK_CM_ACE_AES_16_OPSC_1_ENC, _MAC, _KEK, PIV_CARD_ADMINISTRATOR_KEY_9B_AES_16 (16-byte AES keys)
-
For the pre-issuance Card AES 256: MK_CM_ACE_AES_32_OPSC_1_ENC, _MAC, _KEK, PIV_CARD_ADMINISTRATOR_KEY_9B_AES_32 (32-byte AES keys)
-
|
Supported Devices |
Supported Pre-Issuance IDs |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
5_IDEMIA_PIV_241_TEST_OPSC_1
5_IDEMIA_PIV_241_PROD_OPSC_1
100_IDEMIA_PIV_241_PROD_OPSC_1
|
PIV FIPS201 F2F Java Card - IDEMIA ID-One PIV 2.4.2 - 2048
PIV2 Profile with IDEMIA End-Point applets v2.4.2 (SP800-73-4)
This profile is deprecated and can no longer be used to create new device policies. It is included for legacy purposes.
-
Supports SP 800-73-4 objects, including PIV Discovery, Iris, Key History and Key Management Key objects.
-
Only for IDEMIA PIV cards with PIV applet v2.4.2.
-
Replaced by PIV FIPS201 F2F Java Card - IDEMIA ID-One PIV 2.4.X - 2048 profile.
-
PIN is numeric only.
-
In addition to the card pre-issuance keys, the following keys must be present in the HSM for profile issuance. As these keys are post-issuance keys, they should be generated in the HSM:
-
For the pre-issuance Card AES 128: MK_CM_ACE_AES_16_OPSC_1_ENC, _MAC, _KEK, PIV_CARD_ADMINISTRATOR_KEY_9B_AES_16 (16-byte AES keys)
-
For the pre-issuance Card AES 256: MK_CM_ACE_AES_32_OPSC_1_ENC, _MAC, _KEK, PIV_CARD_ADMINISTRATOR_KEY_9B_AES_32 (32-byte AES keys)
-
|
Supported Devices |
Supported Pre-Issuance IDs |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
IDEMIA_PIV_242_TEST_OPSC_1
IDEMIA_PIV_242_PROD_OPSC_1
|
PIV FIPS201 F2F Java Card – OT 2.3.2 – 2048
PIV2 Profile with OT End-Point applets v2.3.2 (SP 800-73-3)
This profile is deprecated and can no longer be used to create new device policies. It is included for legacy purposes.
-
Supports SP 800-73-3 objects, including PIV Discovery, Iris, Key History and Key Management Key objects. It can accommodate 2048-bit PKI keys and the full set of PIV objects is loaded by ActivID CMS (PIV mandatory and optional objects).
-
Only for Oberthur PIV cards with PIV applet v2.3.2.
Note: For Oberthur PIV profiles with Oberthur PIV applet 2.3.2, use BAP #087282. -
In addition to the card pre-issuance keys, the following keys must be present in the HSM A Hardware Security Module (HSM) securely stores secret key material. They are similar to large-storage, multisession smart cards. However, unlike smart cards, they are used mainly on the server side of a system. for profile issuance. As these keys are post-issuance keys, they should be generated in the HSM:
-
MK_SD_ACE_AES_OPSC_1_ENC, _MAC, _KEK, PIV_CARD_ADMINISTRATOR_KEY_9B_AES_16 (16-byte AES keys)
-
|
Supported Devices |
Supported Pre-Issuance IDs |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Oberthur ID-One PIV 2.3.2 on Cosmo v7 |
5_OCS_PIV_232_TEST_OPSC_1
5_OCS_PIV_232_PROD_OPSC_1
100_OCS_PIV_232_PROD_OPSC_1
|
