Terms and Definitions
-
ASN.1. A standard interface description language for defining data structures that can be serialized and deserialized in a cross-platform way.
-
AES. A symmetric key encryption algorithm established by the U.S. National Institute of Standards and Technology (NIST).
-
Advanced Encryption Standard. A symmetric key encryption algorithm established by the U.S. National Institute of Standards and Technology (NIST).
-
Application Protocol Data Unit. In the context of smart cards and other tokens, an APDU is the communication unit between a reader and a token. The structure of the APDU is defined by ISO/IEC 7816-4 (Organization, security and commands for interchange).
-
Application Programming Interface.
-
A small, subordinate application on the token designed to perform specific tasks.
-
In the context of smart cards and other tokens, an Application Protocol Data Unit (APDU) is the unit of communication between a reader and a token. The structure of the APDU is defined by ISO/IEC 7816-4 (Organization, security and commands for interchange).
-
Abstract Syntax Notation One. A standard interface description language for defining data structures that can be serialized and deserialized in a cross-platform way.
-
A Certificate Authority is a trusted entity that issues digital certificates, confirming the ownership of public keys and other identity attributes. Within a Public Key Infrastructure (PKI), the CA typically relies on a Registration Authority (RA) to verify the certificate requestor's information before issuing the certificate.
-
Random number generated by the server API for authentication of a user in the asynchronous (challenge/response) mode.
-
Cryptography Next Generation. A modern cryptographic API (Application Programming Interface) introduced by Microsoft as part of Windows to replace the older CryptoAPI. It provides a flexible and extensible framework for implementing cryptographic algorithms, key storage, and secure key management and supports a wide range of cryptographic operations, including encryption, decryption, hashing, and digital signatures.
-
HID® Crescendo® Key™ Series are hardware security USB tokens offering strong multi-factor and passwordless authentication with support for FIDO, PKI and OATH.
-
CNG. A modern cryptographic API (Application Programming Interface) introduced by Microsoft as part of Windows to replace the older CryptoAPI. It provides a flexible and extensible framework for implementing cryptographic algorithms, key storage, and secure key management. CNG supports a wide range of cryptographic operations, including encryption, decryption, hashing, and digital signatures, and is designed to be algorithm-agnostic, allowing for the use of both existing and future cryptographic algorithms.
-
The security hardware held by an end user, used for authentication, digital signing, and encryption tasks. This is typically a hardware token or a reader.
-
Eliptic curve cryptography. A cryptography approach for public key encryption using the mathematics of elliptic curves Allows smaller keys to provide equivalent security, compared to other cryptosystems such as RSA.
-
Fast IDentity Online. A security standard used for online authentication, based on a cryptographic key pair unique to each online service. For more information, visit https://fidoalliance.org/how-fido-works/
-
HMAC. Message authentication code that uses a cryptographic key in conjunction with a hash function.
-
Hash-Based Message Authentication Code. Message authentication code that uses a cryptographic key in conjunction with a hash function.
-
HOTP. A type of one-time password that is algorithmically generated using HMAC and a counter that increases every time a new OTP is generated, providing a dynamic passcode each time it is required.
-
HMAC-Based One-Time Password. A type of one-time password that is algorithmically generated using HMAC and a counter that increases every time a new OTP is generated, providing a dynamic passcode each time it is required.
-
A PIN is in its initial state in factory settings, before any changes have been made to it.
-
Smart cards, USB keys, or other security devices administered and controlled through a management platform or system, typically used for secure authentication, encryption, or access control in enterprise environments.
-
A cryptographic key used to control and manage secure operations on a token, such as configuring, updating, or modifying sensitive data.
-
MSI. A software component used for the installation, maintenance, and removal of software on modern Microsoft Windows systems.
-
Smart card middleware for the Microsoft platform that works with the Microsoft Base Smart Card CSP (Cryptographic Service Provider).
-
Microsoft Installer is a software component used for the installation, maintenance, and removal of software on modern Microsoft Windows systems.
-
Initiative for Open Authentication.
-
OATH (Initiative for Open Authentication) Challenge-Response Algorithm.
-
A configuration string used in OATH Challenge-Response Authentication (OCRA) that defines the parameters for generating one-time passwords.
-
Object identifier. Globally unique identifiers standardized by the International Telecommunication Union. OIDs are represented as a series of numbers separated by dots (e.g., 2.5.29.37).
-
OTP. A password that is valid for only one login session or transaction, used to provide an additional layer of security.
-
One-Time Password. A password that is valid for only one login session or transaction, used to provide an additional layer of security.
-
PIN. A numeric or alphanumeric code used to authenticate a user to a system, typically known only to the user and the system.
-
PIV. A United States federal standard for secure and reliable forms of identification issued by the government to federal employees and contractors.
-
Personal Identification Number. A numeric or alphanumeric code used to authenticate a user to a system, typically known only to the user and the system.
-
PUK. A code used to reset the personal identification number (PIN) in devices after they have been locked due to multiple incorrect PIN entries.
-
Personal Identity Verification is a United States federal standard for secure and reliable forms of identification issued by the government to federal employees and contractors.
-
Public Key Infrastructure. A framework that enables secure, electronic identities through the use of public key cryptography, including the creation, distribution, and management of digital certificates.
-
PSKC. An extensible markup language (XML) format defined by the OASIS standard that is used for transporting and provisioning symmetric keys to different types of devices.
-
Portable Symmetric Key Container. An extensible markup language (XML) format defined by the OASIS standard that is used for transporting and provisioning symmetric keys to different types of devices.
-
Files used to securely transport and provision symmetric keys to cryptographic devices or software, following the Portable Symmetric Key Container (PSKC) format.
-
PKI. A framework that enables secure, electronic identities through the use of public key cryptography, including the creation, distribution, and management of digital certificates.
-
PIN Unblock Key. A code used to reset the personal identification number (PIN) in devices after they have been locked due to multiple incorrect PIN entries.
-
Quick-Response Code. A type of two-dimensional barcode that is readable by imaging devices.
-
QR code. A type of two-dimensional barcode that is readable by imaging devices.
-
Rivest–Shamir–Adleman cryptographic algorithm.
-
Secure Key Injection (SKI) is a FIPS certification-compliant protocol that ensures data protection when importing private keys, OTP secrets, and management keys.
-
A standard specifying the concrete steps, cryptographic algorithms and parameters used to produce cryptographic signatures.
-
RSA-3072 key uniquely bound to a specific token, used to securely transfer data to that token in compliance with the Secure Key Injection (SKI) protocol.
-
A smart card is a card with an embedded security chip, which can be used for personal identification, authentication, data storage, and application processing.
-
Smart card with pre-loaded applets issued by the manufacturer.
-
Triple Data Encryption Standard. An encryption algorithm that uses three separate keys for encryption, providing a higher level of security than its predecessor, the Data Encryption Standard (DES).
-
TOTP. A variant of the one-time password (OTP) that uses a representation of the current time as a moving factor to ensure that each OTP is unique and valid only for a short period of time.
-
A physical device, such as a smart card or USB key, that securely stores certificates, cryptographic keys and credentials used for authentication, digital signing, and encryption tasks.
-
Time-Based One-Time Password. A variant of the one-time password (OTP) that uses a representation of the current time as a moving factor to ensure that each OTP is unique and valid only for a short period of time.
-
TDES. An encryption algorithm that uses three separate keys for encryption, providing a higher level of security than its predecessor, the Data Encryption Standard (DES).
-
A PIN in which the difference between each character or digit and the following one is a constant. For example, a PIN that is a sequence of the same number or character, or an increasing/decreasing sequence of numbers or characters (1234, 4321, 86420, ABCD, acegik, etc.) is a weak PIN.
A
C
D
E
F
H
I
M
O
P
Q
R
S
T
W