Download Here - Common Access Card (CAC)

More documents

Recommendations

Info

7 Core DoD Requirements for CAC PKCS11 Module Only 7.1 General 7.1.1 PKCS11 implementation shall implement a singular generic P11 module that supports the CAC, PIV, and DoD alternate token interfaces that conform to NISTR 6887 and NIST SP 800-73-3. 7.1.2 PKCS11 implementation shall support PKCS11 functions listed in Appendix C, PKCS11 Functions. 7.1.3 Vendor shall provide a list of all unsupported PKCS11 functions. 7.2 Support for FIPS 201 and Associated NIST Special Publications 7.2.1 PKCS11 implementation shall support NIST Special Publication 800-85. 7.2.2 PKCS11 implementation shall be certified by an approved NIST laboratory to be FIPS 201 compliant. 7.2.3 Vendors shall migrate product offerings, as part of routine maintenance, to support any updates or adjustments to FIPS 201 and any applicable NIST Special Publication. 7.3 Card Interfaces 7.3.1 PKCS11 implementation shall support all card-edge command sets for: 7.3.1.1 National Institute of Standards and Technology’s Special Publication 800-73-3, “Interfaces for Personal Identity Verification,” February 2010. 7.3.1.2 National Institute of Standards and Technology’s Interagency Report 6887 – 2003 Edition, Government Smart Card Interoperability Specification. Version 2.1, July 13, 2003. 7.3.1.3 CAC Developer’s Kit version 4.2 (March 2009) or higher 2006 located at http://www.cac.mil/common-access-card/developer-resources/. 7.3.1.4 DoD Implementation Guide for CAC Next Generation NG version 2.6 (November 2006) located at http://www.cac.mil/common-accesscard/developer-resources/. 7.3.1.5 DoD Implementation Guide for CAC PIV Endpoint version 1.22 (April 2010) located at http://www.cac.mil/common-access-card/developer-resources/. UNCLASSIFIED 36
7.3.1.6 National Institute of Standards and Technology – Technology Administration U.S. Department of Commerce, Government Smart Card Interoperability Specification. Version 2.1, July 12, 2003, http://smartcard.nist.gov. 7.3.2 Middleware must be configurable to only support NISTR 6887 and NIST SP 800- 73-3 or newer card-edges. The middleware should not request or allow entry of PIN (i.e., activation data) for other card-edges. When an unauthorized card-edge is detected, the middleware must respond with an error to the user interface. An example of the error message could be, “This card is not supported within the current configuration of middleware.” 7.4 PKI Requirements 7.4.1 Supported Cryptography 7.4.1.1 PKCS11 implementation shall support the exchange of information between the card and workstation when those transactions use the following cryptographic algorithms. 7.4.1.1.1 RSA 2048 and higher 7.4.1.1.2 ECC 5 7.4.1.1.3 TDES 7.4.1.1.4 SHA 1 7.4.1.1.5 SHA 256 or higher 5 7.4.1.1.6 AES 5 7.5 Common Access Card (CAC) and Alternate Tokens 7.5.1 PKCS11 implementation shall minimally support the following CAC configurations 6 : 7.5.1.1 Axalto Cyberflex Access 64k v1 soft mask 4 version 1 7.5.1.2 Gemplus GemXpresso (GXP) PRO 64 K 7.5.1.3 Axalto Cyberflex Access 64k v1 soft mask 4 version 2 5 Requirement is only applicable when connected to cryptographic engines that support this algorithm. 6 Specific details on these CAC platforms are outlined in Appendix F. The most current listing of CAC platforms can be found at http://www.cac.mil/common-access-card/developer-resources/. UNCLASSIFIED 37
Page 1 and 2: DoD CAC Middleware Requirements Rel
Page 3 and 4: 5.3 PIN Services ..................
Page 5 and 6: Document Revision History Date Vers
Page 7 and 8: 1.5 Document Objectives The objecti
Page 9 and 10: 2 Middleware Background 2.1 Middlew
Page 11 and 12: 3 Middleware Requirements 3.1 Requi
Page 13 and 14: 4.2.2 Middleware must be configurab
Page 15 and 16: 4.4 Common Access Card (CAC) and Al
Page 17 and 18: Operating Systems Supported by Midd
Page 19 and 20: 4.8.1.3 Only items relative to the
Page 21 and 22: 4.12.2 PIN Change 4.12.2.1 Middlewa
Page 23 and 24: 4.14 Process Descriptions 4.14.1 Mi
Page 25 and 26: 5.1.10 Middleware should monitor sm
Page 27 and 28: Section B: Requirements for CAC Mic
Page 29 and 30: 6.3.1.3 CAC Developer’s Kit versi
Page 31 and 32: 6.5.3.4 Minidriver implementation s
Page 33 and 34: 6.8.3 Client Authentication 6.8.3.1
Page 35: Section C: Requirements for CAC PKC
Page 39 and 40: 7.5.5 Certificates 7.5.5.1 PKCS11 i
Page 41 and 42: 7.9.3.4 PKCS11 shall indicate to th
Page 43 and 44: Example [HKEY_LOCAL_MACHINE\SOFTWAR
Page 45 and 46: Figure 5: Web Servers, Browsers, an
Page 47 and 48: Appendix B- CSP Functions All CSPs
Page 49 and 50: one[0].pValue = &cko_data; char*)tw
Page 51 and 52: Appendix E- BSI Header Files The la
Page 53 and 54: Industry References • GlobalPlatf
Page 55 and 56: Appendix G- List of CAC Platform Co
Page 57 and 58: Attributes Current Platforms Card M

Download Here - Common Access Card (CAC)

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?