C.I.E – Carta di Identità Elettronica Functional Specification Version 2.0

4 --- b0 BSO IDTable 45: External Authenticate commandThis command allows the card to authenticate an external entity by means of a challenge-responseprotocol.It is possible to perform an External Authenticate only after a Get Challenge command. The GetChallenge makes the card generate internally a random, that is stored internally and sent to theterminal.It is possible to have other commands between a Get Challenge and its External Authenticate, aslong as they are issued during the same card session (between 2 resets).The random generated during the Get Challenge command is valid for only one ExternalAuthentication.The Data Field of the command contains the result of the cryptographic operation made on thechallenge.The card compares this value with the value computed internally, and if they match, the securitystatus of the card changes accordingly.The algorithm used for the cryptogram computation is set in the BSO, so P1=0.BSOs that can be used with External Authenticate are:• RSA KPUB – EXT AUTH• 3DES – EXT AUTHThe parameter P2 contains the scope and the ID of the BSO. If the BSO ID is equal to 0 then theBSO is searched in component TEST of the Current Security Environment (CSE).The length of the data field has to match the length of the challenge, and has to be 8 bytes if 3DESis used, or exactly the length of the key modulus in the other case (RSA). If it is not the case, anerror is returned.When the command is executed with success, the access right is granted and the error counterrelated to the relevant object (BSO) is set to its max value.If the command is not executed with success, then access right is not granted and the error counteris decreased by one.Security:The access condition to satisfy is AC_USE. The BSO object must not be in a blocked status.Recommendation:The use of External Authenticate in SM_SIG mode is deprecated.CIE - Functional Specification v 2.0 -Page 62/76