C.I.E – Carta di Identità Elettronica Functional Specification Version 2.0

This command computes the digital signature (DS) of the input data.The DS is given in the response data field.To use this command it is necessary to load in memory a current security environment (CSE) byusing a MSE command. The CSE has to refer to a DS component and to an object type:• RSA KPRI SIGNThe input data are the digest of the hashed data.The card performs a PKCS#1 BT1 padding on the input data before computing the signature.Security:The access condition to satisfy is AC_USE of relevant BSO.12.19 Optional commandsMain Digital Signature schemes need files (EF and DF) to be deactivable / activable after thesignature has reached a certain level of authentication within the card.In the next sections two optional ISO standard APDU commands are described as a suggestion forimplementing such requirement.The implementation of these commands is absolutely optional. Cards manufacturers are free tofulfil Digital Signature requirements with proprietary commands.12.19.1 AC bytes extensionBytes 4 and 5 in MF/DF and EF ACs (See Table7 and Table8 for coding) are used in the followingway:Byte Nr. ACProtected Commands... ... ...4 AC_ DEACTIVATE DEACTIVATE FILE5 AC_ ACTIVATE ACTIVATE FILE... ... ..Table 58: MF/DF and EF AC bytes modification12.19.2 DEACTIVATE FILECLA INS P1 P2 P3 Data FieldCIE - Functional Specification v 2.0 -Page 70/76