DoD Implementation Guide for CAC PIV End-Point - Common ...

More documents

Recommendations

Info

DoD Implementation Guide for CAC PIV End-Point Appendix D Sample data for PIV Authentication Certificate Below is a sample record format for the DoD PIV Authentication Certificate. Summary: Sample PIV Auth Certificate (2048 Root, 2048 Intermediate, and 1024 End Entity) issued from JITC CA 19 on Jan of 2008. The sequence TBSCertificate contains information associated with the subject of the certificate and the CA who issued it. Every TBSCertificate contains the names of the subject and issuer, a public key associated with the subject, a validity period, a version number, and a serial number; some MAY contain optional unique identifier fields. For signature calculation, the data that is to be signed is encoded using the ASN.1 distinguished encoding rules (DER) [X.690]. ASN.1 DER encoding is a tag, length, value encoding system for each element. Sources: *ASN.1, **ASN.1. Specified in 800-73 for interoperable use**ASN.1. Specified in 800-73 for interoperable use Field Name Basic Certificate Hex Raw Data OID Data Content *Version A0 03 02 01 02 2 *Serial Number ** Issuer Signature Algorithm * Issuer Distinguished Name *Validity Period *Subject Distinguished Name *Subject Public Key Information 02 02 13 03 4867 30 0D 06 09 2A 86 48 86 F7 0D 01 01 05 05 00 30 5C 31 0B 30 09 06 03 55 04 06 13 02 55 53 31 18 30 16 06 03 55 04 0A 13 0F 55 2E 53 2E 20 47 6F 76 65 72 6E 6D 65 6E 74 31 0C 30 0A 06 03 55 04 0B 13 03 44 6F 44 31 0C 30 0A 06 03 55 04 0B 13 03 50 4B 49 31 17 30 15 06 03 55 04 03 13 0E 44 4F 44 20 4A 49 54 43 20 43 41 2D 31 39 30 1E 17 0D 30 38 30 31 31 34 30 30 30 30 30 30 5A 17 0D 31 31 30 31 31 30 32 33 35 39 35 39 5A 30 81 90 31 0B 30 09 06 03 55 04 06 13 02 55 53 31 18 30 16 06 03 55 04 0A 13 0F 55 2E 53 2E 20 47 6F 76 65 72 6E 6D 65 6E 74 31 0C 30 0A 06 03 55 04 0B 13 03 44 6F 44 31 0C 30 0A 06 03 55 04 0B 13 03 50 4B 49 31 0D 30 0B 06 03 55 04 0B 13 04 55 53 41 46 31 3C 30 3A 06 03 55 04 03 13 33 4F 43 53 20 50 49 56 41 55 54 48 20 59 45 53 2E 4D 49 4C 4F 4E 2E 43 41 52 44 20 54 48 52 45 45 20 50 49 56 42 45 54 41 2E 31 34 30 31 33 35 37 33 35 38 30 81 9F 30 0D 06 09 2A 86 48 86 F7 0D 01 01 01 2A 86 48 86 F7 0D 01 01 05 (1.2.840.113549.1.1.5 =SHA1withRSA) 30 SHA1withRSA Encryption 55 04 06 (2.5.4.6 =countryName) 'US' 55 04 0A (2.5.4.10=organizationName) 'U.S. Government' 55 04 0B (2.5.4.11= organizationalUnitName) 'DoD' 55 04 0B (2.5.4.11= organizationalUnitName) 'PKI' 55 04 03 (2.5.4.3 =commonName) 'DOD JITC CA-19' 080114000000Z UTC Time Code(issued date) 110110235959Z UTC Time Code (expiration date) 55 04 06 (2.5.4.6=countryName) 'US' 55 04 0A (2.5.4.10 =organizationName) 'U.S. Government' 55 04 0B (2.5.4.11=organizationalUnitName) 55 04 0B (2.5.4.11=organizationUnitName) 55 04 0B (2.5.4.11=organizationUnitName) 'DOD' 'PKI' ‘USAF’ 55 04 03 (2.5.4.3 =commonName) 'OCS PIVAUTH YES.MILON.CARD THREE PIVBETA.1401357358' 2A 86 48 86 F7 0D 01 01 01 (1.2.840.113549.1.1.1= RSA) RSA Encryption **Public Key 03 81 8D 00 30 81 89 02 81 81 00 B7 BE 11 EC B0 3D B3 76 4A 04 1F B8 2A 00 2E C1 C5 3F EF 40 73 5D 4D ED E1 E4 CE E4 49 8F 8D 98 16 3F BE D1 8C 97 05 9C BA 96 E1 8C E8 00 EA 6A A8 95 12 FC 7A 67 83 34 82 BF A7 6B 4B 20 AC 49 BA 73 25 8C 8D 90 A5 BF ED 4E DD 17 49 50 E6 BB E2 5E 0A A2 19 C4 4E 22 4F A3 8D 50 56 25 0F 33 97 E9 C9 CF 6E 33 8D 32 DF EE 16 38 F1 FD 1A 62 9B 90 A6 39 54 1A DC F8 F8 D6 50 B7 58 20 1A F1 02 03 01 00 01
DoD Implementation Guide for CAC PIV End-Point Standard Extensions *Authority Key Identifier *Subject Key Identifier *Extended Key Usage *Certificate Policies *Subject Alternative Name *Subject Directory Attributes *Authority Info Access *CRL Distribution Points A3 82 01 C8 30 82 01 C4 30 1F 06 03 55 1D 23 04 18 30 16 80 14 A9 56 F9 48 50 1D FF 45 1C 54 E2 63 6B FA 71 2C 98 34 C8 8C 30 1D 06 03 55 1D 0E 04 16 04 14 27 FF A1 A1 1D 41 3B F0 1C DF 71 9D BC 57 DF 1C 24 47 B4 87 30 1F 06 03 55 1D 25 04 18 30 16 06 0A 2B 06 01 04 01 82 37 14 02 02 06 08 2B 06 01 05 05 07 03 02 30 16 06 03 55 1D 20 04 0F 30 0D 30 0B 06 09 60 86 48 01 65 02 01 0B 09 30 58 06 03 55 1D 11 04 51 30 4F A0 24 06 0A 2B 06 01 04 01 82 37 14 02 03 A0 16 0C 14 31 34 30 31 33 35 37 33 35 38 31 35 37 30 30 34 40 6D 69 6C A0 27 06 08 60 86 48 01 65 03 06 06 A0 1B 04 19 D4 F8 10 DA 01 15 6C 10 C0 88 85 83 60 DA 04 0C 33 5E 55 1D 23 (2.5.29.35=authorityKeyIdentifier) 80 14 A9 56 F9 48 50 1D FF 45 1C 54 E2 63 6B FA 71 2C 98 34 C8 8C 55 1D 0E (2.5.29.14 =subjectKeyIdentifier) 27 FF A1 A1 1D 41 3B F0 1C DF 71 9D BC 57 DF 1C 24 47 B4 87 55 1D 25 (2.5.29.37 =extKeyUsage) 2B 06 01 04 01 82 37 14 02 02 (1.3.6.1.4.1.311.20.2.2= kp_smartCardLogin) 2B 06 01 05 05 07 03 02 1.3.6.1.5.5.7.3.2= id_kp_clientAuth) 55 1D 20 ( 2.5.29.32 =certificatePolicies) 60 86 48 01 65 02 01 0B 09 (2.16.840.1.101.2.1.11.9 =null) 55 1D 11 (2.5.29.17=subjectAltName) 2B 06 01 04 01 82 37 14 02 03 (1.3.6.1.4.1.311.20.2.3 =nt_userPrincipalName) 31 34 30 31 33 35 37 33 35 38 31 35 37 30 30 34 40 6D 69 6C 66 A2 85 78 10 93 F0 60 86 48 01 65 03 06 06 (2.16.840.1.101.3.6.6 =pivFASC-N) 30 1B 06 03 55 1D 09 04 14 30 12 30 10 06 08 2B 06 01 05 05 07 09 04 31 04 13 02 55 53 30 7E 06 08 2B 06 01 05 05 07 01 01 04 72 30 70 30 3E 06 08 2B 06 01 05 05 07 30 02 86 32 68 74 74 70 3A 2F 2F 63 72 6C 2E 6E 69 74 2E 64 69 73 61 2E 6D 69 6C 2F 67 65 74 73 69 67 6E 3F 44 4F 44 25 32 30 4A 49 54 43 25 32 30 43 41 2D 31 39 30 2E 06 08 2B 06 01 05 05 07 30 01 86 22 68 74 74 70 3A 2F 2F 6F 63 73 70 2E 6E 73 6E 30 2E 72 63 76 73 2E 6E 69 74 2E 64 69 73 61 2E 6D 69 6C 30 42 06 03 55 1D 1F 04 3B 30 39 30 37 A0 35 A0 33 86 31 68 74 74 70 3A 2F 2F 63 72 6C 2E 6E 69 74 2E 64 69 73 61 2E 6D 69 6C 2F 67 65 74 63 72 6C 3F 44 4F 44 25 32 30 4A 49 54 43 25 32 30 43 41 2D 31 39 *Key Usage 30 0E 06 03 55 1D 0F 01 01FF 04 04 03 02 07 80 55 1D 09 (2.5.29.9 =subjectDirectoryAttributes) 2B 06 01 05 05 07 09 04 1.3.6.1.5.5.7.9.4 (id-pdacountryOfCitizenship) 2B 06 01 05 05 07 01 01 (1.3.6.1.5.5.7.1.1=id_pe_authorityInfo Access) 2B 06 01 05 05 07 30 02 (1.3.6.1.5.5.7.48.2=(id_ad_caIssuers) 2B 06 01 05 05 07 30 01 (1.3.6.1.5.5.7.48.1=ocsp) 55 1D 1F (2.5.29.31=cRLDistributionPoints) 68 74 74 70 3A 2F 2F 63 72 6C 2E 6E 69 74 2E 64 69 73 61 2E 6D 69 6C 2F 67 65 74 63 72 6C 3F 44 4F 44 25 32 30 4A 49 54 43 25 32 30 43 41 2D 31 39 31 55 1D 0F (2.5.29.15=(keyUsage) Key Value Key Value '1401357358157004@mil' D4 F8 10 DA 01 15 6C 10 C0 88 85 83 60 DA 04 0C 33 5E 66 A2 85 78 10 93 F0 'US' http://crl.nit.disa.mil/getsi gn?DOD%20JITC%20CA- 19 http://ocsp.nsn0.rcvs.nit.di sa.mil http://crl.nit.disa.mil/getcrl ?DOD%20JITC%20CA-19 01 01 Boolean type, length FF TRUE -Critical 03 02 07 80 Digital Signature
Page 1 and 2: DMDC Card Technologies & Identity S
Page 3 and 4: DoD Implementation Guide for CAC PI
Page 33: DoD Implementation Guide for CAC PI
Page 47: DoD Implementation Guide for CAC PI

DoD Implementation Guide for CAC PIV End-Point - Common ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?