1 1 Update: ISO/IEC Identification Cards - Integrated circuit cards programming interfaces Teresa Schwarzhoff, U.S. Department of Commerce Porvoo-12: Grossetto ITALY

2 2 Topics  Background/overview  ISO/IEC  Part 1  Part 2  Part 3  Part 4  Part 5  Conclusion

3 3 Topics  Background/overview  ISO/IEC  Part 1  Part 2  Part 3  Part 4  Part 5  Conclusion

4 4 ISO/IEC JTC 1 SC 17/WG 4/TF 9  ISO/IEC Joint Technical Committee 1 Sub Committee 17  ISO/IEC JTC1 SC 17/ WG 4  ISO/IEC work assigned to WG4 - Task Force 9 (TF9)  ISO/IEC built upon NIST smart card ‘interoperability’ specification  TF9 chaired by U.S. (NIST) and ANSI secretary  TF9 scope  Standardization of a set of structured programming interfaces for interactions between integrated circuit cards and external applications to include generic services for multi-sector use  Good technical expert representation in TF 9 -- includes Australia, France, Germany, Japan, UK, US, and TC 224/WG15

5 5 ISO/IEC multi-part standard ISO/IEC – Identification Cards - Integrated circuit cards programming interfaces Builds upon ISO/IEC 7816 Focuses on services and interfaces Card type neutral Contact and contactless agnostic eID: identification, authentication, and signature services Goal: Independent implementations that are interchangeable

6 6 Why ISO/IEC 24727?  Existing standards  Too many options  Focus on physical card  Lack of interface standardization  Simplification  Simplify developer’s life  Improve portability  Interoperability  Ubiquitous interoperability: what we are all trying to achieve but must be kept simple Interoperability and security and Conformance testing and privacy: “two” sides of the same coin

7 7 ISO/IEC 24727: A Standard in 5* Parts * To be discussed in future slide

8 8 Topics  Background/overview  ISO/IEC  Part 1  Part 2  Part 3  Part 4  Part 5  Conclusion

9 9 ISO/IEC  ISO/IEC Identification Cards - Integrated circuit cards programming interfaces – Part 1: Architecture  Overarching framework  Common terminology  Logical architecture for framework  Status  Published, available for purchase via your national body standards group or the ISO on-line store

10 ISO/IEC  ISO/IEC Identification Cards - Integrated circuit cards programming interfaces – Part 2: Generic card interface  Common card interface  7816 toolkit fine-tuning  Discovery mechanism  Card capability description (CCD)  Application capability description (ACD)  ISO/IEC  ISO/IEC  Status  FDIS ballot anticipated November 2007  Anticipate IS Spring 2008

11 ISO/IEC  ISO/IEC Identification Cards - Integrated circuit cards programming interfaces – Part 3: Application interface  New territory for smart card standards  Normative API/middleware  Normative authentication protocols  Normative Services  Connection  Card application discovery and retrieval  Identity  Cryptographic  Authorization  Status  Learning curve for committee technical experts: not about the ‘card’ but rather card-applications  FCD ballot launched last Friday, 14 September  Anticipate FDIS in Spring 2008

12 Example of actions for a service found in ISO/IEC : Connection service Initialize Terminate CardApplicationPath CardApplicationConnect CardApplicationDisconnect CardApplicationStartSession CardApplicationEndSession Authentication protocols PIN password symmetric key asymmetric key digital certificate biometric image or template pair of symmetric keys; e.g., one for encryption and one for message authentication code (MAC) generation

13 Name of authentication protocolGeneral definition of protocol ASYMMETRIC INTERNAL AUTHENTICATEFetch certificate Send challenge to be signed (on-card) Validate (off-card) signature based on certificate ASYMMETRIC EXTERNAL AUTHENTICATEFetch challenge Sign (off-card) and validate signature (on-card) SYMMETRIC INTERNAL AUTHENTICATESend challenge to be signed (on-card) Validate signature (off-card) SYMMETRIC EXTERNAL AUTHENTICATEFetch challenge Sign challenge (off-card) Validate signature (on-card) COMPAREMatch input parameter with marker PIN COMPAREMatch input parameter with marker and limiting number of incorrect compares – reset on successful compare BIOMETRIC COMPARETranslate input parameter to template form and compare with base template SYMMETRIC KEY NONCEMutual authenticate of card-application and client- application plus generation of session keys ANYBODYNULL authentication protocol

14 ISO/IEC  ISO/IEC Identification Cards - Integrated circuit cards programming interfaces – Part 4: API administration  Implementation details of Part 2 and Part 3 interactions  Normative security architecture and stack configurations  Normative IFD API  TLS protocol Status  FCD launched October 2007  FDIS anticipated Spring 2008

15 ISO/IEC  ISO/IEC Identification Cards - Integrated circuit cards programming interfaces – Part 5: Testing  Test requirements as technical text is developed  Testing levels and modular approach  Status  Parts 2, 3, and 4 maturity/stability prerequisite has been met  Part 5 WD under modification to reflect recent decisions on the three parts  TF 9 meeting - November  Goal: CD late Spring 2008

16 NEW: ISO/IEC  ISO/IEC Identification Cards - Integrated circuit cards programming interfaces – Part 6: Registration authority procedures for the authentication protocols for interoperability  Decision taken at recent WG 4 meeting to establish a RA for future ISO/IEC authentication protocols  RA streamlines introduction of new normative authentication protocols  Lead: Standards Australia

17 Topics  Background/overview  ISO/IEC  Part 1  Part 2  Part 3  Part 4  Part 5  Conclusion

18 ISO/IEC interoperability goals  Re-use of middleware and tokens  Independence of middleware  Independence of tokens  Independence of token administration  Independence of component certification

19 Challenges  Existing investments, application neutrality  Maintaining progress  ISO process  Learning curve – have reached the right side of the bell curve!  Sustain simple forward looking, verifiable approach  Avoid options; think beyond the ‘plastic’  Conformance testing  Global standard synchronization  Global eID projects  Standard activities in other areas

20 Who is using the standard?  Australia  Australian access card for social services  Queensland drivers license (trailblazer, beginning in 2005)  Europe  EU Citizen Card  German health card  US  Future migration for federal government credential mandated by FIPS 201 (PIV)

21 Contact Information: Teresa Schwarzhoff U.S. Department of Commerce, NIST Thank you. Questions…. The best standard is one in which everyone is equally happy (and unhappy).