1. Ketan Mehta mehta_ketan@nist.gov March 3, 2006
PIV Data Model Testing
Ketan Mehta
March 3, 2006

2. Agenda
PIV Test Environment
Test Methodology
Test Areas
Schedule

3. PIV Test Environment Host PC Smart Card Reader
PIV Client Application Programming Interface
PIV Card Command Calls
Card Reader Driver
Card Reader
PIV Card Application
PIV Data Model
PIV Card Command Interface
PIV
MIDDLEWARE
(SP )
Host PC
Smart Card Reader
PIV CARD
(FIPS 201, SP , SP , SP )
Test Toolkit Application

4. Agenda
PIV Test Environment
Test Methodology
Test Areas
Schedule

5. Derived Test Requirements
PIV Test Methodology
Inputs
Process
Outputs
FIPS 201
Derived Test Requirements
&
Test Assertions SP
Test Results SP SP
NIST Test Guidance — SP
NPIVP Certificate
Lab Testing:
Conformance to SP
PIV Data Model
Testing*
Self-certification
Lab Activity
SP A
Agency Activity**
SP B
* Conformance to FIPS 201, SP , and SP
** The process is currently being defined

6. Agenda
PIV Test Environment
Test Methodology
Test Areas
Schedule

7. Test Areas CHUID Data Object Security Object Biometric Data Object
PKI Keys and Certificates
Note that all test requirements are designed to:
- Validate the format of PIV data
- Validate values in the fields
- Validate computation such as signatures or data comparison

8. SP 800-85B – PIV Biometrics Testing
Test Toolkit Application
PIV
MIDDLEWARE
PIV Client Application Programming Interface
Agency / System Integrator
PIV Card Command Calls
Card Reader Driver
Data Under Test
Smart Card Reader
Finger print stored for FBI Transmission
Finger print stored for PIV Enrollment
Finger print minutiae for PIV Card
Facial Image for PIV Card
Card Reader
PIV Card Application
PIV Card Command Interface
PIV CARD (SP Conformant)
PIV Data Model

9. SP 800-85B – Biometric Data Conformance
Enrollment Process
Face Templating
Fingerprint Templating
CBEFF Header Generation
PIV-Specific Enrollment Procedures
Verification Process
Fingerprint Matching
Integrated
PIV
Biometrics
Process
Documentation (Fingerprint and Facial Acquisition, Equipment, Procedures)
Format Validation
Human Inspection
Performance Tests
Tested through
SP B
- Dependent on the policy requirements and procedural steps
- External to PIV Testing
- Quality dependent on the MINEX04 test results
- External to PIV testing

10. SP 800-85B – PIV PKI Testing Agency / System Integrator
Test Toolkit Application
Agency / System Integrator
Card Reader Driver
Smart Card Reader
Card Reader
PIV Card Application
PIV Card Command Interface
PIV Card
PIV Data Model
Signature Conformance
Data Under Test
Algorithm Conformance
Certificate Profile Conformance

11. SP 800-85B — Cryptographic Objects Conformance …Signature Conformance
Validate signatures on all signed PIV objects
Validate signature block format on all signed PIV objects
Validate encoding of Cryptographic Message Syntax external digital signature
Validate values in certain fields of the signature block
Validate algorithms employed are in agreement with SP
Values are consistent with other data objects on the PIV Card

12. Validate the presence of CRL and OCSP URLs
SP B — Cryptographic Objects Conformance …Certificate Conformance
Validate the presence of CRL and OCSP URLs
Validate NACI indicator field

13. SP 800-85B — BER-TLV Format Conformance
The tags and lengths in various data objects should conform to specifications in Appendix A of SP

14. Tentative Schedule Draft SP 800-85B – April 3rd
Final SP B – April 28th