BS ISO IEC 7816-15-2016 Identification cards Integrated circuit cards Cryptographic information application《识别卡 集成电路卡 加密信息应用》.pdf

1、BS ISO/IEC 7816-15:2016 Identification cards Integrated circuit cards Part 15: Cryptographic information applicationBS ISO/IEC 7816-15:2016 BRITISH STANDARD National foreword This British Standard is the UK implementation of ISO/IEC 7816-15:2016. It supersedes BS ISO/IEC 7816-15:2004+A2:2008 which i

2、s withdrawn. The UK participation in its preparation was entrusted to Technical Committee IST/17, Cards and personal identification. A list of organizations represented on this committee can be obtained on request to its secretary. This publication does not purport to include all the necessary provi

3、sions of a contract. Users are responsible for its correct application. The British Standards Institution 2016. Published by BSI Standards Limited 2016 ISBN 978 0 580 84929 9 ICS 35.240.15 Compliance with a British Standard cannot confer immunity from legal obligations. This British Standard was pub

4、lished under the authority of the Standards Policy and Strategy Committee on 31 May 2016. Amendments/corrigenda issued since publication Date T e x t a f f e c t e dBS ISO/IEC 7816-15:2016 Identification cards Integrated circuit cards Part 15: Cryptographic information application Cartes didentifica

5、tion Cartes circuit intgr contacts Partie 15: Application des informations cryptographiques INTERNATIONAL STANDARD ISO/IEC 7816-15 Reference number ISO/IEC 7816-15:2016(E) Second edition 2016-05-15 ISO/IEC 2016 BS ISO/IEC 7816-15:2016ii ISO/IEC 2016 All rights reserved COPYRIGHT PROTECTED DOCUMENT I

6、SO/IEC 2016, Published in Switzerland All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written p

7、ermission. Permission can be requested from either ISO at the address below or ISOs member body in the country of the requester. ISO copyright office Ch. de Blandonnet 8 CP 401 CH-1214 Vernier, Geneva, Switzerland Tel. +41 22 749 01 11 Fax +41 22 749 09 47 copyrightiso.org www.iso.org ISO/IEC 7816-1

8、5:2016(E)BS ISO/IEC 7816-15:2016 ISO/IEC 7816-15:2016(E) ISO/IEC 2016 All rights reserved i Contents Page Foreword iv Introduction vi 1 Scope 1 2 Normative references 2 3 Terms and definitions . 2 4 Symbols and abbreviated terms 5 4.1 Symbols 5 4.2 Abbreviated terms . 5 5 Conventions . 7 6 Cryptogra

9、phic information objects . 7 6.1 General . 7 6.2 CIO classes 7 6.3 Attributes 8 6.4 Access restrictions . 8 7 CIO files 8 7.1 Overview . 8 7.2 IC card requirements . 8 7.3 Card file structure 9 7.4 EF.DIR . 9 7.5 Contents of DF.CIA 11 7.5.1 Overview . 11 7.5.2 CIAInfo EF 11 7.5.3 EF.OD 12 7.5.4 CIO

10、directory files 12 7.5.5 DF.CIA selection 13 8 Information syntax in ASN.1 14 8.1 Guidelines and encoding conventions . 14 8.2 Basic ASN.1 defined types . 14 8.2.1 Identifier 14 8.2.2 Reference . 14 8.2.3 Label . 14 8.2.4 CredentialIdentifier 14 8.2.5 ReferencedValue and Path . 15 8.2.6 ObjectValue

11、16 8.2.7 PathOrObjects . 17 8.2.8 CommonObjectAttributes . 17 8.2.9 CommonKeyAttributes . 21 8.2.10 CommonPrivateKeyAttributes . 22 8.2.11 CommonPublicKeyAttributes. 23 8.2.12 CommonSecretKeyAttributes 23 8.2.13 GenericKeyAttributes 24 8.2.14 KeyInfo 24 8.2.15 CommonCertificateAttributes 24 8.2.16 G

12、enericCertificateAttributes 25 8.2.17 CommonDataContainerObjectAttributes 25 8.2.18 CommonAuthenticationObjectAttributes . 25 8.2.19 CIO type 26 8.3 CIOChoice type 26 BS ISO/IEC 7816-15:2016 ISO/IEC 7816-15:2016(E) ii ISO/IEC 2016 All rights reserved 8.4 Private key information objects 27 8.4.1 Priv

13、ateKeyChoice . 27 8.4.2 Private RSA key attributes . 27 8.4.3 Private elliptic curve key attributes 27 8.4.4 Private Diffie-Hellman key attributes 28 8.4.5 Private DSA key attributes . 28 8.4.6 Private KEA key attributes . 28 8.4.7 Generic private key information objects 28 8.5 Public key informatio

14、n objects 29 8.5.1 PublicKeyChoice. 29 8.5.2 Public RSA key attributes 29 8.5.3 Public elliptic curve key attributes 29 8.5.4 Public Diffie-Hellman key attributes . 30 8.5.5 Public DSA key attributes 30 8.5.6 Public KEA key attributes 30 8.5.7 Generic public key information objects . 31 8.6 Secret k

15、ey information objects . 31 8.6.1 SecretKeyChoice 31 8.6.2 Algorithm independent key attributes 31 8.6.3 GenericSecretKey type 31 8.7 Certificate information objects 31 8.7.1 CertificateChoice 31 8.7.2 X.509 certificate attributes . 32 8.7.3 X.509 attribute certificate attributes 32 8.7.4 SPKI certi

16、ficate attributes 32 8.7.5 PGP (Pretty Good Privacy) certificate attributes . 33 8.7.6 WTLS certificate attributes 33 8.7.7 ANSI X9.68 domain certificate attributes . 33 8.7.8 Card verifiable certificate attributes . 33 8.7.9 Generic certificate attributes . 34 8.8 Data container information objects

17、 34 8.8.1 DataContainerObjectChoice 34 8.8.2 Opaque data container object attributes 34 8.8.3 ISO/IEC 7816 data object attributes 34 8.8.4 Data container information objects identified by OBJECT IDENTIFIERS . 34 8.9 Authentication information objects 35 8.9.1 AuthenticationObjectChoice . 35 8.9.2 Pa

18、ssword attributes . 35 8.9.3 Biometric reference data attributes 38 8.9.4 Authentication objects for external and internal authentication . 40 8.10 Cryptographic information file, EF.CIAInfo 40 Annex A (normative) ASN.1 module . 43 Annex B (informative) CIA example for cards with digital signature a

19、nd authentication functionality . 59 B.1 General . 59 B.2 CIOs 59 B.3 Access control 60 Annex C (informative) Example topologies 62 Annex D (informative) Examples of CIO values and their encodings . 67 D.1 General . 67 D.2 EF.OD . 67 D.2.1 ASN.1 value notation 67 D.2.2 ASN.1 description, tags, lengt

20、hs and values . 68 D.2.3 Hexadecimal DER-encoding 68 D.3 EF.CIAInfo 68 D.3.1 ASN.1 value notation 68 D.3.2 ASN.1 description, tags, lengths and values . 69 D.3.3 Hexadecimal DER-encoding 69 BS ISO/IEC 7816-15:2016 ISO/IEC 7816-15:2016(E) ISO/IEC 2016 All rights reserved iii D.4 EF.PrKD 69 D.4.1 ASN.

21、1 value notation . 69 D.4.2 ASN.1 description, tags, lengths and values 70 D.4.3 Hexadecimal DER-encoding . 71 D.5 EF. CD . 72 D.5.1 ASN.1 value notation . 72 D.5.2 ASN.1 description, tags, lengths and values 73 D.5.3 Hexadecimal DER-encoding . 73 D.6 EF.AOD . 74 D.6.1 ASN.1 value notation . 74 D.6.

22、2 ASN.1 description, tags, lengths and values 74 D.6.3 Hexadecimal DER-encoding . 76 D.7 EF.DCOD. 76 D.7.1 ASN.1 value notation . 76 D.7.2 ASN.1 description, tags, lengths and values 77 D.7.3 Hexadecimal DER-encoding of DCOD . 77 D.8 Application template (within the EF.DIR) 78 D.8.1 ASN.1 value nota

23、tion . 78 D.8.2 ASN.1 description, tags, lengths and values in ApplicationTemplate . 78 D.8.3 Hexadecimal DER-encoding of ApplicationTemplate 78 D.9 GeneralizedTime encoding guidelines 78 Annex E (informative) Examples of the use of the cryptographic information application 80 E.1 General . 80 E.2 E

24、ncoding of a private key . 80 E.2.1 Cryptographic information application example description . 80 E.2.2 ASN.1 encoding of an RSA private key . 80 E.2.3 Code encoding and decoding from the ASN.1 . 81 E.2.4 BER encoding 84 E.3 Encoding of a protected data container 86 E.3.1 Cryptographic information

25、application example description . 86 E.3.2 ASN.1 encoding of the protected data container object . 86 E.3.3 Code from the ASN.1 for encoding and decoding BER 87 E.3.4 BER encoding 95 E.4 Encoding of a certificate . 95 E.4.1 Cryptographic information application example description . 95 E.4.2 ASN.1 E

26、ncoding of an X.509 certificate 95 E.4.3 Code from the ASN.1 for encoding and decoding BER 97 E.4.4 BER encoding 103 E.5 Encoding of the ESIGN cryptographic information application . 107 E.5.1 Cryptographic information application example description . 107 E.5.2 ASN.1 encoding of the IAS cryptograph

27、ic information application . 107 E.5.3 Code from the ASN.1 for encoding a decoding BER . 115 E.5.4 BER encoding 115 Bibliography 117 BS ISO/IEC 7816-15:2016 ISO/IEC 7816-15:2016(E) iv ISO/IEC 2016 All rights reserved Foreword ISO (the International Organization for Standardization) and IEC (the Inte

28、rnational Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular f

29、ields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established

30、a joint technical committee, ISO/IEC JTC 1. The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the different types of document should be noted. This docu

31、ment was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives). Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any

32、or all such patent rights. Details of any patent rights identified during the development of the document will be in the Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents). Any trade name used in this document is information given for the convenience of use

33、rs and does not constitute an endorsement. For an explanation on the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISOs adherence to the WTO principles in the Technical Barriers to Trade (TBT) see the following URL: Foreword - Supplement

34、ary information The committee responsible for this document is ISO/IEC JTC 1, Information technology, Subcommittee SC 17, Cards and personal identification. This second edition cancels and replaces the first edition (ISO/IEC 7816-15:2004), which has been technically revised. It also incorporates the

35、 Amendments ISO/IEC 7816-15:2004/Amd. 1:2007 and ISO/IEC 7816- 15:2004/Amd. 2:2008 and the Technical Corrigendum ISO/IEC 7816-15:2004/Cor. 1:2004. ISO/IEC 7816 consists of the following parts, under the general title Identification cards Integrated circuit cards: Part 1: Cards with contacts Physical

36、 characteristics Part 2: Cards with contacts Dimensions and location of the contacts Part 3: Cards with contacts Electrical interface and transmission protocols Part 4: Organization, security and commands for interchange Part 5: Registration of application providers Part 6: Interindustry data elemen

37、ts for interchange Part 7: Interindustry commands for Structured Card Query Language (SCQL) Part 8: Commands and mechanisms for security operations Part 9: Commands for card management BS ISO/IEC 7816-15:2016 ISO/IEC 7816-15:2016(E) ISO/IEC 2016 All rights reserved v Part 10: Electronic signals and

38、answer to reset for synchronous cards Part 11: Personal verification through biometric methods Part 12: Cards with contacts USB electrical interface and operating procedures Part 13: Commands for application management in a multi-application environment Part 15: Cryptographic information application

39、 BS ISO/IEC 7816-15:2016 ISO/IEC 7816-15:2016(E) vi ISO/IEC 2016 All rights reserved Introduction Integrated circuit cards with cryptographic functions can be used for secure identification of users of information systems, as well as for other core security services such as non-repudiation with digi

40、tal signatures and distribution of enciphering keys for confidentiality. The objective of this part of ISO/IEC 7816 is to provide a framework for such services based on available International Standards. A main goal has been to provide a solution that may be used in large-scale systems with several

41、issuers of compatible cards, providing for international interchange. It is flexible enough to allow for many different environments while still preserving the requirements for interoperability. A number of data structures have been provided to manage private keys and key fragments to support a publ

42、ic key certificate infrastructure and flexible management of user and entity authentication. This part of ISO/IEC 7816 is based on PKCS #15 v1.1 (see Reference 9). The relationship between these documents is as follows: a common core is identical in both documents; those components of PKCS #15 which

43、 do not relate to IC cards have been removed. This part of ISO/IEC 7816 includes enhancements to meet specific IC card requirements. BS ISO/IEC 7816-15:2016 INTERNATIONAL STANDARD ISO/IEC 7816-15:2016(E) ISO/IEC 2016 All rights reserved 1 Identification cards Integrated circuit cards Part 15: Crypto

44、graphic information application 1 Scope This part of ISO/IEC 7816 specifies an application in a card. This application contains information on cryptographic functionality. This part of ISO/IEC 7816 defines a common syntax and format for the cryptographic information and mechanisms to share this info

45、rmation whenever appropriate. The objectives of this part of ISO/IEC 7816 are to facilitate interoperability among components running on various platforms (platform neutral), enable applications in the outside world to take advantage of products and components from multiple manufacturers (vendor neu

46、tral), enable the use of advances in technology without rewriting application-level software (application neutral), and maintain consistency with existing, related standards while expanding upon them only where necessary and practical. It supports the following capabilities: storage of multiple inst

47、ances of cryptographic information in a card; use of the cryptographic information; retrieval of the cryptographic information, a key factor for this is the notion of “Directory Files”, which provides a layer of indirection between objects on the card and the actual format of these objects; cross-re

48、ferencing of the cryptographic information with DOs defined in other parts of ISO/IEC 7816 when appropriate; different authentication mechanisms; multiple cryptographic algorithms (the suitability of these is outside the scope of this part of ISO/IEC 7816). This part of ISO/IEC 7816 does not cover t

49、he internal implementation within the card and/or the outside world. It is not mandatory for implementations complying with this International Standard to support all options described. In case of discrepancies between ASN.1 definitions in the body of the text and the module in Annex A, Annex A takes precedence. BS ISO/IEC 7816-15:2016 ISO/IEC 7816-15:2016(E) 2 ISO/IEC 2016 All rights reserved 2 Normative references The follo