BS EN 419212-1-2017 Application Interface for Secure Elements for Electronic Identification Authentication and Trusted Services Introduction and common definitions《用于电子识别、认证和可信服务的安.pdf

1、Application Interface for Secure Elements for Electronic Identification, Authentication and Trusted ServicesPart 1: Introduction and common definitionsBS EN 419212-1:2017BSI Standards PublicationWB11885_BSI_StandardCovs_2013_AW.indd 1 15/05/2013 15:06EUROPEAN STANDARD NORME EUROPENNE EUROPISCHE NORM

2、 EN 419212-1 September 2017 ICS 35.240.15 Supersedes EN 419212-1:2014, EN 419212-2:2014English Version Application Interface for Secure Elements for Electronic Identification, Authentication and Trusted Services - Part 1: Introduction and common definitions Interface applicative des lments scuriss u

3、tiliss comme dispositifs de cration de signature lectronique qualifie (cachet) - Partie 1 : Introduction et dfinitions communes Anwendungsschnittstelle fr sichere Elemente, die als qualifizierte elektronischer Signatur-/Siegelerstellungseinheiten verwendet werden - Teil 1: Allgemeine Dienste This Eu

4、ropean Standard was approved by CEN on 6 February 2017. CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references

5、 concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to any CEN member. This European Standard exists in three official versions (English, French, German). A version in any other language made by translation under the responsibility of a CEN memb

6、er into its own language and notified to the CEN-CENELEC Management Centre has the same status as the official versions. CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, Fra

7、nce, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and United Kingdom. EUROPEAN COMMITTEE FOR STANDARDIZATION COMIT EUROPEN DE NORMALISATION EUROP

8、ISCHES KOMITEE FR NORMUNG CEN-CENELEC Management Centre: Avenue Marnix 17, B-1000 Brussels 2017 CEN All rights of exploitation in any form and by any means reserved worldwide for CEN national Members. Ref. No. EN 419212-1:2017 ENational forewordThis British Standard is the UK implementation of EN 41

9、9212-1:2017. Together with BS EN 419212-2, BS EN 419212-3:2017, BS EN 419212-4, and BS EN 419212-5, it supersedes BS EN 419212-1:2014 and BS EN 419212-2:2014, which will be withdrawn upon publication of the rest of the series.The UK participation in its preparation was entrusted to Technical Committ

10、ee IST/17, Cards and personal identification.A list of organizations represented on this committee can be obtained on request to its secretary.This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application. The British Stand

11、ards Institution 2017 Published by BSI Standards Limited 2017ISBN 978 0 580 95127 5ICS 35.240.15Compliance with a British Standard cannot confer immunity from legal obligations. This British Standard was published under the authority of the Standards Policy and Strategy Committee on 30 September 201

12、7.Amendments/corrigenda issued since publicationDate Text affectedBRITISH STANDARDBS EN 419212-1:2017EUROPEAN STANDARD NORME EUROPENNE EUROPISCHE NORM EN 419212-1 September 2017 ICS 35.240.15 Supersedes EN 419212-1:2014, EN 419212-2:2014English Version Application Interface for Secure Elements for E

13、lectronic Identification, Authentication and Trusted Services - Part 1: Introduction and common definitions Interface applicative des lments scuriss utiliss comme dispositifs de cration de signature lectronique qualifie (cachet) - Partie 1 : Introduction et dfinitions communes Anwendungsschnittstell

14、e fr sichere Elemente, die als qualifizierte elektronischer Signatur-/Siegelerstellungseinheiten verwendet werden - Teil 1: Allgemeine Dienste This European Standard was approved by CEN on 6 February 2017. CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the

15、conditions for giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to any CEN member. This European Standard e

16、xists in three official versions (English, French, German). A version in any other language made by translation under the responsibility of a CEN member into its own language and notified to the CEN-CENELEC Management Centre has the same status as the official versions. CEN members are the national

17、standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Serbia,

18、Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and United Kingdom. EUROPEAN COMMITTEE FOR STANDARDIZATION COMIT EUROPEN DE NORMALISATION EUROPISCHES KOMITEE FR NORMUNG CEN-CENELEC Management Centre: Avenue Marnix 17, B-1000 Brussels 2017 CEN All rights of exploitation in any form and by any

19、means reserved worldwide for CEN national Members. Ref. No. EN 419212-1:2017 EBS EN 419212-1:2017EN 419212-1:2017 (E) 2 Contents Page European foreword . 5 Introduction 6 1 Scope 7 2 Normative references 7 3 Terms and definitions . 7 4 Symbols and abbreviations 15 5 Management Summary 18 5.1 Motivat

20、ion . 18 5.2 What is in behind? 19 5.3 Use Cases . 20 5.4 Privacy and Security 21 5.5 Overview - EU Directive and Regulation 21 5.6 Facts and Figures 22 Annex A (normative) Algorithm Identifiers Coding and specification . 23 Table A.1 AlgIDs . 24 Table A.2 Coding of byte 3 and 4 (for hash calculatio

21、n - byte 2 = 01 to 0F) 24 Table A.3 Coding of byte 3 (for digital signature computation - byte 2 = 1x) . 25 Table A.4 Coding of byte 4 (for digital signature computation - byte 2 = 1x) . 25 Table A.5 Coding of byte 3 (for C/S authentication - byte 2 = 2x) 25 Table A.6 Coding of byte 4 (for C/S authe

22、ntication - byte 2 = 2x) 25 Table A.7 Coding of byte 3 (for key decipherment - byte 2 = 3x) . 26 Table A.8 Coding of byte 4 (for key decipherment - byte 2 = 3x) . 26 Table A.9 Coding of byte 3 (for authentication protocol - byte 2 = 4x) 26 Table A.10 Coding of byte 4 (for authentication protocol byt

23、e 2 = 4x) 28 Table A.11 Coding of byte 3 (for digital signature verification byte 2 = 9x). 28 Table A.12 Coding of byte 4 (for digital signature verification byte 2 = 9x). 28 Table A.13 Coding of byte 3 (for role authentication byte 2 = Ax) . 29 Table A.14 Coding of byte 3 (for privacy features byte

24、 2 = Cx) . 29 Table A.15 Coding of byte 4 (for role authentication - byte 2 = Ax) 29 Table A.16 Coding of byte 4 (for privacy feature - byte 2 = Cx) 29 Table A.17 1-byte Algorithm-ID coding. 30 Annex B (informative) OID values 32 B.1 OIDs for certificate signatures . 32 Table B.1 Object identifier v

25、alues related to a public key in a certificate 32 B.2 OIDs for key transport protocol 32 BS EN 419212-1:2017EN 419212-1:2017 (E) 3 Table B.2 Object identifier values for the key transport protocol . 33 B.3 OIDs for device authentication with privacy 33 Table B.3 Object identifier values for device a

26、uthentication with privacy 33 B.4 OIDs for password based mechanisms . 34 Table B.4 PACE OIDs . 34 B.5 OIDs for mEAC protocol 34 B.5.1 OIDs for Chip Device Authentication . 34 Table B.5 Chip Device Authentication (DES/AES) 34 B.5.2 OIDs for Terminal Device Authentication 35 Table B.6 Terminal Authen

27、tication (RSA/ECDSA) . 35 B.6 OIDs for privacy protocols . 36 B.6.1 OIDs for Restricted Identification . 36 Table B.7 OIDs for Restricted Identification 36 Table B.8 OIDs for use in certificate extension . 36 B.6.2 OIDs for Restricted Identification . 36 Table B.9 OIDs for use in auxiliary data veri

28、fication 36 B.7 OIDs for mEAC based eServices - OIDs for Terminal Device Authentication in mEAC-based eServices . 36 Table B.10 OID values for the mEAC Terminal Authentication. 36 B.8 OIDs for the PCA mechanism 37 Table B.11 OID for the PCA mechanism . 37 Annex C (informative) Build scheme for objec

29、t identifiers defined by EN 419212 38 Figure C.1 Build scheme for mEAC OIDs 39 Annex D (informative) Tutorial on Signature Technology 40 D.1 General . 40 D.2 Signatures and keys . 41 Table D.1 Generating RSA keys . 42 D.3 Signing documents . 42 D.4 About certificates 43 D.5 The “chain of trust” 44 D

30、.6 Multi step signature generation 44 D.6.1 General . 44 D.6.2 Device authentication protocols . 44 D.6.3 Secure Messaging 45 D.6.4 Password based device authentication 45 D.6.5 PIN entry 45 D.7 Signing the document 46 BS EN 419212-1:2017EN 419212-1:2017 (E) 4 Annex E (informative) Guide to the EN 4

31、19212 . 47 E.1 From EN 14890 to EN 419212 47 E.2 The EU Regulation 910/2014 and the Directive 1999/93/EU . 48 E.3 Secure Elements (SE) 48 E.4 Specific protection required for contactless integrated circuits 49 E.4.1 General . 49 E.4.2 Eavesdropping attacks . 49 E.4.3 Skimming attack . 49 E.4.4 Relay

32、 attack 49 E.4.5 Denial of Service (DoS) attack . 49 E.4.6 Countermeasures . 50 E.5 The Human-Machine Interface 50 E.6 Communications with the ICC and with the user 50 E.7 Information that should be initally communicated by the ICC to the IFD . 51 E.8 User agreement using PINs . 51 E.9 PIN unlocking

33、. 52 E.10 PIN change 52 E.11 User agreement using biometric information . 52 E.12 User control using a local display and a local keyboard 52 E.13 Card applications . 53 E.13.1 General . 53 E.13.2 eSign card application 53 E.13.3 Device authentication mechanisms . 53 E.13.4 Document Decryption mechan

34、isms 53 E.14 Signature-/Seal functions 53 E.14.1 General . 53 E.14.2 Digital signature/seal creation . 54 E.14.3 Digital signature verification . 54 E.14.4 Identification and authentication service . 54 Bibliography . 56 BS EN 419212-1:2017EN 419212-1:2017 (E) 5 European foreword This document (EN 4

35、19212-1:2017) has been prepared by Technical Committee CEN/TC 224 “Furniture”, the secretariat of which is held by AFNOR. This European Standard shall be given the status of a national standard, either by publication of an identical text or by endorsement, at the latest by March 2018, and conflictin

36、g national standards shall be withdrawn at the latest by March 2018. Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. CEN shall not be held responsible for identifying any or all such patent rights. This document supersedes EN 4192

37、12-1:2014 and EN 419212-2:2014. This standard supports services in the context of electronic IDentification, Authentication and Trust Services (eIDAS) including signatures. In EN 419212-2, the standard allows support of implementations of the European legal framework for electronic signatures, defin

38、ing the functional and security features for a Secure Elements (SE) (e.g. smart cards) intended to be used as a Qualified electronic Signature Creation Device (QSCD) according to the Terms of the “European Regulation on Electronic Identification and Trust Services for electronic transactions in the

39、internal market” 2. A Secure Element (SE) compliant to the standard will be able to produce a “qualified electronic signature” that fulfils the requirements of Article of the Electronic Signature Regulation and therefore can be considered equivalent to a hand-written signature 2. This standard consi

40、sts of five parts: Part 1: “Introduction and common definitions” describes the history, application context, market perspective and a tutorial about the basic understanding of electronic signatures. It also provides common terms and references valid for the entire 419212 series. Part 2: “Signature a

41、nd Seal Services” describes the specifications for signature generation according to the eIDAS regulation. Part 3: “Device Authentication” describes the device authentication protocols and the related key management services to establish a secure channel. Part 4: “Privacy specific Protocols” describ

42、es functions and services to provide privacy to identification services. Part 5: “Trusted eServices” describes services that may be used in conjunction with signature services described in Part 2. This document has been prepared under a mandate given to CEN by the European Commission and the Europea

43、n Free Trade Association. According to the CEN-CENELEC Internal Regulations, the national standards organisations of the following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic

44、 of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and the United Kingdom. BS EN 419212-1:2017EN 419212-1:2017 (E) 6 Introductio

45、n Recipients of this draft are invited to submit, with their comments, notification of any relevant patent rights of which they are aware and to provide supporting documentation. The European Committee for Standardization (CEN) draws attention to the fact that it is claimed that compliance with this

46、 document may involve the use of a patent concerning the mapping function given in EN 419212-2, clause 8.3.6 “Step 4.2 - Map nonce and compute generator point for integrated mapping”. The patent relates to “Sagem, MorphoMapping Patents FR09-54043 and FR09-54053, 2009”. CEN takes no position concerni

47、ng the evidence, validity and scope of this patent right. The holder of this patent right has ensured CEN that he/she is willing to negotiate licences under reasonable and non-discriminatory terms and conditions with applicants throughout the world. In this respect, the statement of the holder of th

48、is patent right is registered with CEN. Information may be obtained from: Morpho 11, boulevard Gallini 92445 Issy-les-Moulineaux Cedex Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights other than those identified above. CEN shall not

49、 be held responsible for identifying any or all such patent rights. BS EN 419212-1:2017EN 419212-1:2017 (E) 7 1 Scope This part is an informative introduction into the following parts. It gives guidance to the following parts in order to allow an efficient usage of the provided information. Therefore Part 1 provides history, application context, market perspective and a tutorial about the basic understanding of electronic signatures. Clause 3 p