CEN TS 15480-2-2012 Identification card systems - European Citizen Card - Part 2 Logical data structures and security services《身份证系统 欧洲公民卡 第2部分 逻辑数据结构和安全服务》.pdf

1、raising standards worldwideNO COPYING WITHOUT BSI PERMISSION EXCEPT AS PERMITTED BY COPYRIGHT LAWBSI Standards PublicationIdentification card systems European Citizen CardPart 2: Logical data structures and security servicesPD CEN/TS 15480-2:2012National forewordThis Published Document is the UK imp

2、lementation of CEN/TS 15480-2:2012.It supersedes DD CEN/TS 15480-2:2007 which is withdrawn.The UK participation in its preparation was entrusted to Technical CommitteeIST/17, Cards and personal identification.A list of organizations represented on this committee can be obtained onrequest to its secr

3、etary.This publication does not purport to include all the necessary provisions of acontract. Users are responsible for its correct application. The British Standards Institution 2012Published by BSI Standards Limited 2012ISBN 978 0 580 75764 8ICS 35.240.15Compliance with a British Standard cannot c

4、onfer immunity fromlegal obligations.This Published Document was published under the authority of the PolicyStandards Policy and Strategy Committee on 31 July 2012.Amendments issued since publicationAmd. No. Date Text affectedPUBLISHED DOCUMENTPD CEN/TS 15480-2:2012TECHNICAL SPECIFICATION SPCIFICATI

5、ON TECHNIQUE TECHNISCHE SPEZIFIKATION CEN/TS 15480-2 June 2012 ICS 35.240.15 Supersedes CEN/TS 15480-2:2007English Version Identification card systems - European Citizen Card - Part 2: Logical data structures and security services Systmes de cartes didentification - Carte Europenne du Citoyen - Part

6、ie 2: structures de donnes logiques et services de scurit Identifikationskartensysteme - Europische Brgerkarte - Teil 2: Logische Datenstrukturen und SicherheitsfunktionenThis Technical Specification (CEN/TS) was approved by CEN on 9 January 2012 for provisional application. The period of validity o

7、f this CEN/TS is limited initially to three years. After two years the members of CEN will be requested to submit their comments, particularly on the question whether the CEN/TS can be converted into a European Standard. CEN members are required to announce the existence of this CEN/TS in the same w

8、ay as for an EN and to make the CEN/TS available promptly at national level in an appropriate form. It is permissible to keep conflicting national standards in force (in parallel to the CEN/TS) until the final decision about the possible conversion of the CEN/TS into an EN is reached. CEN members ar

9、e the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Ro

10、mania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and United Kingdom. EUROPEAN COMMITTEE FOR STANDARDIZATION COMIT EUROPEN DE NORMALISATION EUROPISCHES KOMITEE FR NORMUNG Management Centre: Avenue Marnix 17, B-1000 Brussels 2012 CEN All rights of exploitation in any form and by any means

11、 reserved worldwide for CEN national Members. Ref. No. CEN/TS 15480-2:2012: EPD CEN/TS 15480-2:2012CEN/TS 15480-2:2012 (E) 2 Contents Page Foreword 41 Scope 52 Normative references 53 Terms and definitions .64 Abbreviations .74.1 Abbreviations .74.2 Coding conventions and notation95 Data elements an

12、d data structures . 105.1 Supported data Structures 105.2 Access to data structures 105.3 Answer to reset (ATR) / answer to select (ATS) 115.4 General architecture and file supported 155.5 Selection of data structures 165.6 Access to files . 176 Basic card services 186.1 General . 186.2 Identificati

13、on 186.3 User verification 206.4 Device authentication . 206.5 Digital signature 236.6 Client/Server Authentication . 246.7 Encryption key decipherment . 247 Extended card services 257.1 General . 257.2 Biometrics on card matching . 257.3 Passive Authentication 257.4 Basic Access Control . 257.5 Act

14、ive Authentication . 257.6 Extended Access Control 267.7 Role authentication. 267.8 Restricted Identification (RI) 277.9 Age, Validity or Auxiliary Data Verification 287.10 Modular Enhanced Role Authentication (mERA) 28Annex A (normative) Command set 29A.1 CLASS byte coding. 29A.2 Command chaining m

15、echanisms 29A.3 Extended length mechanism . 30A.4 Logical channels . 31A.5 Short and extended length fields 31A.6 Status words . 31A.7 Command set 32Annex B (normative) Cryptographic Information Application . 54B.1 Description 54B.2 CIA data organisation . 63Annex C (normative) Mandatory features 83

16、C.1 General . 83C.2 Data elements and data structures . 83PD CEN/TS 15480-2:2012CEN/TS 15480-2:2012 (E) 3 C.3 Card services . 84C.4 Command set . 84C.5 Device Authentication and Key Derivation . 85C.6 Digital signature 85C.7 Client/Server Authentication 86C.8 Encryption Key Decipherment . 86Annex D

17、(informative) Optional features 87D.1 General . 87D.2 Data elements and data structures 87D.3 Card services . 88D.4 Command set . 88D.5 Device Authentication and Key Derivation . 89D.6 Digital signature 89Annex E (informative) Application Profiles 90E.1 General . 90E.2 Application Profile 1: ICAO Ap

18、plication with EAC features 90E.3 Application Profile 2: Travel Document Application . 96E.4 Application Profile 3: eID Application . 101E.5 Application Profile 4: Digital Signature Application 111E.6 E.6 Application Profile 5: eServices Application using a trusted third party 121E.7 Application Pro

19、file 6: Health Insurance Application 136E.8 Application Profile 7: Combined eID and signature application 152E.9 Application Profile 8: Multi-Service application . 156Annex F (informative) Access rules in expanded format 161F.1 Object protection by access rules in expanded format 161F.2 Access rules

20、 in expanded format 161F.3 Security attribute referencing expanded format 162F.4 Security attribute template for physical interfaces 163Annex G (informative) Example of data structure: the Security Data Objects concept 164G.1 SDO concept 164Bibliography 176PD CEN/TS 15480-2:2012CEN/TS 15480-2:2012 (

21、E) 4 Foreword This document (CEN/TS 15480-2:2012) has been prepared by Technical Committee CEN/TC 224 “Personal identification, electronic signature and cards and their related systems and operations”, the secretariat of which is held by AFNOR. Attention is drawn to the possibility that some of the

22、elements of this document may be the subject of patent rights. CEN and/or CENELEC shall not be held responsible for identifying any or all such patent rights. This document supersedes CEN/TS 15480-2:2007. CEN/TS 15480 Identification card systems European Citizen Card consists of the following four p

23、arts: Part 1, Physical, electrical and transport protocol characteristics Part 2, Logical data structures and card services Part 3, European Citizen Card Interoperability using an application interface Part 4, Recommendations for European Citizen Card issuance, operation and use According to the CEN

24、/CENELEC Internal Regulations, the national standards organisations of the following countries are bound to announce this Technical Specification: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia

25、, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and the United Kingdom. PD CEN/TS 15480-2:2012CEN/TS 15480-2:2012 (E) 5 1 Scope This Technical Specification specifies the logical characteristics and security featu

26、res at the card/system interface for the European Citizen Card. The European Citizen Card is a smart card with Identification, Authentication and electronic Signature (IAS) services. Therefore: the supported services are specified; the supported data structures as well as the access to these structu

27、res are specified; the command set is defined. This Technical Specification aims to ensure the interoperability at card/system interface in the usage phase. In order to reach the interoperability objective, IAS services are compliant with EN 14890 Part 1 and Part 2. As the EN documents offer options

28、, this specification fully defines a complete profile. This Technical Specification also considers ICAO Doc 9303. This Technical Specification does not mandate the use of a particular technology, and is intended to allow both native and Java card technologies. This specification encompasses mandator

29、y and optional features. Optional features make up a toolbox of modular options from which issuers can pick up the necessary protocols to fulfil the requirements for use. Mandatory features shall be implemented for a smart card to be compliant with this Technical Specification. Mandatory features re

30、quired for compliancy to ECC specification are given in Annex C, the optional features are given in Annex D. Two IAS-enabled smart cards issued by two different issuers, and compliant with this Technical Specification but implementing different application profiles out of this Technical Specificatio

31、n, can interoperate with a terminal provided that such a terminal supports both application profiles. Therefore, interoperability requires a specific agreement between issuers/governments in order to determine which cross-border services are to be shared, and consequently, which protocols are to be

32、supported by the terminals in each country. All the APDU commands described in this Technical Specification are in accordance with ISO/IEC 7816 Part 4 or Part 8. They are fully described here in order to provide the settings adopted by this specification and to prevent any ambiguity in case of sever

33、al possible interpretations of the standards. For physical, electrical and transport protocol characteristics, refer to CEN/TS 15480-1. 2 Normative references The following documents, in whole or in part, are normatively referenced in this document and are indispensable for its application. For date

34、d references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. EN 14890-1:2008:2008, Application Interface for smart cards used as Secure Signature Creation Devices Part 1: Basic requirements ISO/IEC 7816-3, Inf

35、ormation technology Identification cards Integrated circuit(s) cards with contacts Part 3: Electronic signals and transmission protocols ISO/IEC 7816-4:2005, Identification cards Integrated circuit(s) cards Part 4: Organisation, security and commands for interchange PD CEN/TS 15480-2:2012CEN/TS 1548

36、0-2:2012 (E) 6 ISO/IEC 7816-4:2005/PDAM 2.1:2008, Identification cards Integrated circuit(s) cards Part 4: Organisation, security and commands for interchange, AMENDMENT 2: Handling of Extended Length Information (Working Draft) ISO/IEC 7816-11, Identification cards Integrated circuit cards Part 11:

37、 Personal verification through biometric methods ISO/IEC 7816-15, Identification cards Integrated circuit cards with contact Part 15: Cryptographic information application ISO/IEC 7816-15:2004/Amd 1:2007, Identification cards Integrated circuit cards with contact Part 15: Cryptographic information a

38、pplication, AMENDMENT 1: Examples of the use of the cryptographic information application ISO/IEC 7816-15:2004/Amd 2:2008, Identification cards Integrated circuit cards with contact Part 15: Cryptographic information application, AMENDMENT 2: Error corrections and extensions for multi-application en

39、vironments ISO/IEC 9796-2, Information technology Security techniques Digital signature schemes giving message recovery Part 2: Integer factorisation based mechanisms ISO/IEC 14443-4, Identification cards Contactless integrated circuit(s) cards Proximity cards Part 4: Transmission protocol ISO/IEC 1

40、9794-2, Information technology Biometric data interchange formats Part 2: Finger minutiae data ANSI X9.63, Public Key Cryptography For the Financial Services Industry: Key Agreement and Key Transport Using Elliptic Curve Cryptography, January 8th1999 BSI TR-03110 Version 1.11, Advanced Security Mech

41、ansims for Machine Readable Travel Documents Extended Access Control (EAC) BSI TR-03111 Version 1.11, Technical Guideline Elliptic Curve Cryptography ICAO Doc 9303, Machine Readable Travel Documents, Part 3 Machine Readable Official Travel Documents Volume 2 Specifications for Electronically Enabled

42、 MRtds with Biometric Identification Capability, Third Edition, 2008 3 Terms and definitions For the purposes of this document, the following terms and definitions apply. 3.1 Application Dedicated File (ADF) structure hosting an application in a card 3.2 root Master File MF in case of a native opera

43、ting system, the applet instance having the default selection privilege in case of a Java card implementation PD CEN/TS 15480-2:2012CEN/TS 15480-2:2012 (E) 7 4 Abbreviations 4.1 Abbreviations ADF Application Dedicated File AID Application Identifier AMB Access Mode Byte AT Authentication Template AT

44、R Answer to Reset ATS Answer to Select BER Basic Encoding Rules BHT Biometric Header Template BIT Biometric Information Template CA Certification Authority CAR Certification Authority Reference CCT Cryptographic Checksum Template CED Certificate Effective Date CHA Certificate Holder Authorisation CH

45、R Certificate Holder Reference CIA Cryptographic Information Application CPI Certificate Profile Identifier CRT Control Reference Template CT Confidentiality Template CV Card Verifiable CXD Certificate Expiration Date DES Data Encryption Standard DF Dedicated File DH Diffie Hellman DOCP Data Object

46、Control Parameters DST Digital Signature Template ECDH Elliptic Curve DH PD CEN/TS 15480-2:2012CEN/TS 15480-2:2012 (E) 8 ELC Elliptic Curve Cryptosystem ECDSA Elliptic Curve Digital Signature Algorithm EF Elementary File FCI File Control Information FCP File Control Parameters HT Hash Template IAS I

47、dentification, Authentication and electronic Signature ICC Integrated Circuit Card IFD Interface Device KAT Control reference template for key agreement LSB Least Significant Byte MAC Message Authentication Code MF Master File MSE Manage Security Environment OID Object Identifier PAN Primary Account

48、 Number PIN Personal Identification Number PK DH Public key Diffie Hellman (asymmetric key base algorithm) PSO Perform Security Operation RFU Reserved for Future Use RSA Rivest Shamir Adleman SDO Security Data Object SCB Security Condition Byte SE Security Environment SEID Security Environment IDentifier byte SM Secure Messaging TLV Tag Length Value UQB Usage Qualifier Byte PD CEN/TS 15480-2:2012CEN/TS 15480-2:2012 (E) 9 4.2 Coding conventions and notation 4.2.1 Coding conventions The following