EN 14890-1:2008

2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.Uporabniški vmesnik za pametne kartice, ki se uporabljajo kot naprave za izdelovanje varnega podpisa - 1. del: Osnovne storitveAnwendungsschnittstelle für Chipkarten, die zur Erzeugung gesicherter Signaturen verwendet werden — Teil 1: Basis-AnforderungenInterfaces applicatives des cartes à puce utilisées pour le création de signatures électroniques sécurisées - Partie 1: Services de baseApplication Interface for smart cards used as Secure Signature Creation Devices - Part 1: Basic services35.240.15Identifikacijske kartice in sorodne napraveIdentification cards and related devicesICS:Ta slovenski standard je istoveten z:EN 14890-1:2008SIST EN 14890-1:2009en,de01-april-2009SIST EN 14890-1:2009SLOVENSKI
STANDARD
EUROPEAN STANDARDNORME EUROPÉENNEEUROPÄISCHE NORMEN 14890-1December 2008ICS 35.240.15Supersedes CWA 14890-1:2004
English VersionApplication Interface for smart cards used as Secure SignatureCreation Devices - Part 1: Basic servicesInterface applicative des cartes à puces utilisées commedispositifs de création de signature numérique sécurisés -Partie 1 : Services de basesAnwendungsschnittstelle für Chipkarten, die zur Erzeugungqualifizierter elektronischer Signaturen verwendet werden -Teil 1: Allgemeine DiensteThis European Standard was approved by CEN on 27 September 2008.CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this EuropeanStandard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning such nationalstandards may be obtained on application to the CEN Management Centre or to any CEN member.This European Standard exists in three official versions (English, French, German). A version in any other language made by translationunder the responsibility of a CEN member into its own language and notified to the CEN Management Centre has the same status as theofficial versions.CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Cyprus, Czech Republic, Denmark, Estonia, Finland,France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal,Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland and United Kingdom.EUROPEAN COMMITTEE FOR STANDARDIZATIONCOMITÉ EUROPÉEN DE NORMALISATIONEUROPÄISCHES KOMITEE FÜR NORMUNGManagement Centre: rue de Stassart, 36
B-1050 Brussels© 2008 CENAll rights of exploitation in any form and by any means reservedworldwide for CEN national Members.Ref. No. EN 14890-1:2008: ESIST EN 14890-1:2009

Device authentication — Cryptographic view.175 A.1 Algorithms for authentication with key exchange or key negotiation.175 A.2 Device authentication with key transport.175 A.2.1 Conformance to ISO/IEC 11770-3.175 A.2.2 Using min(SIG, N-SIG) for the signature token.177 A.3 Device authentication with key negotiation.178 A.3.1 Diffie-Hellman Key Exchange.179 A.4 Device authentication with privacy protection.181 A.4.1 The authenticity of the public DH parameters.183 A.5 Device authentication with non traceability.185 A.5.1 Diffie-Hellman Key Exchange.185 A.6 The “Grandmaster Chess Attack”.187 Annex B (informative)
Personalization scenarios.189 Annex C (informative)
Build scheme for mEAC Object Identifiers.191 Bibliography.193
3.1 Answer-to-Reset file elementary file which indicates operating characteristics of the card 3.2 command-response pair set of two messages: a command followed by a response 3.3 data element item of information seen at the interface for which are defined a name, a description of logical content, a format and a coding SIST EN 14890-1:2009

NOTE In this specification, data objects are referred to as BER-TLV data objects. 3.5 data unit smallest set of bits which can be unambiguously referenced 3.6 dedicated file file containing file control information and, optionally, memory available for allocation
NOTE It may be the parent of EFs and/or DFs. 3.7 DF name string of bytes which uniquely identifies a dedicated file in the card 3.8 elementary file set of data units or records which share the same file identifier
NOTE It cannot be the parent of another file. 3.9 file control parameters logical, structural and security attributes of a file 3.10 file identifier 2-bytes binary value used to address a file 3.11 master file mandatory unique dedicated file representing the root of the file structure 3.12 message string of bytes transmitted by the interface device to the card or vice-versa, excluding transmission-oriented characters as defined in ISO/IEC 7816-3 3.13 parent file dedicated file immediately preceding a given file within the hierarchy 3.14 password data which may be required by the application to be presented to the card by its user
NOTE A password in the context of this specification is a string of numbers and/or ASCII characters. 3.15 path concatenation of file identifiers without delimitation
NOTE If the path starts with the identifier of the master file, it is an absolute path. SIST EN 14890-1:2009

NOTE If the object (e.g. password entry) was used correctly (correct password entered) then the retry counter is reset to its initial value. A typical value of a retry counter is 3. 3.21 secret key either a symmetrical key or private part of a public key pair 3.22 trusted channel means by which a TSF and a remote trusted IT product can communicate with necessary confidence to support the TSP 3.23 trusted environment operating environment that avoids the fraud with data that is seen at the communication interface by the definition of its physical location, physical security protection or physical access conditions or other measures to protect from tampering or intrusion of data
NOTE
See 8.2.3. 3.24 trusted path means by which a user and a TSF can communicate with necessary confidence to support the TSP 3.25 untrusted environment operating environment that allows tampering and intrusion of data available at the communication interface
NOTE The decision whether an environment is trusted cannot always be made at the system level and therefore might have to be taken by the card holder. 3.26 usage counter counter updated each time a related object is used
NOTE Opposite to retry counters, usage counters are not reset to their initial value after the object was successfully used. SIST EN 14890-1:2009
...