Skip to content

R10 — PIV, certificates, OpenSC and PC/SC

Status: NOT EXECUTED as a complete hardware procedure — T2B1 and T3B1.

Use the shared acceptance record, with a separate result for every required model/OS. Host and emulator output remains separate evidence.

Preconditions

R01 passed; PC/SC/OpenSC on macOS/Windows/Linux; standard PIV client; disposable certificate matching the generated public key; no production certificate.

Steps

  1. Run opensc-tool --list-readers, pkcs15-tool --dump and yubico-piv-tool -r "" -a status. Change the initial PIN/PUK/management key from the menu and keep the replacement key private for host tools.
  2. Under Cryptography → PIV → Identities generate P-256 in 9A/9C/9D/9E. Load each matching certificate through PUT DATA using piv-tool or yubico-piv-tool and ../protocols/piv.md. Compare SPKI and the on-device fingerprint.
  3. Sign a digest through OpenSC/PKCS#11 and verify independently. Exercise a 9E challenge-response and 9D ECDH, verifying results independently. Refuse one signature and let another time out.
  4. Use the 9A certificate in a real test TLS client exchange, with a campaign CA/server. The server must verify the expected certificate and identity; retain configuration and logs.
  5. Repeat RSA-2048 generation/signature, compressed certificates if used, PIN/PUK changes, counters and targeted deletion. Regeneration must remove the old certificate. Verify 9C consumes its PIN verification on every use and policies cannot be weakened below their default.
  6. Repeat applicable operations on all three OSes. Detection of a virtual reader does not substitute for these tests.

Expected result

Common PIV applications work; certificates match keys; signatures/challenges/TLS verify; physical consent is required; PIN/slot/policies are isolated; refusal produces no signature. Do not invent FIPS certification or manufacturer attestation.

Evidence to retain

Tool/module versions, public certificate and SPKI/fingerprint, redacted APDUs, verification/server TLS results by model/OS. Never publish management keys or PINs.