PIV (Personal Identity Verification) is defined by the US federal government FIPS 201 standard. PIV can store keys and certificates for signing and encryption, enabling functions such as digital signatures and file encryption.
Firmware version 3.0.0 and later also support the following extended algorithms:
| Algorithm Name | Algorithm ID |
|---|---|
| RSA3072 | 05 |
| RSA4096 | 16 |
| secp256k1 | 53 |
| Ed25519 | E0 |
| X25519 | E1 |
| SM2 | 54 |
Firmware version 3.1.1 adds NIST P-521 (secp521r1, algorithm ID 15). Management software can read the extended algorithm IDs currently used by the device; use the values returned by the device.
CanoKey firmware version 3.0.0 only supports signing 32-byte data using Ed25519 and only supports internally generated X25519 keys. Firmware version 3.0.2 and later are not affected by these limitations.
010203040506070801020304050607080102030405060708On firmware version 3.1.1 and later, the 24-byte management key uses AES-192 (algorithm ID 0A).
CanoKey supports the following key slots:
Firmware version 2.0.0 adds Retired Key Management slots 82 and 83.
Firmware version 3.1.1 and later support all Retired Key Management slots from 82 through 95. These slots and their certificate objects are created only when used and consume available device storage.
Starting from firmware version 2.0.0, CanoKey supports configuring PIV PIN and touch policies.
| Key Slot | Default PIN Policy | Default Touch Policy |
|---|---|---|
| 9E | Never | Never |
| 9C | Always | Never |
| 9A, 9D, 82-95 | Once | Never |
The default shown for slot 9C applies to firmware version 3.1.1 and later. Defaults may differ on older firmware; read the PIV metadata to determine the policies in use on a device.
Firmware version 3.1.1 and later support all Retired Key Management certificate objects. Reading Printed Information, fingerprints, facial images, or iris images requires PIN verification. Writing these objects requires management-key authentication. Optional objects consume storage only after data is written to them.
Starting from firmware version 2.0.0, CanoKey supports viewing PIV metadata.
Firmware version 3.1.1 and later support:
INS F9). Slot F9 must contain a provisioned P-256 attestation key, and its certificate must be stored in data object 5FFF01. A PIV application reset preserves both items. Imported keys cannot be attested.INS F6). The corresponding certificates are not moved or deleted with the keys.As PIV is typically issued by system administrators and used by regular users, please review the documentation to understand the following content before proceeding.
It is recommended to use yubico-piv-tool for related operations.
If the key and certificate are in two separate files, they need to be imported separately.
Importing the private key:
yubico-piv-tool -r canokey -a import-key -s 9a -i private-key.pem
Importing the certificate:
yubico-piv-tool -r canokey -a import-certificate -s 9a -i certificate.pem
Here, -s 9a indicates using the 9A key slot, which can be changed as needed.
To import a PKCS#12 file (.p12 or .pfx) containing both the private key and certificate, execute:
yubico-piv-tool -r canokey -a import-key -a import-certificate -K PKCS12 -s 9a -i certificate.p12
Generate a new private key and self-sign it:
yubico-piv-tool -r canokey -a generate -s 9a -A RSA2048 -o public-key.pem
yubico-piv-tool -r canokey -a verify-pin -a selfsign -s 9a -S "/CN=Test Certificate" -i public-key.pem -o certificate.pem
yubico-piv-tool -r canokey -a import-certificate -s 9a -i certificate.pem
Since Windows caches certificate information based on CHUID, you need to update the CHUID after certificate import on Windows:
yubico-piv-tool -r canokey -a set-chuid