I had a client requirement asking me to provide an existing base64 encoded certificate in a CVC format. Could someone point me in the right direction here to understand what this format is? How can I convert an x509 certificate to CVC format and the tools to achieve this, please? thanks.

  • 4
    $\begingroup$ In my experience, Card Verifiable Certificate format is highly application-dependent. It won't be the same for an EMV card, an ID card, a Digital Tachograph card. The specification for the particular application should tell the expected format of the CVC. If what you are asked is possible, it most likely means first removing the base64 wrapper (going back to a sequence of bytes), then perhaps removing some constant ASN.1 format bytes or/and converting from ASN.1 variable-size integers to fixed-size integers by removing/adding padding bytes. The CVC spec will tell the expected output format. $\endgroup$
    – fgrieu
    Apr 24 '18 at 15:58

A Card Verifiable Certificate (CVC) is a certificate that has been created with validation and verification on smart cards in mind. These cards are extremely small System on Chips, with RAM, persistent memory (flash or EEPROM) and ROM.

So basically it's the same as a normal certificate, but it doesn't contain as many bells and whistles, as the bells and whistles it does have are generally minimized as well.

There are some standards for CVC's but generally they are not complied to so you will have to look up the specific protocol to know how the certificate is encoded.

Things you should expect:

  • a non-standard certificate format
  • a flattened DER encoded structure (sometimes just a single sequence with child elements)
  • specialized DER tags
  • the use of octet strings over integers or bit strings (smaller encoding)
  • short date formats for the date of issuance and date of expiry
  • few if any personal details
  • a simplified / shorter scheme for subject / issuer identification
  • for ECDSA: flattened signature format (i.e. statically sized R & S)
  • for RSA: signatures with message recovery (ISO / IEC 9796)
  • signatures over all of the other elements (so the signature can be updated / verified in a single operation)
  • simplified encoding of the public key (e.g. without algorithm specification)

Sometimes the certificate contains an OID that specifies the specific scheme and versioning information. In that case you could try and find the protocol required.

As for your question:

  • Base 64 is not a certificate format, it's an encoding format.
  • You cannot just convert an existing X.509 certificate to CVC because the signature would not be valid - even if you knew which ASN.1 elements to copy / convert.
  • There is no generic standard that is commonly used, so there are no generic tools - you'd need specialized tools and - of course - the private key of the issuer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.