Skip to main content
U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Symmetric Key Injection onto Smart Cards



David A. Cooper, William I. MacGregor


This paper describes architectures for securely injecting secret keys onto smart cards. Specifically, this paper details key injection architectures based on the identity credentials available on the Personal Identify Verification (PIV) Card. The primary goal is to create additional opportunities for the use of the PIV Card in Physical Access Control Systems (PACS). There is significant interest in conducting a fast, accurate, and highly secured authentication transaction using symmetric keys in PACS environments. This paper identifies ways to load site specific symmetric keys onto a PIV Card after the card has been issued, which allows each smart card to share a unique secret key with each PACS with which it interacts. The paper presents four protocols that enable a Card Management System (CMS) to securely load site-specific PACS symmetric keys. Each protocol presents unique security characteristics and uses the PIV Card's card management key in different capacities.
NIST Interagency/Internal Report (NISTIR) - 7539
Report Number


card authentication key, cryptographic key management, FIPS 201, HSPD-12, PACS, Personal Identity Verification, Physcial Access Control Systems, PIV, smart cards


Cooper, D. and MacGregor, W. (2008), Symmetric Key Injection onto Smart Cards, NIST Interagency/Internal Report (NISTIR), National Institute of Standards and Technology, Gaithersburg, MD, [online], (Accessed May 18, 2024)


If you have any questions about this publication or are having problems accessing it, please contact

Created December 22, 2008, Updated November 10, 2018