Choices of PIV algorithm Identifiers conflicts

[dengert]

I am the OpenSC developer of the PIV driver and starting to add support for the Nitrokey 3A. There exists some discrepancies for the choices of Algorithm Identifiers in Nitrokey PIV and other vendors choices. If it is not too late, could these be changed in next firmware update?
The Nitrokey PIV code still appears to be experimental.

https://github.com/trussed-dev/piv-authenticator/blob/main/src/piv_types.rs#L88-L116

and in these documents:
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-78-5.pdf
used for versions of NIST 800-73.

https://globalplatform.org/wp-content/uploads/2014/03/GPC_ISO_Framework_v1.0.pdf#page=15

https://developers.yubico.com/PIV/Introduction/YubiKey_and_PIV.html
"9C, 9D, 9E: RSA 1024, RSA 2048, ECC secp256r1, or secp384r1 keys (algorithms 06, 07, 11, 14 respectively). YubiKeys with firmware 5.7 and up also support RSA 3072, RSA 4096, Ed25519, and X25519 keys (algorithms 05, 16, E0, E1, respectively"

• RSA 3072 was define as 0x05 in early NIST 800-73 documents and is back in SP800-78-5 (2024) "Table 9. Identifiers for supported cryptographic algorithms" and will most likely be added to next version 800-73 as 0x05. Yubikey and possibly other PIV applets will use 0x05. I would suggest 0x05 be used in Nitrokey PIV.

• RSA 4096 in Yubikey uses 0x16, (not sure why the picked 0x16). But Nitrokey PIV uses 0xE1

• 0xE0 Nitrokey is using it for RSA 3072, Yubikey uses it for Ed25519

• 0xE1 Nitrokey is using it for RSA 4096, Yubikey uses it for X25519

• 0xE2, 0xE3, 0xE4 and 0xE5 are only by Nitrokey for Ed25519, X25519, Ed448, and X448

Although the 0xE* appear to be vendor definable you know Yubikey will evential use 0xE2... A good choice is for Nitrokey to use the Yubikey version reserving 0xE2 for Ed448 and 0xE3 for Ed448

If NIST (who defines PIV), NitroKey and Yubikey could agree on these it would make things easier.

(I am going send a URL of this issue to NIST as they may have some ideas.)

An Microsoft might also pick these up too.