Frequently asked questions

The important development of the Common AMC obliges us, as a structure responsible for governance and security, to be more vigilant and rigorous. This is why we remind you that any public or private organization that intervenes in the issuance of a common MCA (manufacturer), or that uses the common MCA (User Entity), whatever the use, must sign a usage agreement with ADCET and thus be referenced by our association. Moreover, the functioning of a project around the Common AMC is only possible insofar as ADCET mobilizes the means necessary to support, develop, secure and govern the Common AMC, which represents a significant expense.

Consequently, the agreement may be granted free of charge, provided that the Relying Party and/or the manufacturer is a member of ADCET and is up to date with its dues.

If the User and/or the manufacturer does not wish to join the ADCET or is not up to date with its membership fees, a fee must be paid, by annex to the agreement to be established between the ADCET, the User and/or the manufacturer.

We would be grateful if you could communicate this information to any third party that you may meet in the context of a project around the common AMC. As a member, it is also your responsibility to contribute to ensuring that each third party partner is registered as an organization with ADCET and in particular to remind this obligation in the calls for tender and contracts that you will have to sign with third parties concerning the use and/or production of the Common AMC.

Furthermore, it is reminded that the logo of the common AMC must appear on any support integrating the common AMC. If, at first, there may have been exceptions and factual derogations to this rule, it is now necessary to regularize the situation without delay.

In this sense, we ask that each card manufacturer provide us with a visual for validation, before any new production. If the logo is not present, ADCET will have to oppose the production of these cards.

Finally, it is also reminded that the specification of the AMC standard cannot be distributed but that each entity wishing to know about it must acquire it on the AFNOR website (https://www.boutique.afnor.org/norme/nf-p99-508/services-de-vie-quotidienne-application-multiservices-citoyenne-amc/article/938347/fa199961).

We remain at your disposal.

Matthieu Theurier

President

Link to this question : What are the rules for using the common-amc? (direct address of this question)

Yes, because as any ISO7816-5 compliant Calypso Rev.3 application, each AMC (common and specific) has its own application name (AID), so it can cohabit with one or more other AMCs in the same media.

Link to this question : Can a common AMC and a specific AMC coexist in the same medium? (direct address of this question)

T-DES keys will be used to manage access to OGD files and to calculate the values of predefined identifiers. An ECDSA key will be used to calculate the signature of the predefined identifiers.

Link to this question : Which cryptographic algorithm (DES-X or T-DES) is used for the AMC application keys? (direct address of this question)

AMC private keys are usually only transmitted to the embedders. The procedure is to be decided on a case-by-case basis (e.g. via OpenPGP secure mechanism). In the case of the common AMC, ADCET is in charge of transmitting the keys to the encoder on request of the community in charge of the services. In the case of a specific AMC, the community transmits its keys to the encoder.

In technical terms there are 2 groups of keys:

Group1 (in a SAM) :

• The 3 keys to be loaded in the Calypso application

• The MAC signature key

• The 3DES encryption key

Group 2 (outside SAM, transmitted securely) :

• The secret/private key pair, for signing predefined identifiers

• The 3DES key for calculating predefined identifiers

Link to this question : What is the procedure for transmitting AMC private keys? (direct address of this question)

Nine keys for managing the predefined identifiers of the common AMC have been generated and are held by ADCET:

• three TDES keys, to calculate the identifier values;
• three private ECDSA keys, to generate the signatures;
• three public ECDSA keys, matching the private keys, to verify the signatures.

In each group, one key is used for identifiers on AMC media, one for virtual AMCs, and the third is a reserve key. The key references (PIDXKeyRef, PIDSignKeyReference) and the public keys are provided by ADCET on request to amc-register@adcet.org.

Link to this question : What are the keys for the predefined common AMC identifiers? (direct address of this question)

• For the keys loaded into the application: the France interoperable test keys.
• For data MAC management (such as custom identifiers): the corresponding France interoperable test key.
• For encrypting and decrypting personal data (photo, name): the corresponding France interoperable test key.
• For predefined identifier management: the example keys of the NF P 99-508 standard, i.e. the TDES identifier calculation key of Annex A.1 and the ECDSA authentication keys of Annex A.4.

The identifiers (KIF and KVC) and references of these test keys are provided on request to amc-register@adcet.org.

Link to this question : What are the recommended test keys, specifically for the common AMC? (direct address of this question)

Link to this question : Key identifiers/references (direct address of this question)

Link to this question : How are the predefined identifiers calculated? (direct address of this question)

Considering all the AMCs issued within a given service area, the uniqueness of a predefined identifier is guaranteed by the combination of the following fields:

• PIDXSector (2 bytes), which defines the service area;
• PIDXKeyRef (2 bytes), which designates the TDES key used to calculate identifiers from a root value;
• PIDXValue (4 bytes), the value calculated from that key and a root value.

Uniqueness is ensured by following the rules defined for choosing the values of PIDXSector, PIDXKeyRef and PIDXValue. Within a given information system, PIDXKeyRef or PIDXSector may be omitted if they are the same for all the AMCs managed by that system.

For the common AMC, to use one of the ranges in the Common AMC value ranges registry, the predefined identifiers data structure must contain:

• the PIDScopeID of the common AMC;
• the PIDXKeyRef of the common TDES key for identifiers on AMC media, provided by ADCET with the key.

Whoever produces the predefined identifiers must also only use values within the ranges allocated to them by ADCET.

Important — uniqueness and non-correlation rule: the issuer of the predefined identifiers (given by PIDIssuerReference) guarantees that each value it generates is used only once for a given sector of activity, and that an identifier cannot be deduced from knowledge of one or more other AMC identifiers.

The value generation principles used for the common AMC, and recommended for specific AMCs, are as follows:

• the issuer of predefined identifiers has a full 4-byte range of values (over 4 billion possible values), which it may subdivide as it wishes, for example into smaller ranges assigned to different subcontractors or projects, provided they do not overlap;
• a triple-DES (TDES) key, managed by the governance of the service area (ADCET for the common AMC), is used. This key must remain confidential, as it would make it possible to predict AMC application numbers: only the entities that generate identifiers need to know it.

Link to this question : How is the uniqueness of the identifiers guaranteed? (direct address of this question)

In order to comply with CNIL recommendations, the card bears several identifiers (from 1 to 10: these identifiers are reserved for public services corresponding to a sector of activity defined by the CNIL):

1 Taxation Tax or fee for household waste collection. Tourist tax.

2 Labor and social services Employment exchange. Apprenticeship. Professional training. Application for internships and jobs. Management of social aid (application, allocation and follow-up) in the following areas

application for housing and/or assistance ;

grants ;

personalized autonomy allowance

aid for the disabled;

active solidarity income.

3 Health Maternal and child protection. Vaccination plan. Heat wave plan. Warning and protection plan for the population.

4 Transport: Registration, monitoring and online payment of school or municipal services, individual or public transport (bicycle, car, bus, etc.) Information on traffic conditions.

5 Civil status and citizenship Request for extracts or copies of civil status records, family record book. Registration for the defense and citizenship day/compulsory citizen census. Registration on electoral lists. Notification of change of address. Certificate of reception. Authorization to leave the territory. Application for identity, travel or residence permits.

6 Relations with elected officials Municipal communication. User relations with elected officials (request for an appointment, etc.).

7 School and extracurricular services, sports and socio-cultural activities Management of files (registration, follow-up and online payment) in the following areas

leisure center without accommodation ;

tourist services ;

vacation center ;

school ;

day-care center;

School catering ;

sports activities (municipal swimming pool, sports hall, etc.);

socio-cultural activities (library, media library, museum, reservation of municipal hall);

training for adults ;

rental of municipal halls or equipment;

meals on wheels.

8 Economy and town planning Registration of the activity in the socio-economic directory. Aid to businesses. Request for business premises.

Management of files (application, allocation, follow-up and online payment) in the following areas: water and sanitation; building permits; development permits; demolition permits; town planning certificates; individual alignment orders.

Declaration: of completion of works; of opening of a building site; of intention to sell.

9 Special policies and roads; Temporary authorization of a drinks shop. Declaration of first or second category dog. Certificate of change of address. Payment, subscription or parking permit. Market/fair site. Access to pedestrian areas. Lost and found. Notification of noise, odor or visual nuisance. Request for intervention on the public domain (maintenance of green space, public lighting, graffiti, container, etc.). Cemetery (allocation of burial plot). Filming of films.

10 User relations User relations with the services (request for an appointment, etc.).

Registration for the ceremony for new residents.

Exercise of data protection rights (request for information, rectification, deletion, etc.).

11 Services for agents (agent card)

12 Student life services (student catering, access to premises and services reserved for students: libraries, student residences, computer rooms, etc.)

13 Loyalty and commerce

14 Mobility (Maas) mobility actions grouping either public or private transport around a single account

15- 19 Reserved for future definition PUBLIC SERVICES

20 Personal services

21 Private transport

22 Payments

23 Social networks

24 Sports, cultural and leisure activities

25 Loyalty program (outside the “city center” context)

26 to 35: RFU

Link to this question : What are the predefined sectors and identifiers (direct address of this question)