The asymmetric key slots are intended for different kinds of cryptographic operations:
| Slot | Intended use |
|---|---|
| 9A (PIV Authentication) | Authenticating the user, usually for system login |
| 9C (Digital Signature) | Signing emails, files, executables, git commits, etc. |
| 9D (Key Management) | Encryption for confidentiality, e.g. decrypting emails |
| 9E (Card Authentication) | Authenticating the card, usually for building access |
| 82–95 (Retired Key Management) | Decrypting older data encrypted to keys with expired certificates |
Signing is not restricted to slot 9C: the keys in slots 9A, 9D, 9E, and 82–95 can sign as well. Slot 9B holds a symmetric key and cannot sign; slot F9 signs only attestation statements.
Slot 9D is used for decryption with RSA keys and for ECDH key agreement with EC keys.
ECDSA signatures are returned in ASN.1 DER encoding, as required by the PIV standard.
Whether an operation prompts for the PIN, a touch, or both is governed by the PIN and touch policies configured for the slot. For example, with the default policies, signing with slot 9C requires PIN verification for every use, while slot 9A requires it only once per session. Touch requirements apply only over USB and are not enforced over NFC. The policies in effect on a device can be read from its metadata.