The PIV applet is protected by three secrets: a PIN, a PUK, and a management key. Each of them guards a different class of operations.
The PIN is the everyday user credential. Depending on the PIN policy of each slot, it must be verified before the private key in a slot can be used for signing, decryption, or key agreement. The default PIN is 123456.
The PUK (PIN Unblocking Key) exists to recover a blocked PIN. When the PIN has been entered incorrectly too many times and is blocked, the PUK is used with the Reset Retry Counter command to set a new PIN and restore its retry counter. The default PUK is 12345678.
The management key is the administrator credential. It is a 24-byte Triple-DES key with the default value 010203040506070801020304050607080102030405060708. The management key itself can be changed with the Set Management Key command.
Entering the PIN incorrectly exhausts its retry counter, after which the PIN is blocked and operations that require it fail. A blocked PIN can be unblocked with the PUK. If the PUK is also blocked, the PIV application can be reset; the Reset command is accepted only when both the PIN and the PUK are blocked. A reset restores the PIV user data and defaults and clears writable data objects.
Operations that require management-key authentication:
Operations that require the PIN:
Operations that require the PUK: