BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4.2.1 Cardholder Unique Identifier (CHUID)

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 4 PIV Front-End Subsystem part of 4.2

Title

Cardholder Unique Identifier (CHUID)

Control changed

Before · FIPS 201-2

The PIV Card shall include the CHUID as defined in [SP 800-73]. The CHUID includes the Federal Agency Smart Credential Number (FASC-N) and the Global Unique Identification Number (GUID), which uniquely identify each card as described in [SP 800-73]. The value of the GUID data element shall be a 16-byte binary representation of a valid Universally Unique IDentifier (UUID) [RFC4122]. The CHUID shall also include an expiration date data element in machine-readable format that specifies when the card expires. The expiration date format and encoding rules are as specified in [SP 800-73].

The CHUID shall be accessible from both the contact and contactless interfaces of the PIV Card without card activation. The FASC-N, UUID, and expiration date shall not be modified post-issuance.

This Standard requires inclusion of the asymmetric signature field in the CHUID container. The asymmetric signature data element of the CHUID shall be encoded as a Cryptographic Message Syntax (CMS) external digital signature, as specified in [SP 800-73]. Algorithm and key size requirements for the asymmetric signature and digest algorithm are detailed in [SP 800-78]. For signatures created before October 15, 2015, the public key required to verify the digital signature shall be provided in the certificates field of the CMS external digital signature in a content signing certificate, which shall be an X.509 digital signature certificate issued under the id-fpki-common-piv- contentSigning, id-fpki-common-devices, id-fpki-common-devicesHardware, id-fpki-common-hardware, or id-fpki-common-High policy of [COMMON]. 22 For signatures created on or after October 15, 2015, the public key required to verify the digital signature shall be provided in the certificates field of the CMS external digital signature in a content signing certificate, which shall be an X.509 digital signature certificate issued under the id-fpki-common-piv-contentSigning policy of [COMMON]. The content signing certificate shall also include an extended key usage ( extKeyUsage) extension asserting id-PIV- content-signing. Additional descriptions for the PIV object identifiers are provided in Appendix B. The content signing certificate on a valid PIV Card (one that is neither expired nor revoked) shall not be expired.

After · FIPS 201-3

Note: The CHUID authentication mechanism (Section 6.2.5) has been removed from this version of the Standard. The CHUID data element itself, however, has not been removed and continues to be mandatory as it supports other PIV authentication mechanisms. For example, the BIO, BIO-A, and SYM-CAK authentication mechanisms use the CHUID data element as a source for the card’s expiration date. The CHUID data element also provides the content signing certificate for some authentication mechanisms and unique identifiers for PACS ACLs.

The PIV Card shallSHALL include the CHUID, as defined in [SP 800-73]. The CHUID includesSHALL include two card identifiers: the Federal Agency Smart Credential Number (FASC-N) and the card UUID in the Global Unique Identification Number (GUID), whichdata element of the CHUID. Each identifier uniquely identifyidentifies each card as describedspecified in [SP 800-73]. The value of the GUID datacard elementUUID shallSHALL be athe 16-byte16 byte binary representation of a valid UniversallyUUID Uniqueas IDentifierspecified (UUID)in [RFC4122RFC 4122]. The CHUID shallSHALL also include an expiration date data element in machine-readable format that specifies when the card expires. The expiration date format and encoding rules are as specified in [SP 800-73].

A CHUID MAY also include a Cardholder UUID that represents a persistent identifier of the cardholder, as specified in [SP 800-73]. The value of the cardholder UUID SHALL be the 16 byte binary representation of a valid UUID, as specified in [RFC 4122].

The CHUID shallSHALL be accessible from both the contact and contactless interfaces of the PIV Card without card activation.

The FASC-N, card UUID, and expiration date, shalland, notif present, cardholder UUID SHALL NOT be modified post-issuance.

This Standard requires inclusion of the asymmetric signature field in the CHUID container. The asymmetric signature data element of the CHUID shallSHALL be encoded as a Cryptographic Message Syntax (CMS) external digital signature, as specified in [SP 800-73]. Algorithm and key size requirements for the asymmetric signature and digest algorithm are detailed in [SP 800-78]. For signatures created before October 15, 2015, the

The public key required to verify the digital signature shallSHALL be provided in the certificates field of the CMS external digital signaturecontained in a content signing certificate, which shallSHALL be an X.509 digital signature certificate issued under the id-fpki-common-piv- contentSigning, id-fpki-common-devices, id-fpki-common-devicesHardware, id-fpki-common-hardware,id-fpki-common-piv or- id-fpki-common-HighcontentSigning policy of [COMMON]. 22The Forcontent signaturessigning createdcertificate onSHALL oralso afterinclude Octoberan 15,extended 2015,key theusage public( keyextKeyUsage required) toextension verifyasserting theid-PIV-content digital- signaturesigning shall. The public key SHALL be providedincluded in the certificates field of the CMS external digital signature in a content signing certificate, which shall be an X.509 digital signature certificate issued under the id-fpki-common-piv-contentSigning policy of [COMMON]. The content signing certificate shall also include an extended key usage ( extKeyUsage) extension asserting id-PIV- content-signing. Additional descriptions for the PIV object identifiers are provided in Appendix B. The content signing certificate on a valid PIV Card (oneSHALL thatNOT isexpire neitherbefore expiredthe norexpiration revoked)of shallthe notcard beauthentication expiredcertificate.