BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

6.2.3.1 Authentication with the PIV Authentication Certificate Credential (PKI-AUTH)

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 6 PIV Cardholder Authentication part of 6.2.3

Title

Authentication with the PIV Authentication Certificate Credential (PKI-AUTH)

Control changed

Before · FIPS 201-2

The following steps shall be performed for PKI-AUTH:

• The PIV Authentication certificate is read from the PIV Card Application.

• The relying system validates the PIV Authentication certificate from the PIV Card Application using standards-compliant PKI path validation 33 to ensure that it is neither expired nor revoked and that it is from a trusted source.

• The cardholder is prompted to submit a PIN, which is used to activate the card. (If implemented, other card activation mechanisms, as specified in [SP 800-73], may be used to activate the card.)

• The relying system issues a challenge string to the card and requests an asymmetric operation in response.

• The card responds to the previously issued challenge by signing it using the PIV Authentication private key.

• The relying system verifies that the card’s response is the expected response to the issued challenge.

• A unique identifier from the PIV Authentication certificate is extracted and passed as input to the access control decision.

Some of the characteristics of the PKI-based authentication mechanism are as follows:

• Requires the use of certificate status checking infrastructure.

• Highly resistant to credential forgery.

33 Path validation should be configured to specify which policy OIDs are trusted. The policy OID for the PIV Authentication certificate is id-fpki-common-authentication.
• Strong resistance to use of unaltered card by non-owner since card activation is required.

• Provides protection against use of a revoked card.

• Applicable with contact card readers, and contactless card readers that support the virtual contact interface.

After · FIPS 201-3

The following steps shallSHALL be performed for PKI-AUTH:

• The PIV Authenticationauthentication certificate is read from the PIV Card Applicationapplication.


• The relying system validates the PIV Authenticationauthentication certificate from the PIV Card Applicationapplication using standards-compliant PKIcertificate path validation 33as specified in [RFC 5280] to ensure that it is neither expired nor revoked and that it is from a trusted source.

 Path validation SHOULD be configured to specify which policy OIDs are trusted. 39
• The cardholder is prompted to submitenter a PIN, which is used to activate the card. (If implemented, other card activation mechanisms, as specified in [SP 800-73], mayMAY be used to activate the card.)


• The relying system issues a challenge string to the card and requests an asymmetric operation in response.


• The card responds to the previously issued challenge by signing it using the PIV Authenticationauthentication private key.


• The relying system verifies that the card’s responsesignature isusing the expectedpublic responsekey toin the issuedPIV challengeauthentication certificate.


• A unique identifier from the PIV Authenticationauthentication certificate is extracted and passed as input to the accessauthorization controlcheck decisionto determine whether the cardholder should be granted access.

Some of the characteristics of the PKI-based authentication mechanism are as follows:

• Requiresrequires the use of certificate status checking infrastructure.

,
• Highlyhighly resistant to credential forgery.

33 Path validation should be configured to specify which policy OIDs are trusted. The policy OID for the PIV Authentication certificate is id-fpki-common-authentication.,
• Strongstrong resistance to the use of an unaltered card by a non-owner since card activation is required.

,
• Provides protection against the use of a revoked card.

, and
• Applicableusable with both contact card readers, and contactless card readers that support the virtual contact interface.