BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

6.2.3.2 Authentication with the Card Authentication Certificate Credential (PKI-CAK)

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 6 PIV Cardholder Authentication part of 6.2.3

Title

Authentication with the Card Authentication Certificate Credential (PKI-CAK)

Control changed

Before · FIPS 201-2

The following steps shall be performed for PKI-CAK:

• The Card Authentication certificate is read from the PIV Card Application.

• The relying system validates the Card Authentication certificate from the PIV Card Application using standards-compliant PKI path validation 34 to ensure that it is neither expired nor revoked and that it is from a trusted source.

• The relying system issues a challenge string to the card and requests an asymmetric operation in response.

• The card responds to the previously issued challenge by signing it using the Card Authentication private key.

• The relying system verifies that the card’s response is the expected response to the issued challenge.

• A unique identifier from the Card Authentication certificate is extracted and passed as input to the access control decision.

Some of the characteristics of the PKI-CAK authentication mechanism are as follows:

• Requires the use of certificate status checking infrastructure.

• Highly resistant to credential forgery.

• Low resistance to use of unaltered card by non-owner of card.

• Applicable with contact and contactless readers.

After · FIPS 201-3

The following steps shallSHALL be performed for PKI-CAK:

• The Cardcard Authenticationauthentication certificate is read from the PIV Card Applicationapplication.


• The relying system validates the Cardcard Authenticationauthentication certificate from the PIV Card Applicationapplication using standards-compliant PKIcertificate path validation 34as specified in [RFC 5280] to ensure that it is neither expired nor revoked and that it is from a trusted source.

 Path validation SHOULD be configured to specify which policy OIDs are trusted. 40
• The relying system issues a challenge string to the card and requests an operation using an asymmetric operationcryptographic algorithm in response.

39 The policy OID for the PIV authenticatio n certificate is id-fpki-common-authentication . 40 The policy OID for the card authentication certificate is id-fpki-common-cardAuth .
• The card responds to the previously issued challenge by signing it using the Cardcard Authenticationauthentication private key.


• The relying system verifies that the card’s responsesignature isusing the expectedpublic responsekey toin the issuedcard challengeauthentication certificate.


• A unique identifier from the Cardcard Authenticationauthentication certificate is extracted and passed as input to the accessauthorization controlcheck decisionto determine whether the cardholder should be granted access.

Some of the characteristics of the PKI-CAK authentication mechanism are as follows:

• Requiresrequires the use of certificate status checking infrastructure.

,
• Highlyhighly resistant to credential forgery.

,
• Lowlow resistance to use of unaltered card by non-owner of, card.

and
• Applicableusable with contact and contactless readers.