NIST PIV and digital identity SP 800-73-5
All1 The value of the GUID data element of the CHUID data object SHALL be a 16-byte binaryAppendix A PIV Data ModelAppendix B PIV Authentication MechanismsAppendix C PIV Algorithm Identifier DiscoveryAppendix D List of Symbols, Abbreviations, and AcronymsAppendix E GlossaryAppendix F NotationAppendix G Revision History
| Ref | Title | Text | |
|---|---|---|---|
| 1 | The value of the GUID data element of the CHUID data object SHALL be a 16-byte binary | representation of a valid UUID [RFC4122] . The UUID SHALL be version 1, 4, or 5, as specified in [RFC4122 , Section 4.1.3]. 2. The same 16-byte binary representation of the UUID value SHALL be present as the value of an entryUUID attribute | changed here |
| Appendix A | PIV Data Model | The PIV data model number is 0x10, and the data model version number is 0x01. The SP 800-73-5 specification does not provide mechanisms to read partial contents of a PIV data object. Individual access to the TLV elements within a container | changed here |
| Appendix B | PIV Authentication Mechanisms | PIV authentication mechanisms and application scenarios are described in this section to provide guidelines on the usage and behavior supported by the PIV Card. FIPS 201 describes PIV authentication as “the process of establishing confidenc | changed here |
| B.1 in B |
Authentication Mechanism Diagrams | This section describes the activities and interactions involved in interoperable usage and authentication of the PIV Card. The authentication mechanisms represent how a relying party will authenticate the cardholder (regardless of which age | changed here |
| B.1.1 in B.1 |
Authentication Using PIV Biometrics (BIO) | Figure 1 shows the general authentication mechanism that uses PIV biometrics for off-card matching . Fig. 1. Authentication using PIV Biometrics (BIO) The assurance of authentication using PIV biometrics CAN be further increased if the liv | changed here |
| B.1.2 in B.1 |
Authentication Using PIV Authentication Key | Figure 3 shows the authentication mechanism using the PIV Authentication key. Fig. 3. Authentication using PIV Authentication Key | changed here |
| B.1.3 in B.1 |
Authentication Using Card Authentication Key | Authentication mechanisms using the Card Authentication key are illustrated in Fig. 4 and Fig. 5 . Figure 4 illustrates the use of the mandatory asymmetric Card Authentication key, while Fig. 5 uses the deprecated, optional symmetric Card A | changed here |
| B.1.4 in B.1 |
Authentication Using OCC (OCC-AUTH) | The OCC-AUTH authentication mechanism is implemented by performing OCC over secure messaging. The PIV Application authenticates the PIV Card as part of the process of establishing secure messaging. When the live-scan fingerprint biometric i | changed here |
| B.1.5 in B.1 |
Authentication Using PIV Visual Credentials (Deprecated) | Figure 7 shows the deprecated authentication mechanism in which a human guard authenticates the cardholder using the visual credentials held by the PIV Card. The authentication mechanism has been deprecated in FIPS 201-3 and MAY be removed | changed here |
| B.1.6 in B.1 |
Authentication Using PIV CHUID (Removed) | The content of this section has been removed since the CHUID as an authentication mechanism is no longer allowed under FIPS-201. However, the CHUID data element itself remains on-card to support other authentication mechanisms. For example, | changed here |
| B.1.7 in B.1 |
Authentication Using Secure Messaging Key (SM-AUTH) | If the PIV Card supports the secure messaging protocol, then the secure messaging key, corresponding CVC, and key establishment protocol (see Sec. 4 of SP 800-73-5 Part 2) CAN be used for authentication of the PIV Card and the cardholder (S | changed here |
| B.2 in B |
Summary Table | Table 45 summarizes the types of validation activities that are included in each of the PIV authentication mechanisms described earlier in this section. Table 45. Summary of PIV authentication mechanisms PIV Authentication Mechanism Card | changed here |
| Appendix C | PIV Algorithm Identifier Discovery | Relying parties interact with many PIV Cards with the same native key type implemented by different key sizes and algorithms. 34 34 Table 1 of SP 800-78 lists the various algorithms and key sizes that may be used for each PIV Key Type. For | changed here |
| C.1 in C |
PIV Algorithm Identifier Discovery for Asymmetric Cryptographic Authentication | As illustrated in the authentication mechanisms in Appendix B , an asymmetric cryptographic authentication involves issuing a challenge (request to sign a nonce) to the PIV Card. The relying party issuing the command provides the nonce to b | changed here |
| C.2 in C |
PIV Algorithm Identifier Discovery for Symmetric Cryptographic Authentication | In the absence of an X.509 certificate, as is the case with symmetric cryptography, the PIV algorithm identifier discovery mechanism has to rely on a lookup table that resides on the local system. The table maps a unique card identifier and | changed here |
| C.3 in C |
PIV Algorithm Identifier Discovery for Secure Messaging | The Application Property Template included in the response to the SELECT command optionally includes a tag 0xAC, which indicates what cryptographic algorithms the PIV Card Application supports. The presence of algorithm identifier '27' or ' | changed here |
| Appendix D | List of Symbols, Abbreviations, and Acronyms | ACR Access Control Rule AID Application Identifier APDU Application Protocol Data Unit API Application Programming Interface ASCII American Standard Code for Information Interchange ASN.1 Abstract Syntax Notation One BER Basic Encodin | changed here |
| Appendix E | Glossary | algorithm identifier A 1-byte identifier that specifies a cryptographic algorithm and key size. For symmetric cryptographic operations, the algorithm identifier also specifies a mode of operation (i.e., ECB). application identifier A globa | changed here |
| Appendix F | Notation | The 16 hexadecimal digits SHALL be denoted using the alphanumeric characters 0, 1, 2, …, 9, A, B, C, D, E, and F. A byte consists of two hexadecimal digits, such as '2D'. The two hexadecimal digits are represented in quotations '2D' or as 0 | changed here |
| Appendix G | Revision History | SP 800-73 April 2005 Initial Release SP 800-73-1 April 2006 Incorporated Errata SP 800-73-2 September 2008 • Separated SP 800-73 into four Parts: | changed here |
20 of 20.