NIST PIV and digital identity SP 800-78-4
All1 Introduction2 Application of Cryptography in FIPS 201-23 On Card Cryptographic Requirements4 Certificate Status Information5 PIV Card Application Administration Keys6 Identifiers for PIV Card Interfaces7 Cryptographic Algorithm Validation Testing Requirements
| Ref | Title | Text | |
|---|---|---|---|
| 1 | Introduction | Homeland Security Presidential Directive-12 (HSPD-12) mandated the creation of new standards for interoperable identity credentials for physical and logical access to federal government locations and systems. Federal Information Processing | |
| 1.1 in 1 |
Purpose | FIPS 201-2 defines requirements for the PIV lifecycle activities including identity proofing, registration, PIV Card issuance, and PIV Card usage. FIPS 201-2 also defines the structure of an identity credential that includes cryptographic k | |
| 1.2 in 1 |
Scope | The scope of this Recommendation encompasses the PIV Card, infrastructure components that support issuance and management of the PIV Card, and applications that rely on the credentials supported by the PIV Card to provide security services. | |
| 1.3 in 1 |
Audience and Assumptions | This document is targeted at federal agencies and implementers of PIV systems. Readers are assumed to have a working knowledge of cryptography and public key infrastructure (PKI) technology. | |
| 1.4 in 1 |
Document Overview | The document is organized as follows: + Section 1 , Introduction , provides the purpose, scope, audience, and assumptions of the document and outlines its structure. + Section 2 , Application of Cryptography in FIPS 201-2 , identifies the | |
| 2 | Application of Cryptography in FIPS 201-2 | FIPS 201-2 employs cryptographic mechanisms to authenticate cardholders, secure information stored on the PIV Card, and secure the supporting infrastructure. FIPS 201-2 and its supporting documents specify a suite of keys to be stored on t | |
| 3 | On Card Cryptographic Requirements | FIPS 201-2 identifies a suite of objects that are stored on the PIV Card for use in authentication mechanisms or in other security protocols. These objects may be divided into three classes: cryptographic keys, signed authentication informa | |
| 3.1 in 3 |
PIV Cryptographic Keys | FIPS 201-2 and SP 800-73-4 specify six different classes of cryptographic keys to be used as credentials by the PIV cardholder: + the mandatory PIV Authentication key; + the mandatory asymmetric Card Authentication key; + an optional sym | |
| 3.2 in 3 |
Authentication Information Stored on the PIV Card | ||
| 3.2.1 in 3.2 |
Specification of Digital Signatures on Authentication Information | FIPS 201-2 requires the use of digital signatures to protect the integrity and authenticity of information stored on the PIV Card. FIPS 201-2 and SP 800-73-4 require digital signatures on the following objects stored on the PIV Card: + X.5 | |
| 3.2.2 in 3.2 |
Specification of Public Keys In X.509 Certificates | FIPS 201-2 requires generation and storage of an X.509 certificate to correspond with each asymmetric private key contained on the PIV Card, except the PIV Secure Messaging key. X.509 certificates include object identifiers to specify the c | |
| 3.2.3 in 3.2 |
Specification of Message Digests in the SP 800-73-4 Security Object | SP 800-73-4 mandates inclusion of a Security Object consistent with the Authenticity/Integrity Code defined by the International Civil Aviation Organization (ICAO) in [MRTD] . This object contains message digests of other digital informatio | |
| 4 | Certificate Status Information | The FIPS 201-2 functional component PIV Card Issuance and Management Subsystem generates and distributes status information for PIV asymmetric keys, other than PIV Secure Messaging keys. FIPS 201-2 mandates two formats for certificate statu | |
| 5 | PIV Card Application Administration Keys | PIV Cards may support card activation by the card management system to support card personalization and post-issuance card update. PIV Cards that support card personalization and post-issuance updates perform a challenge response protocol u | |
| 6 | Identifiers for PIV Card Interfaces | SP 800-73-4 defines an application programming interface, the PIV Client Application Programming Interface (Part 3), and a set of mandatory card commands, the PIV Card Application Card Command Interface (Part 2). The command syntaxes for th | |
| 6.1 in 6 |
Key Reference Values | A PIV Card key reference is a one-byte identifier that specifies a cryptographic key according to its PIV Key Type. Table 6-1 defines the key reference values used on the PIV interfaces for PIV Key Types. Table 6-1. Key References for PIV | |
| 6.2 in 6 |
PIV Card Algorithm Identifiers | A PIV Card algorithm identifier is a one-byte identifier that specifies a cryptographic algorithm and key size, or a suite of algorithms and key sizes. For symmetric cryptographic operations, the algorithm identifier also specifies a mode o | |
| 6.3 in 6 |
Algorithm Identifiers for PIV Key Types | Table 6-3 summarizes the set of algorithms supported for each key reference value. Table 6-3. PIV Card Keys: Key References and Algorithms PIV Key Type Key Reference Value Permitted Algorithm Identifiers PIV Secure Messaging key '04' '27' | |
| 7 | Cryptographic Algorithm Validation Testing Requirements | As noted in Section 4.2.2 of [FIPS201] , the PIV Card shall be validated under [FIPS140] with an overall validation of Level 2 and with Level 3 physical security. The scope of the Cryptographic Module Validation Program (CMVP) validation sh |
19 of 19.