3.1 PIV Cryptographic Keys
All changes in this version
Title
PIV Cryptographic Keys
Control changed
Before · SP 800-78-4
FIPS 201-2 and SP 800-73-4 specify six different classes of cryptographic keys to be used as credentials by the PIV cardholder:
+ the mandatory PIV Authentication key;
+ the mandatory asymmetric Card Authentication key;
+ an optional symmetric Card Authentication key;
+ a conditionally mandatory digital signature key;
+ a conditionally mandatory key management key; 1 and
+ an optional asymmetric key to establish session keys for secure messaging.
Table 3-1 establishes specific requirements for cryptographic algorithms and key sizes for each key type.
In addition to the key sizes, keys must be generated using secure parameters. Rivest, Shamir, Adleman (RSA) keys must be generated using a public exponent of 65 537. Elliptic curve keys must correspond to one of the following recommended curves from [FIPS186] :
+ Curve P-256; or
+ Curve P-384.
To promote interoperability, this specification further limits PIV Authentication and Card Authentication elliptic curve keys to a single curve (P-256). 2 PIV cryptographic keys for digital signatures and key management may use P-256 or P-384, based on application requirements. There is no phase out date specified for either curve.
If the PIV Card Application supports the virtual contact interface [SP800-73] and the digital signature key, the key management key, or any of the retired key management keys are elliptic curve keys corresponding to Curve P-384, then the PIV Secure Messaging key shall use P-384, otherwise it may use P-256 or P-384.
1 The digital signature and key management keys are mandatory if the cardholder has a government-issued email account at the time of credential issuance. 2 To reduce computation times for authentication for physical access, it is recommended that the asymmetric Card Authentication key be an elliptic curve key rather than an RSA key. Table 3-1. Algorithm and Key Size Requirements for PIV Key Types
PIV Key Type Algorithms and Key Sizes PIV Authentication key RSA (2048 bits) ECDSA (Curve P-256) asymmetric Card Authentication key RSA (2048 bits) ECDSA (Curve P-256) symmetric Card Authentication key 3TDEA 3 AES-128, AES-192, or AES-256 digital signature key RSA (2048 bits) ECDSA (Curve P-256 or P-384) key management key RSA key transport (2048 bits); ECDH (Curve P-256 or P-384) PIV Secure Messaging key ECDH (Curve P-256 or P-384)
While this specification requires that the RSA public exponent associated with PIV keys be 65 537, applications should be able to process RSA public keys that have any public exponent that is an odd positive integer greater than or equal to 65 537 and less than 2 256 .
This specification requires that the key management key must be an RSA key transport key or an Elliptic Curve Diffie-Hellman (ECDH) key. The specifications for RSA key transport are [PKCS1] and [SP800-56B] ; the specification for ECDH is [SP800-56A] .
After · SP 800-78-5
FIPS 201-2201-3 and SP 800-73-4800-73 specify six different classestypes of cryptographic keys to be used as credentials by the PIV cardholder:+1. theThe mandatory PIV Authentication key;,+2. theThe mandatory asymmetric Card Authentication key;,+3. anAn optional symmetric Card Authentication key; (deprecated),+4. aA conditionally mandatory digital signature key;,+5. aA conditionally mandatory key management key;, 1 and+ an1 optionalThe asymmetricdigital keysignature toand establishkey sessionmanagement keys for secureare messaging.mandatory
Table3-1if establishesthe specificcardholder requirementshas fora cryptographicgovernment-issued algorithmsemail andaccount keyat sizesthe fortime eachof keycredential typeissuance. andIn6. additionAn tooptional theasymmetric key sizes,to establish session keys mustfor besecure generatedmessaging usingand secureto parameters.authenticate Rivest,the Shamir,cardholder Adlemanusing (RSA)the keysSM-AUTH mustauthentication bemechanism.
All generatedcryptographic usingalgorithms aemployed publicshall exponentprovide at least 112 bits of 65security 537strength. Elliptic curveCryptographic keys mustthat correspondwill toremain onein ofuse theafter following2030 recommendedshould curvesprovide from128 [FIPS186]bits :of
+Curvesecurity P-256;strength. or2+2 CurveFor P-384.detailed
Topromoteguidance interoperability,on thisthe specificationstrength furtherof limitscryptographic PIValgorithms, Authenticationsee and[SP800-57(1)] Card, AuthenticationRecommendation ellipticon curveKey keysManagement to– aPart single1: curveGeneral (P-256). 2Federal PIVdepartments cryptographicand keysagencies forshould digitalconsider signaturespotential andcryptographic key managementlength maymigrations useas P-256part orof P-384,their basedmoderate onto applicationlong-term requirements.cryptographic Theretransition isand nomodernization phaseplans, outincluding datethe specifiedneed forto eitherplan curve.and
Iftheinvest PIVfor Carda Applicationfuture supportsmigration theto virtualpost- contactquantum interfacealgorithms. [SP800-73]Capital andinvestments thefor digitalPIV signatureissuance key,and therelying keyparty managementsystems key,should orbe anyselected ofwith thean retiredemphasis keyon managementensuring keysa aretimely ellipticmigration curveto keyspost-quantum correspondingalgorithms toonce Curvestandards, P-384technologies, thenand theservices PIVare Secureavailable. MessagingIf keya shallmigration useto P-384,longer otherwisecryptographic itkeys maywould userequire P-256significant resources or P-384.infrastructure
1Theupgrades, digitalfederal signaturedepartments and key managementagencies keysmay areelect mandatoryto ifdefer thethese cardholderimprovements hasuntil athe government-issuedpost-quantum emailmigration. accountPost- atquantum thealgorithms timewill ofbe credentialspecified issuance.in 2a Tofuture reducerevision computationof timesthis fordocument authenticationonce forfoundational physicalstandards access,supporting ittheir isuse recommendedhave thatbeen theadopted.
Table asymmetric1 Cardestablishes Authenticationspecific keyrequirements befor ancryptographic ellipticalgorithms curveand key rather thansizes anfor RSAeach key type. Table 3-11. Algorithm and Keykey Sizesize Requirementsrequirements for PIV Keykey Typestypes
PIV Key Type Algorithms and Key Sizes Through 2030 Algorithm and Key Sizes for 2031 and Beyond PIV Authentication key RSA (2048 or 3072 bits) ECDSA (Curve P-256 or P-384) asymmetricRSA 3072 bits ECDSA (Curve P-256 or P-384)
Asymmetric Card Authentication key RSA (2048 or 3072 bits) ECDSA (Curve P-256 or P-384) symmetricRSA 3072 bits ECDSA (Curve P-256 or P-384) Symmetric Card Authentication key (deprecated) 3TDEA 3
3 3TDEA is Triple DES using Keying Option 1 from [SP800-67] , which requires that all three keys be unique (i.e., Key 1 ≠ Key 2, Key 2 ≠ Key 3, and Key 3 ≠ Key 1). (deprecated), AES-128, AES-192, or AES-256 digitalAES-128, AES-192, or AES-256
Digital signature key RSA (2048 or 3072 bits) ECDSA (Curve P-256 or P-384) keyRSA 3072 bits ECDSA (Curve P-256 or P-384) Key management key RSA key transport (2048 or 3072 bits); ECDH (Curve P-256 or P-384) RSA key transport 3072 ECDH (Curve P-256 or P-384) PIV Secure Messaging key ECDH (Curve P-256 or P-384) ECDH (Curve P-256 or P-384)
In addition to the key sizes, keys must be generated using secure parameters. Rivest-Shamir- Adleman (RSA) keys must be generated using a public exponent of 65537. Elliptic curve keys must correspond to one of the following recommended curves from [FIPS186] :
• Curve P-256 or
• Curve P-384.
Elliptic curve keys are a faster option than RSA-based keys for the Card Authentication key for physical access since elliptic curve private key computation time is significantly shorter than RSA-based private key computation time. There is no phaseout date specified for either curve.
If the PIV Card Application supports the virtual contact interface [SP800-73] and the digital signature key, the key management key, or any of the retired key management keys are elliptic curve keys that correspond to Curve P-384, then the PIV Secure Messaging key shall use P-384. Otherwise, it may use P-256 or P-384.
While this specification requires that the RSA public exponent associated with PIV keys be 65 53765537, applications should be able to process RSA public keys that have any public exponent that is an odd positive integer greater than or equal to 65 53765537 and less than 2 256 .
This specification requires that the key management key mustto be an RSA key transport key or an Elliptic Curve Diffie-Hellman (ECDH) key. The specifications for RSA key transport are [PKCS1] and [SP800-56B] ;, and the specification for ECDH key agreement is [SP800-56A] .