BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4 Certificate Status Information

NIST PIV and digital identity SP 800-78-5 against SP 800-78-4
All changes in this version
modified 4 Certificate Status Information

Title

Certificate Status Information

Control changed

Before · SP 800-78-4

The FIPS 201-2 functional component PIV Card Issuance and Management Subsystem generates and distributes status information for PIV asymmetric keys, other than PIV Secure Messaging keys. FIPS 201-2 mandates two formats for certificate status information:

+ X.509 CRLs; and

+ OCSP status response messages.

The CRLs and OCSP status responses shall be digitally signed to support authentication and integrity using a key size and hash algorithm that satisfy the requirements for signing PIV information, as specified in Table 3-2 , and that are at least as large as the key size and hash algorithm used to sign the certificate.

CRLs and OCSP messages rely on object identifiers to specify which signature algorithm was used to generate the digital signature. The object identifiers specified in Table 3-3 must be used in CRLs and OCSP messages to identify the signature algorithm.

After · SP 800-78-5

The FIPS 201-2201-3 functional component PIV Card Issuance and Management Subsystem generates and distributes status information for PIV asymmetric keys, other than PIV Secure Messaging keys. FIPS 201-2 mandates two formats for certificate status information:

+1. X.509 CRLs; and

+2. OCSP status response messages.

The CRLs and OCSP status responses shall be digitally signed to support authentication and integrity using a key size and hash algorithm that satisfy the requirements for signing PIV information, as specified in Table 3-22 , and that are at least as large as the key size and hash algorithm used to sign the certificate.

CRLs and OCSP messages rely on object identifiers to specify which signature algorithm was used to generate the digital signature. The object identifiers specified in Table 3-33 must be used in CRLs and OCSP messages to identify the signature algorithm.