BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

6.3 Algorithm Identifiers for PIV Key Types

NIST PIV and digital identity SP 800-78-5 against SP 800-78-4
All changes in this version
modified 6 Identifiers for PIV Card Interfaces part of 6

Title

Algorithm Identifiers for PIV Key Types

Control changed

Before · SP 800-78-4

Table 6-3 summarizes the set of algorithms supported for each key reference value.

Table 6-3. PIV Card Keys: Key References and Algorithms

PIV Key Type Key Reference Value Permitted Algorithm Identifiers PIV Secure Messaging key '04' '27', '2E'

retired key management key '82', '83', '84', '85', '86', '87', '88', '89', '8A', '8B', '8C', '8D', '8E', '8F', '90', '91', '92', '93', '94', '95' '06', '07', '11', '14'

PIV Authentication key '9A' '07', '11' PIV Card Application Administration Key '9B' '00', '03', '08', '0A', '0C' digital signature key '9C' '07', '11', '14' key management key '9D' '07', '11', '14' asymmetric Card Authentication key '9E' '07', '11' symmetric Card Authentication key '9E' '00', '03', '08', '0A', '0C'

After · SP 800-78-5

Table 6-310 summarizes the set of algorithms supported for each key reference value.

All cryptographic algorithms employed shall provide at least 112 bits of security strength. Cryptographic keys that will remain in use after 2030 should provide 128 bits of security strength. 7

7 For detailed guidance on the strength of cryptographic algorithms, see [SP800-57(1)] , Recommendation on Key Management – Part 1: General . Federal departments and agencies should consider potential cryptographic key length migrations as part of their moderate to long-term cryptographic transition and modernization plans, including the need to plan and invest for a future migration to post- quantum algorithms. Capital investments for PIV issuance and relying party systems should be selected with an emphasis on ensuring a timely migration to post-quantum algorithms once standards, technologies, and services are available. If a migration to longer cryptographic keys would require significant resources or infrastructure upgrades, federal departments and agencies may elect to defer these improvements until the post-quantum migration. Post- quantum algorithms will be specified in a future revision of this document once foundational standards supporting their use have been adopted. Table 6-310. PIV Card Keyskeys: Key Referencesreferences and Algorithmsalgorithms

PIV Key Type Key Reference Value PermittedAlgorithm Identifiers Through 2030 Algorithm Identifiers After 2030 PIV Secure Messaging key '04' '27', '2E' '27', '2E'

retiredRetired key management key '82', '83', '84', '85', '86', '87', '88', '89', '8A', '8B', '8C', '8D', '8E', '8F', '90', '91', '92', '93', '94', '95' '05', '06', '07', '11', '14' '05', '06', '07', '11', '14'

PIV Authentication key '9A' '05','07', '11', '14' '05', '11', '14' PIV Card Application Administration Key '9B' '00', '03', '08', '0A', '0C' digital'08', '0A', '0C'

Digital signature key '9C' '05', '07', '11', '14' key'05', '11', '14' Key management key '9D' '05','07', '11', '14' asymmetric'05', '11', '14' Asymmetric Card Authentication key '9E' '05','07', '11', symmetric'14' '05', '11', '14' Symmetric Card Authentication key (deprecated) '9E' '00', '03', '08', '0A', '0C' '08', '0A', '0C'