BaselineWatch
21 requirements
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

NIST PIV and digital identity SP 800-78-5

21 requirements · published 2024-07-15
Changes in this version
All1 Introduction2 Application of Cryptography in FIPS 201-33 On-Card Cryptographic Requirements4 Certificate Status Information5 PIV Card Application Administration Keys6 Identifiers for PIV Card Interfaces7 Cryptographic Algorithm Validation Testing RequirementsAppendix A List of Symbols, Abbreviations, and AcronymsAppendix B Change Log
RefTitleText
1 Introduction Homeland Security Presidential Directive-12 (HSPD-12) mandated the creation of new standards for interoperable identity credentials for physical and logical access to Federal Government locations and systems. Federal Information Processing changed here
1.1
in 1
 Purpose FIPS 201-3 defines the requirements for PIV life cycle activities, including identity proofing, registration, PIV Card issuance, and PIV Card usage. FIPS 201-3 also defines the structure of an identity credential that includes cryptographic changed here
1.2
in 1
 Scope The scope of this recommendation encompasses the PIV Card, infrastructure components that support issuance and management of the PIV Card, and applications that rely on the credentials supported by the PIV Card to provide security services. changed here
1.3
in 1
 Audience and Assumptions This document is intended for federal agencies and implementers of PIV systems. Readers are assumed to have a working knowledge of cryptography and public key infrastructure (PKI) technology. changed here
1.4
in 1
 Document Overview The document is organized as follows: • Section 1 , Introduction , provides the purpose, scope, audience, and assumptions of the document and outlines its structure. • Section 2 , Application of Cryptography in FIPS 201-3 , identifies the changed here
2 Application of Cryptography in FIPS 201-3 FIPS 201-3 employs cryptographic mechanisms to authenticate cardholders, secure information stored on the PIV Card, and secure the supporting infrastructure. FIPS 201-3 and its supporting documents specify a suite of keys to be stored on th changed here
3 On-Card Cryptographic Requirements FIPS 201-3 identifies a suite of objects that are stored on the PIV Card for use in authentication mechanisms or other security protocols. These objects may be divided into three classes: cryptographic keys, signed authentication informatio changed here
3.1
in 3
 PIV Cryptographic Keys FIPS 201-3 and SP 800-73 specify six types of cryptographic keys to be used as credentials by the PIV cardholder: 1. The mandatory PIV Authentication key, 2. The mandatory asymmetric Card Authentication key, 3. An optional symmetric Card changed here
3.2
in 3
 Authentication Information Stored on the PIV Card
3.2.1
in 3.2
 Specification of Digital Signatures on Authentication Information FIPS 201-3 requires the use of digital signatures to protect the integrity and authenticity of information stored on the PIV Card. FIPS 201-3 and SP 800-73 require digital signatures on the following objects stored on the PIV Card: • X.509 changed here
3.2.2
in 3.2
 Specification of Public Keys in X.509 Certificates FIPS 201-3 requires the generation and storage of an X.509 certificate to correspond with each asymmetric private key contained on the PIV Card, except for the PIV Secure Messaging key. X.509 certificates include object identifiers to speci changed here
3.2.3
in 3.2
 Specification of Message Digests in the SP 800-73-4 Security Object SP 800-73 mandates the inclusion of a Security Object consistent with the Authenticity/Integrity Code defined by the International Civil Aviation Organization (ICAO) in [MRTD] . This object contains message digests of other digital informat changed here
4 Certificate Status Information The FIPS 201-3 functional component PIV Card Issuance and Management Subsystem generates and distributes status information for PIV asymmetric keys other than PIV Secure Messaging keys. FIPS 201-2 mandates two formats for certificate status changed here
5 PIV Card Application Administration Keys PIV Cards may support card activation by the card management system to support card personalization and post-issuance card updates. PIV Cards that support card personalization and post-issuance updates perform a challenge-response protocol changed here
6 Identifiers for PIV Card Interfaces SP 800-73 defines an application programming interface, the PIV Client Application Programming Interface (Part 3), and a set of mandatory card commands, the PIV Card Application Card Command Interface (Part 2). The command syntaxes for thes changed here
6.1
in 6
 Key Reference Values A PIV Card key reference is a one-byte identifier that specifies a cryptographic key according to its PIV Key Type. Table 8 defines the key reference values used on the PIV interfaces for PIV Key Types. Table 8. Key references for PIV Key changed here
6.2
in 6
 PIV Card Algorithm Identifiers A PIV Card algorithm identifier is a one-byte identifier that specifies a cryptographic algorithm and key size or a suite of algorithms and key sizes. For symmetric cryptographic operations, the algorithm identifier also specifies a mode of changed here
6.3
in 6
 Algorithm Identifiers for PIV Key Types Table 10 summarizes the set of algorithms supported for each key reference value. All cryptographic algorithms employed shall provide at least 112 bits of security strength. Cryptographic keys that will remain in use after 2030 should prov changed here
7 Cryptographic Algorithm Validation Testing Requirements As noted in Section 4.2.2 of [FIPS201] , the PIV Card shall be validated under [FIPS140] with an overall validation of Level 2 and with Level 3 physical security. The scope of the Cryptographic Module Validation Program (CMVP) validation sh changed here
Appendix A List of Symbols, Abbreviations, and Acronyms The following abbreviations and acronyms are used in this standard. 3TDEA Three key TDEA (TDEA with Keying Option 1 [SP800-67] ) AES Advanced Encryption Standard [FIPS197] CAVP Cryptographic Algorithm Validation Program CBC Cipher Block changed here
Appendix B Change Log This appendix is informative and provides an overview of the changes made to SP 800-78 since its initial release. In August 2007, Revision 1 enhanced alignment with the National Security Agency’s Suite B Cryptography by: • Reducing the se changed here

21 of 21.