BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3.2.2 PIV Data Objects Accessibility and Storage Tests

NIST PIV and digital identity SP 800-85A-4 against SP 800-85A-2
All changes in this version
modified 3 Test Suite Elements part of 3.2

Title

PIV Data Objects Accessibility and Storage Tests

Control changed

Before · SP 800-85A-2

The testing covers the following data objects The five mandatory data objects as defined in Part 1 of SP 800-73-3

ƒ Card Capability Container ƒ Card Holder Unique Identifier (CHUID) ƒ X.509 Certificate for PIV authentication ƒ Cardholder Fingerprints ƒ Security Object

The twenty-eight optional data objects, also defined in Part 1 of SP 800-73-3

ƒ On-card Printed Information ƒ Cardholder Facial Image ƒ PIV Discovery Object ƒ X.509 Certificate for Digital Signature ƒ X.509 Certificate for Key Management ƒ X.509 Certificate for Card Authentication ƒ Key History Object ƒ 20 retired X.509 Certificates for Key Management ƒ Cardholder Iris Image

The data objects will be validated for the following conditions. Presence of all mandatory data objects and those optional objects in the vendor documentation.

Accessibility and storage of data objects using the appropriate BER-TLV tags (specified identifiers –Chapter 4, Part 1 of SP 800-73-3).

Appropriate container size allocations for each of the data objects.

Data objects access rule (PIN vs. no PIN).

Security condition for data objects storage (cryptographic authentication). Appropriate card interface type for accessing each of the data objects (contact vs. contactless).

After · SP 800-85A-4

The testing covers the following data objects: + The fiveseven mandatory data objects as defined in Part 1 of SP 800-73-3

ƒ800-73-4 :  Card Capability Container. ƒ Card Holder Unique Identifier (CHUID). ƒ X.509 Certificate for PIV authentication. ƒ X.509 Certificate for Card Authentication.  Cardholder Fingerprints ƒfor off card comparison.  Cardholder Facial Image.  Security Object

The. twenty-eight+ optionalThe two data objects, also defined inthat Partare 1mandatory ofif SPthe 800-73-3

ƒcardholder On-cardhas Printeda Informationgovernment-issued ƒemail Cardholderaccount Facialat Imagethe ƒtime PIVof Discoverycredential Objectissuance: ƒ X.509 Certificate for Digital Signature. ƒ X.509 Certificate for Key Management. ƒ+ X.509The Certificatetwenty-seven foroptional Carddata Authenticationobjects, ƒalso defined in Part 1 of SP 800-73-4 :  Printed Information.  Discovery Object.  Key History Object. ƒ 20 retired X.509 Certificates for Key Management. ƒ Cardholder Iris Image

Images.  Pairing Code Reference Data Container.  Secure Messaging Certificate Signer.  Biometric Information Templates Group Template. The data objects will be validated for the following conditions.: + Presence of all mandatory data objects and those optional objects in the vendor documentation.

 + Accessibility and storage of data objects using the appropriate BER-TLV tags (specified identifiers –Chapter Section 4, Part 1 of SP 800-73-3800-73-4 ).

 + Appropriate container size allocations for each of the data objects.

 + Data objects access rule (e.g., PIN vs. no PIN).

 + Security condition for data objects storage (cryptographic authentication). + Appropriate card interface type for accessing each of the data objects (contact vs. contactless vs. secure messaging vs. virtual contact interface).