BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4.2 Terminated PIV Cards

NIST PIV and digital identity SP 800-116 Rev. 1 against SP 800-116
All changes in this version
removed 4 Threat Environment part of 4

Title changed

Before · SP 800-116

Terminated PIV Cards

After · SP 800-116 Rev. 1

Terminated PIV Cards

Control changed

Before · SP 800-116

PIV Cards may be terminated for a number of reasons, including a lost or stolen card. A terminated PIV Card could continue to open doors with the CHUID authentication mechanism long after the card has been terminated. As described in FIPS 201, the check for termination should be performed by a status check, using either the Online Certificate Status Protocol (OCSP) or Certificate Revocation Lists (CRL), on a PIV authentication certificate. Credential validation is required by FIPS 201 for the PKI authentication mechanism, but it is not required, nor described, for the CHUID authentication mechanism. If a PIV Card is reported as lost and then terminated by the issuer, PACS relying on CHUID authentication mechanism will continue to accept the CHUID until the user is de-authorized in each of those systems. If a PACS caches the status of PIV Cards, the cached status of a terminated PIV Card will remain “valid” until the cache is refreshed. The process for PACS de-authorization is not required or defined by FIPS 201, raising the possibility that on-line credential validation will not be implemented, or not effectively implemented, where the CHUID authentication mechanism is employed. The PIV System mitigates the risk of use of a misappropriated PIV Card (which has been successfully reported and revoked) through the process of on-line credential validation. FIPS 201 Section 5.4.5 equates on-line PIV credential validation to path validation of a PIV authentication certificate. In the CHUID authentication mechanism, only the CHUID data object is read from the PIV Card, and a reader cannot check the status of a PIV authentication certificate on the basis of the CHUID alone. Therefore, it is recommended that path validation of a PIV authentication certificate be done at PIV registration, and periodically repeated by the PACS server as long as registration is maintained. Implementation methods are further discussed in Sections 7.4 and 7.5.

After · SP 800-116 Rev. 1

PIV Cards may be terminated for a number of reasons, including a lost or stolen card. A terminated PIV Card could continue to open doors with the CHUID authentication mechanism long after the card has been terminated. As described in FIPS 201, the check for termination should be performed by a status check, using either the Online Certificate Status Protocol (OCSP) or Certificate Revocation Lists (CRL), on a PIV authentication certificate. Credential validation is required by FIPS 201 for the PKI authentication mechanism, but it is not required, nor described, for the CHUID authentication mechanism. If a PIV Card is reported as lost and then terminated by the issuer, PACS relying on CHUID authentication mechanism will continue to accept the CHUID until the user is de-authorized in each of those systems. If a PACS caches the status of PIV Cards, the cached status of a terminated PIV Card will remain “valid” until the cache is refreshed. The process for PACS de-authorization is not required or defined by FIPS 201, raising the possibility that on-line credential validation will not be implemented, or not effectively implemented, where the CHUID authentication mechanism is employed. The PIV System mitigates the risk of use of a misappropriated PIV Card (which has been successfully reported and revoked) through the process of on-line credential validation. FIPS 201 Section 5.4.5 equates on-line PIV credential validation to path validation of a PIV authentication certificate. In the CHUID authentication mechanism, only the CHUID data object is read from the PIV Card, and a reader cannot check the status of a PIV authentication certificate on the basis of the CHUID alone. Therefore, it is recommended that path validation of a PIV authentication certificate be done at PIV registration, and periodically repeated by the PACS server as long as registration is maintained. Implementation methods are further discussed in Sections 7.4 and 7.5.