BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

1.2 Purpose and Scope

NIST PIV and digital identity SP 800-156
All changes in this version
first version loaded 1 Introduction part of 1

Title

Purpose and Scope

Control

[ FIPS201 ] describes three use cases for a chain-of-trust: 1) to extend enrollment, 2) to re- issue a PIV Card, and 3) to transfer PIV Card enrollment records to another federal issuer or to a service provider. The purpose of this document is to provide the data representation of a chain-of-trust record for the transferal use case. The data representation is based on a common XML (Extensible Markup Language) schema to facilitate interoperable information sharing and data exchange. The sending and receiving federal agencies will be able to exchange the chain-of-trust data according to the specifications provided in this document. Similarly, a service provider will be able to receive chain-of-trust records from different client agencies that are based on a common XML schema specified in this document. This document also provides support for data integrity through digital signatures and for confidentiality through encryption of chain-of- trust data, in transit and at rest. There are two use cases within the transferal scenario which this document supports:

Agency to agency: In this use case, an existing PIV cardholder from agency A is transferring to agency B, where he/she will require a new PIV Card issued by agency B. Rather than re-enrolling the user, the chain-of-trust record is sent, (upon Agency B’s request) from agency A to agency B such that agency B is able to reuse the enrollment data, thus reducing the time and effort required for agency B to issue a new PIV Card.

Agency to service provider: In this use case, an agency does not directly issue PIV Cards to their employees and contractors, but instead utilizes a separate service provider for issuance of PIV Cards. The agency can use the chain-of-trust to send PIV Card enrollment data collected by the agency to the service provider.

It is anticipated that more optional elements will be populated in the chain-of-trust XML record for the agency to service provider use case than the agency to agency use case. In the agency to service provider exchange, the agency is likely to indicate several optional elements that are not applicable in the agency to agency use case. Examples of these elements include those that would be printed on a card and are provided by the agency to the service provider, such as <EmployeeAffiliation>, <AgencyDepartmentOrOrganization>, <AffiliationColorCode>, and <Rank>.

Regardless of the use case, the goal is to provide a common chain-of-trust schema to facilitate information sharing and data exchange between different issuers.