NIST PIV and digital identity SP 800-156
All1 Introduction2 Chain - of - T rust Data Requirements and Namespaces3 Chain - of - T rust Schema Description4 Chain - of - trust Record Encryption in Transit5 Log and Historical DataAppendix A XML SchemaAppendix B XML Sample PIV ChainOfTrust RecordAppendix C ReferencesAppendix D Glossary of TermsAppendix E Acronyms
| Ref | Title | Text | |
|---|---|---|---|
| 1 | Introduction | ||
| 1.1 in 1 |
Background | The Homeland Security Presidential Directive 12 [ HSPD12 ] called for a common identification standard to be adopted governing the interoperable use of identity credentials to allow physical and logical access to federal government location | |
| 1.2 in 1 |
Purpose and Scope | [ FIPS201 ] describes three use cases for a chain-of-trust: 1) to extend enrollment, 2) to re- issue a PIV Card, and 3) to transfer PIV Card enrollment records to another federal issuer or to a service provider. The purpose of this document | |
| 1.3 in 1 |
Document Structure | The remainder of this document is divided into the following sections and appendices: Section 2 , Chain-of-Trust Data Requirements and Namespaces , discusses the representation of chain-of-trust data in XML schemas. Section 3 , Chain- | |
| 1.4 in 1 |
Document Conventions | Throughout this document key words are used to identify requirements. The key words “optional”, “required”, “shall”, “shall not”, and “should” are used. These words are a subset of the IETF Request For Comments (RFC) 2119 [ RFC2119 ] key wo | |
| 2 | Chain - of - T rust Data Requirements and Namespaces | [ FIPS201 ] recommends that the following data be included in the chain-of-trust: A log of activities that documents who took the action, what action was taken, when and where the action took place, and what identification data was colle | |
| 2.1 in 2 |
Namespaces Declaration for Chain-of-Trust Schema | XML namespace prefixes are used throughout this specification to stand for their respective namespaces as follows: Table 1: Standard Namespace Prefix XML Namespace Comments ds: http://www.w3.org/2000/09/xmldsig# This is the W3C XML Signat | |
| 3 | Chain - of - T rust Schema Description | The chain-of-trust data is encoded in the XML format specified in this document. The chain-of-trust XML records are intended to be used in a direct-exchange. While log and historical data are not included in the XML chain-of-trust record, t | |
| 3.1 in 3 |
Schema Header and Namespace Declarations | The following schema fragment defines the XML namespaces and other header information for the PIV chain-of-trust schema: <xs:schema elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema" targetNamespace="http://csrc.nis | |
| 3.2 in 3 |
Element <PIVChainOfTrust> | The following schema fragment defines the <PIVChainOfTrust> element: <xs:element name="PIVChainOfTrust" type="PIVChainOfTrustType"/> The <PIVChainOfTrust> element is of PIVChainOfTrustType complex type, and carries one or more <Enrollment | |
| 3.3 in 3 |
Complex Type PIVChainOfTrustType | The following schema fragment defines the PIVChainOfTrustType complex type: <xs:complexType name="PIVChainOfTrustType"> <xs:sequence> <xs:choice> <xs:sequence> <xs:element ref="xenc:EncryptedData" minOccurs="1" maxOccurs="1"/> <xs:element | |
| 3.4 in 3 |
Complex Type EnrollmentRecordType | The following schema fragment defines the EnrollmentRecordType complex type: <xs:complexType name="EnrollmentRecordType"> <xs:sequence> <xs:element name="PersonalInformation" type="PersonalInformationType" minOccurs="1" maxOccurs="1"/> <xs | |
| 3.5 in 3 |
Complex Type PersonalInformationType | The following schema fragment defines the PersonalInformationType complex type: <xs:complexType name="PersonalInformationType"> <xs:sequence> <xs:element name="PrimaryIdentifier" type="xs:string" minOccurs="1" maxOccurs="1"/> <xs:element n | |
| 3.6 in 3 |
Complex Type AdjudicationInformationType | The following schema fragment defines the AdjudicationInformationType complex type: <xs:complexType name="AdjudicationInformationType"> <xs:sequence> <xs:element name="NACIAdjudicationValue" minOccurs="1" maxOccurs="1"> <xs:simpleType> <xs | |
| 3.7 in 3 |
Complex Type EnrollmentPackageType | The following schema fragment defines the EnrollmentPackageType complex type: <xs:complexType name="EnrollmentPackageType"> <xs:sequence> <xs:element name="EPBiographic" type="EPBiographicType" minOccurs="0" maxOccurs="1"/> <xs:element nam | |
| 3.8 in 3 |
Complex Type EPBiographicType | The following schema fragment defines the EPBiographicType complex type: <xs:complexType name="EPBiographicType"> <xs:sequence> <xs:element name="GenderCode" minOccurs="0" maxOccurs="1"> <xs:simpleType> <xs:restriction base="xs:string"> <x | |
| 3.9 in 3 |
Complex Type EPBiometricsType | The following schema fragment defines the EPBiometricsType complex type: <xs:complexType name="EPBiometricsType"> <xs:sequence> <xs:element name="Photo" type="xs:base64Binary" minOccurs="1" maxOccurs="1"/> <xs:element name="FingerprintOffC | |
| 3.10 in 3 |
Complex Type EPDocumentType | The following schema fragment defines the EPDocumentType complex type: <xs:complexType name="EPDocumentType"> <xs:sequence> <xs:element name="DocumentTypeIdentifier" minOccurs="1" maxOccurs="1"> <xs:simpleType> <xs:restriction base="xs:str | |
| 3.11 in 3 |
Complex Type PIVCardTopographyType | The following schema fragment defines the PIVCardTopographyType complex type: <xs:complexType name="PIVCardTopographyType"> <xs:sequence> <xs:element name="EmployeeAffiliation" type="xs:string" minOccurs="0" maxOccurs="1"/> <xs:element nam | |
| 4 | Chain - of - trust Record Encryption in Transit | The confidentiality of the chain-of-trust record is to be protected at all times by both the producing and consuming organizations. In addition to encrypting the chain-of-trust record in accordance with XML encryption, as documented in Sect | |
| 5 | Log and Historical Data | Logs and historical data are maintained by the original issuer and are not transferred when exchanging PIV Card enrollment records. These log and historical data were created by the original issuer and are part of the chain-of-trust record. | |
| Appendix A | XML Schema | This appendix contains the chain of trust XML schema, which can also be download at http://csrc.nist.gov/schema/piv/chain-of-trust/piv- chain-of-trust-1.0.xsd . <? xml version = "1.0" encoding = "utf - 8" ?> <xs:schema elementFormDefault = | |
| Appendix B | XML Sample PIV ChainOfTrust Record | <? xml version = "1.0" encoding = "utf - 8" ?> <nist:PIVChainOfTrust xmlns:nist = " http://csrc.nist.gov/ns/piv/chain - of - trust/1.0 " > <nist:EnrollmentRecord> <nist:PersonalInformation> <nist:PrimaryIdentifier> Doe </nist:PrimaryIdentif | |
| Appendix C | References | [EBTS] Criminal Justice Information Services. Electronic Biometric Transmission Specification (EBTS) 10.0, July 2, 2013, https://www.fbibiospecs.cjis.gov/Document/Get?fileName=Master %20EBTS%20v10%20-%20FINAL%2020130702.pdf [accessed 5/10/1 | |
| Appendix D | Glossary of Terms | Biometric The stored electronic information pertaining to a biometric. This information can be in terms of compressed pixels or in terms of some characteristic (e.g., patterns). Cardholder An individual possessing an issued PIV Card. Chai | |
| Appendix E | Acronyms | CHUID Card Holder Unique Identifier DN Distinguished Name EVSSL Extended Validation Secure Sockets Layer FASC-N Federal Agency Smart Credential Number FBCA Federal Bridge Certificate Authority FIPS Federal Information Processing Standa |
26 of 26.