BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2 Use of non-PKI-based authenticators. Non-PKI authenticators rely on IdAM

NIST PIV and digital identity SP 800-157 Rev. 1 (Draft)
All changes in this version
first version loaded 2 Use of non-PKI-based authenticators. Non-PKI authenticators rely on IdAM

Title

Use of non-PKI-based authenticators. Non-PKI authenticators rely on IdAM

Control

infrastructure to allow for direct authentication by the home agency. Cross- domain use of non-PKI-based derived PIV credentials is supported through federation protocols, as specified in [SP800-217] . The derived PIV credentials specified in this document are issued at authentication 288 289 290 291

292 293 294 295 296 297 298 299 300

301 302 303 304 305

306

307 308 309

310

311 312 313 314 315 316

317 318 319 320

321 322 323 324 assurance level (AAL) 2 or 3. Derived PIV credentials are issued at identity assurance level (IAL) 3, which is the identity proofing and issuance level associated with the PIV Card and bound to the PIV identity account, as per [FIPS201] .

Derived PIV credentials are based on the general concept of post-enrollment authenticator binding in [SP800-63B] , which leverages identity proofing and vetting associated with an existing subscriber account using current and valid authenticators to bind additional authenticators to that account. Identity proofing and vetting processes do not have to be repeated to issue a derived PIV credential. Instead, the user proves possession and control of a valid PIV Card to bind a derived PIV credential to their PIV identity account. The PIV Card may be used as the basis for issuing other types of derived credentials, but those credentials would not be bound to the PIV identity account and are therefore outside of this document’s scope.

While non-PKI derived PIV credentials are different in nature from PIV Cards and PKI-based derived PIV credentials, they are nevertheless considered to be derived PIV credentials due to their binding to the cardholder’s PIV identity account. Other authenticator requirements such as strength (AAL) and phishing resistance are additionally required for suitability as derived PIV credentials.

Derived PIV credentials are:

• Issued based on possession and control of the PIV Card,
• Represented in the PIV identity account at the home agency IdMS, and
• Issued in accordance with this document.

This document provides technical guidelines on:

• The primary life cycle activities for the derived PIV credential (i.e., initial issuance, maintenance, and termination) and the requirements for each activity to ensure security and
• The derived PIV credential, including cryptographic specifications, permitted implementation types, mechanisms for activation, use of the credential, and certificate policies, if applicable.

This publication includes an informative appendix that provides recommendations for including digital signature and key management keys on devices that host a derived PIV credential. It also includes an annex with guidelines for the issuance and use of derived PIV credentials for facility access.