2.1 Derived PIV Credential Life Cycle Activities
All changes in this version
Title
Derived PIV Credential Life Cycle Activities
Control
The derived PIV credential life cycle consists of the activities described above: initial issuance, maintenance, and termination. The activities at the manufacturer during fabrication and pre-personalization of the authenticator (as applicable) are not considered part of this life cycle model. Figure 1 presents the PKI-based derived PIV credential life cycle activities alongside the PIV Card life cycle activities. Figure 2 presents the corresponding life cycle activities for non-PKI-based derived PIV credentials.
The life cycle of a derived PIV credential begins with issuance on an approved device or authenticator associated with the applicant. This may be part of issuing a PIV Card or a subsequent process. Mobile devices with derived PIV credentials are managed, as described in [SP800-124] .
The maintenance activities for a PKI-based derived PIV credential are the same as for other X.509 public key certificates. Certificate re-key is typically used to replace a certificate that is nearing expiration. Certificate modification replaces a certificate if information about the subscriber that appears on the certificate (e.g., their name) needs to be changed.
While non-PKI-based derived PIV credentials are not typically re-keyed and do not contain PII about the subscriber, they may require maintenance, such as replacing the activation secret or biometric factor used to activate the physical authenticator. Instead of re-keying, the current non-PKI-based derived PIV credential SHALL be invalidated and the initial issuance process (except for the device or authenticator approval process) repeated to bind a new derived PIV credential. When a non-PKI-based derived PIV credential is lost, stolen, or damaged, the issuer SHALL invalidate the credential to prevent its further use.
When an authenticator with the private key that corresponds to a PKI-based derived PIV credential is lost, stolen, or damaged, the issuer SHALL prevent further use of the affected credential by either collecting and destroying the associated private key or Fig. 1. PKI-based derived PIV credential life cycle activities Revoke certificates or zeroize private keys PIV Identity Account PKI-based Derived PIV Credential (DPC) Lifecycle PIV Card Lifecycle
Revoke DPC or zeroize private key PIV Card Request
ID Proofing & Registration
PIV Card Issuance
PKI Credential Issuance
PIV Card Usage
PIV Card Termination Reissuance
Updates
PIV Card Maintenance DPC Request
PIV PKI-AUTH*
DPC Issuance
DPC Usage
DPC Termination DPC Maintenance Start
End Rekey/ Modification
*Authentication with PIV Authentication certificate Status Check Validation/Monitoring Binding
Fig. 2. Non-PKI-based derived PIV credential life cycle activities
7 Authentication
Revoke certificates or zeroize private keys PIV Identity Account Non-PKI-based Derived PIV Credential (DPC) Lifecycle PIV Card Lifecycle
Invalidate authenticator PIV Card Request
ID Proofing & Registration
PIV Card Issuance
PKI Credential Issuance
PIV Card Usage
PIV Card Termination Reissuance
Updates
PIV Card Maintenance DPC Request
PIV PKI-AUTH*
DPC Issuance
DPC Usage
DPC Termination Start
End
*Authentication with PIV Authentication certificate Authenticator binding
DPC Maintenance Password Reset revoking the associated certificate. These processes are described in Sec. 2.4 . If the 410 411 412
413 414 415 416 417 418 419
420 421 422 423 424 425 426
427 428 429 430 431 432 433 434 435 436
437 438 439 440
441 442 443 444 445
446 447 subscriber becomes ineligible to possess a PIV Card, all derived PIV credentials for that subscriber are revoked or otherwise invalidated.