BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2.2.1 PKI-Based Derived PIV Credential Issuance

NIST PIV and digital identity SP 800-157 Rev. 1 (Draft)
All changes in this version
first version loaded 2 Use of non-PKI-based authenticators. Non-PKI authenticators rely on IdAM part of 2.2

Title

PKI-Based Derived PIV Credential Issuance

Control

Issuing a PKI-based derived PIV credential requires the generation of a public/private key pair followed by the creation of a corresponding authentication certificate by the certificate authority (CA). For a derived PIV credential capable of being used at AAL3, all of the following requirements apply:

• The cardholder SHALL be authenticated using the PIV-AUTH authentication mechanism specified in [FIPS201] .

• The key pair SHALL be generated in the device (authenticator or endpoint) that will house the derived PIV credential.

• The device SHALL send the certificate signing request containing the public key to the CA, which SHALL return an X.509 authentication certificate that SHALL be stored on the device (authenticator or endpoint).

• The CA SHALL retain a copy of the issued certificate for use should revocation be required.

For a derived PIV credential issued for use only at AAL2, the same procedure MAY be used, or the CA SHALL generate a key pair and corresponding certificate and send the certificate and private key to the device over an authenticated protected channel for installation. Following installation, the CA SHALL promptly and securely delete its copy of the private key.

The private key SHALL be stored on the device in a manner that makes it accessible only upon entry of the correct activation secret or presentation of a biometric factor that matches a stored biometric image or template. This SHALL be accomplished by using strong access controls for the stored private key or through decryption of the private key using an encryption key derived from the activation secret.