BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3.1.2 Cryptographic Specifications 626

NIST PIV and digital identity SP 800-157 Rev. 1 (Draft)
All changes in this version
first version loaded 3 Technical Requirements 594 part of 3.1

Title

Cryptographic Specifications 626

Control

627 628 629

630 631 632 633 634 635

636 637 638 639 640 641 642

643 644 645 646 647

648 649 650 651

652 653 654 655 656 657 658 659

660 661 662 The cryptographic algorithm and key size requirements for the derived PIV authentication certificates and private keys are the same as the requirements for the PIV authentication certificate and private key, as specified in [SP800-78] .

For derived PIV authentication certificates issued under id-fpki-common- pivAuth-derived-hardware (AAL3), the derived PIV authentication key pair SHALL be generated within a cryptographic module that meets the requirements of [SP800-63B] Sec. 2.3.2, including being validated to [FIPS140] Level 2 or higher with Level 3 physical security to protect the derived PIV authentication private key while in storage and not permitting export of the private key.

For derived PIV authentication certificates issued under id-fpki-common- pivAuth-derived (AAL2), the derived PIV authentication key pair SHALL be generated within a cryptographic module that has been validated to [FIPS140] Level 1 or higher. If the key pair is generated outside of the authenticator itself, the private key SHALL be transferred via an authenticated protected channel as defined in [SP800-63B] , and the authenticator SHALL meet the requirements of [SP800-63B] Sec. 2.2.2, including being validated to [FIPS140] Level 1 or higher.