BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

B.1.2 Derived PIV Application Data Model Elements 871

NIST PIV and digital identity SP 800-157 Rev. 1 (Draft)
All changes in this version
first version loaded Appendix B Data Model and Interfaces for Removable or Wireless PKI-Based Cryptographic 840 part of B.1

Title

Derived PIV Application Data Model Elements 871

Control

872 873

874 875 876 877 878

879

880 881 882 883

884 885 886 887

888 889 890

891 892

893 894

895 896 897 898 899 900 901

902 903 904 905 906 The derived PIV application SHALL contain the following mandatory interoperable data object:

X.509 Certificate for Derived PIV Authentication The read access control rule for the X.509 certificate for derived PIV authentication and the PKI cryptographic function access rule for the corresponding private key are as described for the X.509 certificate for PIV authentication in Sec. 3.1.3 of [SP800-73pt1] .

The following data objects MAY also be present:

X.509 Certificate for Digital Signature The read access control rule for the X.509 certificate for digital signature and the PKI cryptographic function access rule for the corresponding private key are as described in Sec. 3.2.1 of [SP800-73pt1] .

X.509 Certificate for Key Management The read access control rule for the X.509 certificate for key management and the PKI cryptographic function access rule for the corresponding private key are as described in Sec. 3.2.2 of [SP800-73pt1] .

Discovery Object The requirements for the discovery object are as described in Sec. 3.3.2 of [SP800-73pt1] , except for the following:

• References to “PIV card application AID” are replaced by “derived PIV application AID.”

• References to “PIV card application PIN” are replaced by “derived PIV activation secret.”

• The first byte of the PIN usage policy SHALL be set to 0x40 to indicate that the virtual contact interface (VCI) is not implemented, 0x48 to indicate that a pairing code is required to establish a VCI, or 0x4C to indicate that no pairing code is required to establish a VCI. This also means that neither the global PIN nor the on-card biometric comparison (OCC) satisfies the access control rules for command execution and data object access within the derived PIV application.

Key History Object Up to 20 retired key management private keys MAY be stored in the derived PIV application. The Key History Object SHALL be present in the derived PIV application if the derived PIV application contains any retired key management private keys but MAY be present even if no such keys are present in the derived PIV application. The requirements for the key history object are as described in Sec. 3.3.3 of 907 908

909 910 911 912 913 914 915 916 917

918 919 920 921

922 923 924 925 926

927 928 929 930 931 932 933 934 935

936 937 938 939

940 941 942 943 [SP800-73pt1] , except for the following:

• References to keysWithOnCardCerts SHOULD be interpreted as keys for which the corresponding certificate is populated within the derived PIV application.
• References to keysWithOffCardCerts SHOULD be interpreted as keys for which the corresponding certificate is not populated within the derived PIV application.
• References to offCardCertURL SHOULD be interpreted as a URL that points to a file containing the certificates that correspond to all of the retired key management private keys within the derived PIV application, including those for which the corresponding certificate is stored within the derived PIV application.

Retired X.509 Certificates for Key Management The read access control rules for the retired X.509 certificates for key management and the PKI cryptographic function access rules for corresponding private keys are as described in Sec. 3.3.4 of [SP800-73pt1] .

Security Object The security object SHALL be present in the derived PIV application if the discovery object, the key history object, or the optional pairing code reference data container is present. The requirements for the security object are as described in Sec. 3.1.7 of [SP800-73pt1] , except for the following:

• The security object for a derived PIV application is signed using a private key whose corresponding public key is contained in a PIV content signing certificate that satisfies the requirements for certificates used to verify signatures on cardholder unique identifiers (CHUID), as specified in Sec. 4.2.1 of [FIPS201] .
• The signature field of the Security Object, tag 0xBB , SHALL include the derived PIV credential issuer’s certificate.
• The security object SHALL include all unsigned data objects (i.e., the discovery object, the key history object, and the pairing code reference data container) within the derived PIV application.

Secure Messaging Certificate Signer Derived PIV credential applications that support the virtual contact interface (VCI) capability SHALL include the secure messaging certificate signer object described in Sec. 3.3.7 of [SP800-73pt1] .

Pairing Code Reference Data Container Derived PIV credential applications that support the virtual contact interface (VCI) using a pairing code SHALL include the pairing code reference data container described in Sec. 3.3.8 of [SP800-73pt1] .