BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

B.1.2.1 Derived PIV Application Data Object Containers and Associated Access Rules 944

NIST PIV and digital identity SP 800-157 Rev. 1 (Draft)
All changes in this version
first version loaded Appendix B Data Model and Interfaces for Removable or Wireless PKI-Based Cryptographic 840 part of B.1.2

Title

Derived PIV Application Data Object Containers and Associated Access Rules 944

Control

945 946 947

948 949 950 951

952 953 954

955 956

957 958 959 960 961

962 963 964 Section 3.5 of [SP800-73pt1] provides the container IDs and access rules for the mandatory and optional data objects for a derived PIV application with the following mappings:

Table 1. Mapping of Data Objects

Derived PIV Application Data Object PIV Card Application Data Object

X.509 Certificate for Derived PIV Authentication X.509 Certificate for PIV Authentication

Security Object Security Object X.509 Certificate for Digital Signature X.509 Certificate for Digital Signature X.509 Certificate for Key Management X.509 Certificate for Key Management Discovery Object Discovery Object Key History Object Key History Object Retired X.509 Certificate for Key Management [1:20] Retired X.509 Certificate for Key Management [1:20] Secure Messaging Certificate Signer Secure Messaging Certificate Signer Pairing Code Reference Data Container Pairing Code Reference Data Container

The detailed data model specifications for each of the data objects of the derived PIV application are the same as the specifications for the corresponding data objects (mapped per Table 1 ) of the PIV Card application as described in Appendix A of [SP800-73pt1] , except for the following:

• The security object for the derived PIV application is optional. It is required if the optional discovery object, the optional key history object, or the optional pairing code reference data container is present.

• The minimum capacity for the security object container SHALL be 3000 bytes to allow space for the derived PIV credential issuer’s certificate.