BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

B.1.5 Derived PIV Authentication Mechanisms

NIST PIV and digital identity SP 800-157 Rev. 1 (Draft)
All changes in this version
first version loaded Appendix B Data Model and Interfaces for Removable or Wireless PKI-Based Cryptographic 840 part of B.1

Title

Derived PIV Authentication Mechanisms

Control

The derived PIV application supports the following validation steps:
• Credential validation (CredV) is established by verifying the certificates retrieved 986 987 988

989 990 991 992

993 994 995 996

997

998 999

1000

1001 1002

1003 1004 1005 1006 1007 1008

1009

1010

1011

1012

1013

1014

1015

1016

1017 1018 1019 from the derived PIV application and checking the validity and revocation status of these certificates.

• Derived PIV application holder validation (HolderV) is established when the authenticator holder proves knowledge of the derived PIV activation secret associated with the derived PIV credential that contains valid and unrevoked certificates.

The derived PIV application facilitates a single authentication mechanism, which is a cryptographic challenge and response authentication protocol that uses the derived PIV authentication private key as described in Appendix B.1.2 of [SP800-73pt1] with the following translations:

• References to “PIV application” are replaced with “derived PIV application.”

• References to “PIV auth certificate” are replaced with “derived PIV authentication certificate.”

• References to “PIV Card app ID” are replaced with “derived PIV application ID.”

Authentication can also be performed wirelessly over a virtual contact interface (VCI) if a VCI has been established with the derived PIV application.