BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

B.2.1 Authentication of an Individual

NIST PIV and digital identity SP 800-157 Rev. 1 (Draft)
All changes in this version
first version loaded Appendix B Data Model and Interfaces for Removable or Wireless PKI-Based Cryptographic 840 part of B.2

Title

Authentication of an Individual

Control

Knowledge of a secret (specifically the derived PIV activation secret) is how an individual can be authenticated to the derived PIV application.

The derived PIV activation secret SHALL be between 6 and 8 bytes in length. If the actual length of the derived PIV activation secret is less than 8 bytes, it SHALL be padded to 8 bytes with 0xFF when presented to the token command interface. The 0xFF padding bytes SHALL be appended to the actual value of the secret. The bytes that comprise the derived PIV activation secret SHALL be limited to values 0x30 – 0x39 , 0x41 – 0x5A , and 0x61 – 0x7A : the ASCII values for the decimal digits ‘0’ – ‘9’; upper case characters ‘A’ – ‘Z’; and lower case characters ‘a’ – ‘z’. For example,

• Actual derived PIV activation secret: “Part21” or (hexadecimal) 50 61 72 74 32 31

• Padded derived PIV activation secret presented to the card command interface (hexadecimal): 50 61 72 74 32 31 FF FF

The derived PIV application SHALL enforce the minimum length requirement of 6 bytes for the derived PIV activation secret (i.e., SHALL verify that at least the first 6 bytes of the value presented to the card command interface are in the range 0x30 – 0x39 , 0x41 – 0x5A , or 0x61 – 0x7A ) as well as the other formatting requirements specified in this section.