NIST PIV and digital identity SP 800-157 Rev. 1 (Draft)
All1 Use of public key infrastructure (PKI) technology. PKI-based derived PIV credentials2 Use of non-PKI-based authenticators. Non-PKI authenticators rely on IdAM3 Technical Requirements 594Appendix A Digital Signature and Key Management Keys 811Appendix B Data Model and Interfaces for Removable or Wireless PKI-Based Cryptographic 840Appendix C Example Issuance Processes 1053Appendix D Physical Access 1151Appendix E Glossary 1360Appendix F Acronyms and Abbreviations 1407Appendix G Change Log 1436
| Ref | Title | Text | |
|---|---|---|---|
| 3 | Technical Requirements 594 | 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 This section is normative. This section describes technical requirements for PKI-based and non-PKI-based der | |
| 3.1 in 3 |
PKI-Based Derived PIV Credentials | A PKI-based derived PIV credential is a derived PIV authentication certificate, which is an X.509 public key certificate that has been issued in accordance with the requirements of this document and [COMMON] . All derived PIV credentials cr | |
| 3.1.1 in 3.1 |
Certificate Policies for PKI-Based Derived PIV Credentials | Derived PIV authentication certificates SHALL be issued under either the id-fpki- common-derived-pivAuth-hardware policy (satisfying [SP800-63B] AAL3) or the id-fpki-common-derived-pivAuth policy (satisfying AAL2) of [COMMON] . All derived | |
| 3.1.2 in 3.1 |
Cryptographic Specifications 626 | 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 The cryptographic algorithm and key size requirements for the derived PIV authentication c | |
| 3.1.3 in 3.1 |
Allowable Authenticator Types | A multi-factor cryptographic authenticator as specified in [SP800-63B] Sec. 3.1.7.1 SHALL be used for PKI-based derived PIV authentication. The authenticator SHALL be phishing- resistant, as described in [SP800-63B] Sec. 3.2.5. Authenticato | |
| 3.1.4 in 3.1 |
Activation Data | Activation of PKI-based derived PIV authenticators using an activation secret SHALL meet the requirements of [SP800-63B] Sec. 3.2.10. Activation using a biometric characteristic SHALL meet the requirements of [SP800-63B] Sec. 3.2.3. If the | |
| 3.2 in 3 |
Non-PKI-Based Derived PIV Credentials | Non-PKI-based credentials SHALL only be used to authenticate to verifiers that are authorized by the home agency of the associated PIV Card. All verifiers of non-PKI-based derived PIV credentials SHALL access the home agency IdMS in order t | |
| 3.2.1 in 3.2 |
Allowable Authenticator Types | Multi-factor or single-factor cryptographic authenticators as specified in [SP800-63B] Sec. 3.1.7.1 and Sec. 3.1.6.1, respectively, SHALL be used for non-PKI-based derived PIV authentication. Cryptographic authenticators SHALL be phishing-r | |
| 3.2.2 in 3.2 |
Cryptographic Specifications | Authenticators used as non-PKI-based derived PIV credentials SHALL meet the cryptographic requirements specified in [SP800-63B] Sec. 3.1 for the corresponding authenticator type. | |
| 3.2.3 in 3.2 |
Activation Data | Activation of the derived PIV credential using an activation secret SHALL meet the requirements of [SP800-63B] Sec. 3.2.10. Activation using a biometric characteristic SHALL meet the requirements of [SP800-63B] Sec. 3.2.3. If the activatio |
10 of 60.