NIST PIV and digital identity SP 800-157 Rev. 1 (Draft)
All1 Use of public key infrastructure (PKI) technology. PKI-based derived PIV credentials2 Use of non-PKI-based authenticators. Non-PKI authenticators rely on IdAM3 Technical Requirements 594Appendix A Digital Signature and Key Management Keys 811Appendix B Data Model and Interfaces for Removable or Wireless PKI-Based Cryptographic 840Appendix C Example Issuance Processes 1053Appendix D Physical Access 1151Appendix E Glossary 1360Appendix F Acronyms and Abbreviations 1407Appendix G Change Log 1436
| Ref | Title | Text | |
|---|---|---|---|
| Appendix D | Physical Access 1151 | 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 This appendix is normative. Credentials on PIV cards | |
| D.1 in D |
PACS Derived PIV Application Data Model and Representation | The data model and representation requirements for the derived PIV application are based on the requirements for the PIV Card application, as described in [SP800-73pt1] . Test requirements and test assertions for testing the derived PIV app | |
| D.1.1 in D.1 |
Derived PIV Application Identifier | Either the PIV card application identifier (AID) defined in Sec. 2.2 of [SP800-73pt1] or the derived PIV application AID, defined in Appendix B , SHALL be used. To maximize compatibility with existing PACS readers, the AID of the PIV card a | |
| D.1.2 in D.1 |
PACS Derived PIV Application Data Model Elements | The derived PIV application SHALL contain the following data objects when used for PACS: Derived CHUID Data Object The read access control rule for the derived CHUID data object is as described for the CHUID data object specified in Sec. 3 | |
| D.1.2.1 in D.1.2 |
PACS Derived PIV Application Data Object Containers and Associated Access Rules | Section 3.5 of [SP800-73pt1] provides the container IDs and access rules for the PACS data objects for a derived PIV application with the mappings in Table 3 . Table 3. Mapping of Data Objects Derived PIV Application Data Object PIV Card | |
| D.1.3 in D.1 |
Derived PIV PACS Application Data Objects Representation | The ASN.1 object identifiers (OID) and basic encoding rules – tag length value (BER- TLV) tags for the PACS data objects within the derived PIV application are the same as for the corresponding data objects of the PIV Card application (mapp | |
| D.1.4 in D.1 |
Derived PIV Application PACS Data Types and Representation 1282 | 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 This section describes the data types used in the derived PIV application PACS command interface. | |
| D.1.4.1 in D.1.4 |
Derived PIV Application PACS Key References and Security Conditions | Key references are assigned to keys and secrets of the derived PIV application. Table 8 of [SP800-78] and Table 4 of [SP800-73pt1] define the key reference values that SHALL be used on the derived PIV application interfaces with the mapping | |
| D.1.4.2 in D.1.4 |
Derived PIV Application PACS Cryptographic Algorithm and Mechanism Identi- | fiers The algorithm identifiers for the cryptographic algorithms that MAY be recognized for PACS use on the derived PIV application interfaces are the asymmetric identifiers specified in Table 9 and Table 10 of [SP800-78] . The cryptographi | |
| D.1.4.3 in D.1.4 |
Derived PIV Application Status Words | The status words that MAY be returned for PACS use on the derived PIV application command interface are as specified in Sec. 5.6 of [SP800-73pt1] . | |
| D.1.5 in D.1 |
Derived PIV PACS Authentication Mechanisms | The derived PIV application supports the following validation steps for PACS use: • Credential validation (CredV) is established by verifying the certificates retrieved from the derived PIV application and checking the validity and revocat | |
| D.2 in D |
Derived PIV Application Token Command Interface | This appendix contains the technical specifications for the command interface to the derived PIV application surfaced by the wireless interface to the derived PIV credential for PACS. The command interface for the derived PIV application SH | |
| D.2.1 in D.2 |
Authentication of an Individual for PACS | The two authentication mechanisms for PACS are PKI-CAK and SM-AUTH, which rely only on possession of the derived PIV credential for holder validation (HolderV). Therefore, an activation secret is not used for enhanced holder validation. | |
| D.3 in D |
Invalidation of PACS Derived PIV | A derived PIV credential that is used for physical access SHALL be invalidated when the associated PIV identity account is terminated or when the PACS credential or the device on which it resides has been lost or compromised. The IdMS SHALL |
14 of 60.