BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

D.1.2 PACS Derived PIV Application Data Model Elements

NIST PIV and digital identity SP 800-157 Rev. 1 (Draft)
All changes in this version
first version loaded Appendix D Physical Access 1151 part of D.1

Title

PACS Derived PIV Application Data Model Elements

Control

The derived PIV application SHALL contain the following data objects when used for PACS:

Derived CHUID Data Object The read access control rule for the derived CHUID data object is as described for the CHUID data object specified in Sec. 3.1.2 of [SP800-73pt1] except that it SHALL be accessible only via the contactless interface. The FASC-N and card UUID contained within the derived CHUID data object SHALL be distinct from the corresponding values on the PIV card and any other derived PIV credential module. 1

1 This will generally require multiple entries for the cardholder on the access control list — one for each of their derived PIV credential modules and the PIV card. This data object is required for access control systems that use the FASC-N or the card UUID in the CHUID to look up authorization information rapidly. The derived CHUID SHALL NOT be used for authentication since that authentication method has been withdrawn. If the optional cardholder UUID is included in the derived CHUID data object, it SHALL contain the same value as the cardholder’s PIV card.

The FASC-N, card UUID, expiration date, and, if present, cardholder UUID SHALL NOT be modified post-issuance.

The expiration date included in the derived CHUID data object SHALL be the same as the expiration date of the derived card authentication certificate. It SHALL be no later than the expiration date of the content signing certificate. There is no requirement to align the expiration date included in the derived CHUID data object with the expiration date of the CHUID data object on the cardholder’s PIV Card or with other certificates on the derived PIV credential.

X.509 Certificate for Derived Card Authentication This data object is required for the PKI-CAK authentication mechanism. The read access control rule for the X.509 certificate for derived card authentication and the PKI cryptographic function access rule for the corresponding private key 1221 1222 1223 1224 1225

1226

1227 1228 1229 1230 1231 1232 1233 1234

1235 1236 1237 1238

1239 1240 1241

1242 1243 are as described for the X.509 certificate for card authentication in Sec. 3.1.4 of [SP800-73pt1] with the exception that they SHALL only be accessible via the contactless interface. The card UUID value SHALL be the same as the one in the derived CHUID data object.

The derived PIV application MAY contain the following data objects:

Derived PIV Secure Messaging Key and Derived Card Verifiable Certificate The PKI cryptographic function access rule for the derived PIV secure messaging key and the read access control rule for the derived card verifiable certificate (DCVC) are as described for the secure messaging key specified in Sec. 5.1.2 of [SP800-73pt1] and Sec. 4.1.5 of [SP800-73pt2] , respectively, except that they SHALL only be accessible via the contactless interface. These data objects are required for the SM-AUTH authentication mechanism. The card UUID in the derived card verifiable certificate SHALL be the same as that in the derived CHUID data object.

Secure Messaging Certificate Signer Object The read access control rule for the secure messaging certificate signer object is as described in Sec. 3.3.7 of [SP800-73pt1] . This data object is required for the SM- AUTH authentication mechanism.