BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

D.1.5 Derived PIV PACS Authentication Mechanisms

NIST PIV and digital identity SP 800-157 Rev. 1 (Draft)
All changes in this version
first version loaded Appendix D Physical Access 1151 part of D.1

Title

Derived PIV PACS Authentication Mechanisms

Control

The derived PIV application supports the following validation steps for PACS use:

• Credential validation (CredV) is established by verifying the certificates retrieved from the derived PIV application and checking the validity and revocation status of these certificates.
• As with the PKI-CAK and SM-AUTH authentication mechanisms for the PIV card, 1307 1308 1309 1310

1311 1312 1313 1314 1315 1316

1317

1318 1319

1320

1321

1322 1323 1324 1325 1326 1327

1328

1329

1330

1331

1332

1333 1334 1335

1336

1337

1338 1339

1340 derived PIV holder validation (HolderV) for PACS is only established by possession of the derived PIV credential (i.e., these are single-factor authentication mechanisms).

Derived PIV applications that support PACS SHALL support PKI-CAK, a cryptographic challenge and response authentication protocol that uses the derived card authentication key as described in Appendix B.1.3 of [SP800-73pt1] . Derived PIV applications MAY also support SM-AUTH — a key establishment protocol that uses the derived PIV secure messaging key, as described in Appendix B.1.7 of [SP800-73pt1] . The following translations apply to the use of these protocols by a derived PIV credential:

• References to “PIV application” are replaced with “derived PIV application.”

• References to “Card auth certificate” are replaced with “derived card authentication certificate.”

• References to “SM parameters” are replaced with “derived SM parameters”

• References to “PIV Card app ID” are replaced with “derived PIV application ID.”