BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3.5.1 Home Agencies and Subscriber-Controlled Wallet 769

NIST PIV and digital identity SP 800-217 (Draft)
All changes in this version
first version loaded 3 Trust Agreements 574 part of 3.5

Title

Home Agencies and Subscriber-Controlled Wallet 769

Control

770 771 772 773

774

775 776

777 778

779 780

781 782

783 784

785

786 787 Subscriber-controlled wallets can be a trusted mechanism for PIV federation, even if they are not controlled by the home agency. The home agency can declare that subscriber- controlled wallets are sufficient to fulfill the role of a home agency IdP if the following are true:

• The home agency is able to validate the IdP software.

• The subscriber-controlled wallet can be deprovisioned by the home agency independent of IdP action.

To declare subscriber-controlled wallets as fulfilling a home agency IdP role, the home agency SHALL publish a record that indicates:

• A canonical identifier for the home agency onboarding subscriber-controlled wallets

• A list of public signing keys or the location of a machine-readable document that lists the public signing keys used to issue attribute bundles

• A list of agency identifiers and organizational affiliations covered by subscriber- controlled IdPs

• Technical contact information for the home agency

The keys listed in this record used for signing attribute bundles SHALL NOT be used for other purposes.