BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

1 Introduction

NIST PIV and digital identity IR 7863
All changes in this version
first version loaded 1 Introduction

Title

Introduction

Control

Federal Information Processing Standard (FIPS) 201 defines the Personal Identity Verification (PIV) Card and supporting process requirements. A private cryptographic key, the digital signature key (DSK), is specified for digitally signing messages and data. The DSK is generated on the card and is never exported; all operations with this private key are performed by the PIV Card. FIPS 201 requires authentication of the cardholder via “explicit user action” each time the DSK is used to perform a cryptographic operation. NIST Special Publication 800-73 specifies the “PIN ALWAYS” access condition for the DSK to ensure that the Personal Identification Number (PIN) is submitted to the card for each requested cryptographic operation. However, FIPS 201 does not mandate the use of card readers with integrated PIN entry pads. As a result, the PIV Card itself cannot differentiate between a freshly supplied PIN and a PIN cached by the calling application or system. This specification clarifies the requirement for “explicit user action” and specifies a range of implementation options that satisfy this requirement, in order to ensure a consistent and reliable level of security.