BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2 Background

NIST PIV and digital identity IR 7863
All changes in this version
first version loaded 2 Background

Title

Background

Control

The digital signature key (DSK) is intended to sign data, such as electronic forms, documents or electronic mail. Operations using the DSK can be performed after the PIV Card has been activated. To protect the DSK against misuse after activation, each subsequent private key operation requires an explicit user action. The PIV Card incorporates a single mechanism for both authenticating the cardholder and expressing explicit user action: entry of the user PIN. 1 The user PIN must be presented to the PIV Card to activate the card for privileged/protected operations or to perform a signing operation with the DSK. If the user is prompted for the PIN, and that value is presented to the PIV Card for each operation, the requirement for explicit user action is clearly satisfied. This ensures that the user is present and intended to generate a signature with the DSK each time a signature generation operation is performed. However, ensuring that the PIN is re-entered by the user for each signature operation requires system level controls outside the boundaries of the PIV Card. In addition, for some applications it is considered impractical to require the cardholder to enter the PIN for each signature. For example, users may be required by policy to sign every email message. When the user is sending a large number of email messages in a short period, repeatedly entering the PIN greatly decreases usability. In such cases, the application or middleware can be designed to retain (or cache) the smart card PIN and present it on behalf of the user. However, caching the PIN may allow the application or middleware to present the PIN without the cardholder’s knowledge. The following sections identify possible architectures for systems that use the DSK, and define the minimum security objectives and controls that constitute explicit user action for the PIN ALWAYS access condition of the DSK.

1 FIPS 201-2 introduces the option for PIV Cards to implement on-card fingerprint biometric comparison, in addition to the PIN, as a mechanism to authenticate the cardholder to the card; however, the recommendations in this document only apply to the PIN.