BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3 Architectures

NIST PIV and digital identity IR 7863
All changes in this version
first version loaded 3 Architectures

Title

Architectures

Control

There are two basic configurations for a PIV compliant system that leverages the DSK: (1) A computing system can be designed so that the PIN is never exposed to the operating system, middleware, or applications. The components of this system are the host computer with an external smart card reader with keypad, and the PIV Card. In this case, the PIN is submitted from the user “directly” to the PIV Card. The application or operating system cannot cache the PIN so enforcing the PIN ALWAYS requirement is sufficient to confirm explicit user action for each DSK private key operation. (2) A computing system can be designed so that the PIN is entered via the host computer’s keyboard. The components of this system are the host computer system with an internal or external smart card reader without keypad, and the PIV Card. In this case, the PIN is entered into the keyboard and is processed by the operating system, middleware, or application before submission to the PIV Card. In configuration (1), it is the external reader’s responsibility to ensure that the PIN is supplied to the PIV Card as a result of an explicit action. In configuration (2), the host system software, in combination, has the responsibility to ensure that the PIN is supplied to the PIV Card as a result of an explicit action. The following section specifies implementation guidelines for PIV system components.