IA-05(02) Public Key-based Authentication
NIST SP 800-53 (controls) 5.1.1+u4
All changes in this version
All changes in this version
Title
Public Key-based Authentication
Control
(a) For public key-based authentication:
(1) Enforce authorized access to the corresponding private key; and
(2) Map the authenticated identity to the account of the individual or group; and
(b) When public key infrastructure (PKI) is used:
(1) Validate certificates by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status information; and
(2) Implement a local cache of revocation data to support path discovery and validation.
Discussion
Public key cryptography is a valid authentication mechanism for individuals, machines, and devices. For PKI solutions, status information for certification paths includes certificate revocation lists or certificate status protocol responses. For PIV cards, certificate validation involves the construction and verification of a certification path to the Common Policy Root trust anchor, which includes certificate policy processing. Implementing a local cache of revocation data to support path discovery and validation also supports system availability in situations where organizations are unable to access revocation information via the network.
Related controls
ia-3, sc-17
STIG rules that implement this control 48
Apple macOS 15 (Sequoia) V1R8
- APPL-15-001060 CAT II The macOS system must set smart card certificate trust to moderate.
- APPL-15-001150 CAT I The macOS system must disable password authentication for SSH.
- APPL-15-003020 CAT II The macOS system must enforce smart card authentication.
- APPL-15-003030 CAT II The macOS system must allow smart card authentication.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-001060 CAT II The macOS system must set smart card certificate trust to moderate.
- APPL-26-001150 CAT I The macOS system must disable password authentication for SSH.
- APPL-26-003020 CAT II The macOS system must enforce smart card authentication.
- APPL-26-003030 CAT II The macOS system must allow smart card authentication.
Application Security and Development V6R5
- APSC-DV-001810 CAT I The application, when utilizing PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.
- APSC-DV-001820 CAT I The application, when using PKI-based authentication, must enforce authorized access to the corresponding private key.
- APSC-DV-001830 CAT II The application must map the authenticated identity to the individual user or group account for PKI-based authentication.
- APSC-DV-001840 CAT II The application, for PKI-based authentication, must implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-254020 CAT II Ubuntu 22.04 LTS must ensure SSSD performs certificate path validation, including revocation checking, against a trusted anchor for PKI-based authentication.
- UBTU-22-254030 CAT II Ubuntu 22.04 LTS must map the authenticated identity to the user or group account for PKI-based authentication.
- UBTU-22-612030 CAT II Ubuntu 22.04 LTS, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.
- UBTU-22-612035 CAT II Ubuntu 22.04 LTS for PKI-based authentication, must implement a local cache of revocation data in case of the inability to access revocation information via the network.
- UBTU-22-612040 CAT I Ubuntu 22.04 LTS must map the authenticated identity to the user or group account for PKI-based authentication.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-400360 CAT II Ubuntu 24.04 LTS, for PKI-based authentication, SSSD must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.
- UBTU-24-400370 CAT I Ubuntu 24.04 LTS must map the authenticated identity to the user or group account for PKI-based authentication.
- UBTU-24-400375 CAT II Ubuntu 24.04 LTS, for PKI-based authentication, Privileged Access Management (PAM) must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.
- UBTU-24-400380 CAT II Ubuntu 24.04 LTS for PKI-based authentication, must implement a local cache of revocation data in case of the inability to access revocation information via the network.
Google Chrome Current Windows V2R11
- DTBC-0037 CAT II Online revocation checks must be performed.
Microsoft Edge V2R5
- EDGE-00-000030 CAT II Online revocation checks must be performed.
Microsoft Windows 11 V2R11
- WN11-PK-000005 CAT II The DoW Root CA certificates must be installed in the Trusted Root Store.
- WN11-PK-000010 CAT II The External Root CA certificates must be installed in the Trusted Root Store on unclassified systems.
Microsoft Windows Server 2022 V2R11
- WN22-DC-000280 CAT II Windows Server 2022 domain controllers must have a PKI server certificate.
- WN22-DC-000290 CAT I Windows Server 2022 domain controller PKI certificates must be issued by the DoW PKI or an approved External Certificate Authority (ECA).
- WN22-DC-000300 CAT I Windows Server 2022 PKI certificates associated with user accounts must be issued by a DoW PKI or an approved External Certificate Authority (ECA).
- WN22-PK-000010 CAT II Windows Server 2022 must have the DoW Root Certificate Authority (CA) certificates installed in the Trusted Root Store.
- WN22-PK-000020 CAT II Windows Server 2022 must have the DoW Interoperability Root Certificate Authority (CA) cross-certificates installed in the Untrusted Certificates Store on unclassified systems.
- WN22-PK-000030 CAT II Windows Server 2022 must have the US DoW CCEB Interoperability Root CA cross-certificates in the Untrusted Certificates Store on unclassified systems.
- WN22-SO-000350 CAT II Windows Server 2022 users must be required to enter a password to access private keys stored on the computer.
Microsoft Windows Server 2025 V1R4
- WN25-DC-000280 CAT II Windows Server 2025 domain controllers must have a PKI server certificate.
- WN25-DC-000290 CAT I Windows Server 2025 domain Controller PKI certificates must be issued by the DoW PKI or an approved External Certificate Authority (ECA).
- WN25-DC-000300 CAT I Windows Server 2025 PKI certificates associated with user accounts must be issued by a DoW PKI or an approved External Certificate Authority (ECA).
- WN25-PK-000010 CAT II Windows Server 2025 must have the DoW Root Certificate Authority (CA) certificates installed in the Trusted Root Store.
- WN25-PK-000020 CAT II Windows Server 2025 must have the DoW Interoperability Root Certificate Authority (CA) cross-certificates installed in the Untrusted Certificates Store on unclassified systems.
- WN25-PK-000030 CAT II Windows Server 2025 must have the US DoW CCEB Interoperability Root CA cross-certificates in the Untrusted Certificates Store on unclassified systems.
- WN25-SO-000350 CAT II Windows Server 2025 users must be required to enter a password to access private keys stored on the computer.
Mozilla Firefox V6R9
- FFOX-00-000003 CAT II Firefox must be configured to ask which certificate to present to a website when a certificate is required.
- FFOX-00-000016 CAT II Firefox must have the DoW root certificates installed.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-701240 CAT II RHEL 10 must, for PKI-based authentication, enforce authorized access to the corresponding private key.
- RHEL-10-701270 CAT II RHEL 10 must, for PKI-based authentication, validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.
- RHEL-10-701280 CAT II RHEL 10 must map the authenticated identity to the user or group account for public key infrastructure (PKI)-based authentication.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-611190 CAT II RHEL 9, for PKI-based authentication, must enforce authorized access to the corresponding private key.
- RHEL-09-631010 CAT II RHEL 9, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.
- RHEL-09-631015 CAT II RHEL 9 must map the authenticated identity to the user or group account for PKI-based authentication.
Samsung Android 16 COBO Y26M10
- KNOX-16-000700 CAT III Samsung Android must not accept the certificate when it cannot establish a connection to determine the validity of a certificate.