NIST releases guidelines for interoperable ID management credentials
Connecting state and local government leaders
NIST explains the use of new international standard enabling client applications to access identity credentials from different issuers, including the federal PIV card, and releases a proof-of-concept tool for using PIV with some common applications.
The operation of a new international standard for interoperability among digital identity credentials is explained in a new report from the National Institute of Standards and Technology, which also has released a proof-of-concept demonstration of the standard with the federal Personal Identity Verification (PIV) card and several client applications.
“Normalized access to information can reduce the potential for duplication of common ID management system services,” NIST says in Interagency Report (IR) 7611. “Without methods that provide standardized access and interfaces, portability and interoperability of identity credentials across different client applications is a programmatic and technical challenge,” according to the report, titled “Use of ISO/IEC 24727 -- Service Access Layer Interface for Identity.”
NIST also has released a draft of its updated interfaces for PIV cards that includes new optional features in Draft Special Publication 800-73-3, titled “Interfaces for Personal Identity Verification.”
Although government has standardized on digital credentials housed on smart cards as the format for identity verification in most of identity management systems, differences exist between different implementations.
“Information, requirements, and card-applications can vary from agency to agency, with numerous methods available to use and store information on smart cards,” NIST states in IR 7611. This can limit interoperability and result in duplication of verification services. “For instance, a PIV card and Transportation Worker Identity Credential card may not be easily and interoperably authenticated by the same application. These two cards support similar but not identical requirements and use different authentication mechanisms and security protocols.”
An international standard has been established to develop a normalized way for applications to access credentialing data on different platforms. The multipart international standard from the International Organization for Standardization (ISO)/International Electrotechnical Commission is ISO/IEC 24727, which allows any client application to communicate with any card application and enables authentication of cardholders and use of card services from many different identity cards and across many applications.
IR 7611 describes the use of ISO/IEC 24727, specifically with existing federal identity credentials such as PIV. It also describes the PIV application demonstrations developed by NIST. The proof-of-concept demonstrations are for Windows Logon, Linux Logon, e-mail signing and encryption, and Web authentication. The demo applications are available online here.
“Using ISO/IEC 24727 with these applications, the proof-of-concept will demonstrate the ability to enable client-applications to accept and use cards from diverse identity credentialing systems,” NIST states.
The interagency report is a high-level discussion minimizing technical details. A more technical publication, including an ISO/IEC 24727 reference implementation, will be released later.
The draft of SP 800-73-3 includes technical specifications for PIV card system standards. It specifies the PIV data model, command interface, client application programming interface and references to transitional interface specifications for the government’s interoperable PIV cards. This latest version of SP 800-73 would replace release 2 of the specifications, which were released in September.
Draft SP 800-73-3 introduces new, optional features including:
- On-card retention of retired Key Management keys and corresponding X.509 certificates for the purpose of deriving or decrypting data encryption keys;
- Use of the ECDH key-establishment scheme with the Key Management Key, as specified in SP 800-78-1; and
- Provisions for Non-Federal Issuer credentials. Draft SP 800-73-3 also includes editorial changes aimed at clarifying ambiguities.
The draft publication is published in four parts:
- Part 1, End Point PIV Card Application Namespace, Data Model and Representation
- Part 2, PIV Card Application Interface
- Part 3, PIV Client Application Programming Interface and
- Part 4, The PIV Transitional Data Model and Interfaces.
The multivolume specs can be downloaded here.
Comments on draft SP 800-73-3 can be submitted through September 13, 2009. Submit comments using the comment template form to PIV_comments@nist.gov with "Comments on Public Draft SP 800-73-3" in the subject line.