NIST releases two papers dealing with identity
09 September, 2009
category:
Two publications from the National Institute of Standards and Technology describe new capabilities for authentication systems using smart cards or other personal security devices within and outside federal government applications.
One report describes a NIST-led international standard, ISO/IEC 24727, which defines a general-purpose identity application programming interface (API). The other is a draft publication on refinements to the Personal Identity Verification (PIV) specification.
NIST is responsible for developing specifications for PIV cards required for the government under HSPD-12. The goal is to develop methods that allow each worker to have a PIV card that works with PIV equipment at all government agencies and with all card-reader equipment regardless of the manufacturer.
Because there is growing interest in using secure identity credentials, like PIV cards, for multiple applications beyond the federal workplace, NIST provided its smart card research expertise in the development of the ISO/IEC 24727 international standard. The standard aims to provide a set of authentication protocols and services common to identity management frameworks.
The new NIST report describes the standard’s general-purpose identity application programming interface, the “Service Access Layer Interface for Identity (SALII)”, which enables cards and readers to communicate and operate with applications. The report also describes a proof-of-concept experiment demonstrating that existing PIV cards and readers can work interoperable with ISO/IEC 24727. The applications tested included logging on to Windows or Linux systems, signing and encrypting email, and performing Web authentications.
The report on ISO 24727 can be downloaded here.
The other publication – Special Publication 800-73-3, Interfaces for Personal Identity Verification – provides specifications for PIV-Interoperable and PIV-Compatible cards issued by non-federal issuers, which also may be used with the federal system.
It also provides specifications designed to ease implementation, facilitate interoperability and ensure performance of PIV applications in the federal workplace. The new publication specifies a PIV data model, card edge interface and application programming interface. The report also provides editorial changes to clarify information in the earlier version.
The draft version of NIST SP 800-73-3 is open for public comment through Sept. 13. The document is available online here.
