NIST: Personal Identity Verification (PIV) of Federal Employees and Contractors

https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-3.pdf

by stefankuehnel • 2 years ago

114 49 2 years ago

nvlpubs.nist.gov

I'm glad they explain how to write names on the card for even very long names, like: "Dingo Pontooroomooloo Vaasa Silvaan Beenelong Wooloomooloo Warrandyte Warwarnambool"

deepsun• 2 years ago

How?

bee_rider• 2 years ago

Table 4-1 on page 44, I think.

mschuster91• 2 years ago

To send you down a bit of a rabbit hole: ICAOs standard 9303 [1] on how to abbreviate long names for use on the MRZ of international travel documents uses the exact same examples.

[1] https://www.icao.int/publications/Documents/9303_p4_cons_en.... (page 30)

omoikane• 2 years ago

I wonder how they came up with this. I thought it was unique to FIPS 201 but looks like ICAO has it too. Is there like a lorem ipsum generator but for text that looks like names?

doctor_eval2• 2 years ago

That is weird. Dingo is an Australian native dog. Wooloomooloo and Bennelong (slight spelling difference) are in Sydney, Australia. Warrandyte is an outer suburb north of Melbourne. Warnambool (not Warwarnambool) is a town to the west of Melbourne. I've been to all of them.

Why so much Australian in this example?!

xarope• 2 years ago

some involvement with the australian outback and NASA at some point in history?

rkeene27• 2 years ago

PIV and CAC (DOD, but is now a PIV with CAC-NG) has been around for a very long time. Passwords haven't been permitted in the US Government since a short time after the signing of HSPD-12 in 2004.

joesnark727• 2 years ago

Lol

codeslave13• 2 years ago

Thats blatantly false. I just left an agency with passwords on all thier unix boxed. With zero rotation policies. Its a shitshow

Abekkus• 2 years ago

You both can be right, US Gov will write well-intentioned policy that none of their live teams can keep up with, even after 20 years, and I haven't yet seen a practical enterprise authentication architecture that doesn't fall back on passwords somewhere.

jhbadger• 2 years ago

But could you get into the network to access the UNIX boxes without a PIV card? That's how the NIH works -- the UNIX boxes do have passwords, but unless you are on campus you have to connect to the VPN with your PIV card first.

pigbearpig• 2 years ago

Maybe, just maybe it’s possible the US Government is an enormous entity and there could be some inconsistencies.

torstenvl• 2 years ago

It depends. There are IL2-exposed sites that permit password login, and interface with IL4 backends (milConnect and DEERS, MOL and MCTFS, etc.). I'm not sure what the ATO process looks like for those systems though. But you're not getting direct IL4+ access without a CAC somewhere.

jki275• 2 years ago

LOL.

Nice theory, but has no actual connection to the real world.

tiffanyh• 2 years ago

(2022)

wolverine876• 2 years ago

(PDF)

sparcpile• 2 years ago

I use a PIV Badge as a FAA contractor. We're told to never use the PIV badge as a means of identification anywhere. The documentation doubles down by mentioning to never use it as an ID at an airport. I've been told it is because FAA employees would use it and the airline workers would then freak out that the employee was there to inspect them.

plasma_beam• 2 years ago

I’m a contractor for DHS and heard a rumor a long time ago that you could get special treatment with TSA agents when using your DHS badge as identification. Yeah no. Doesn’t work :) Southwest did give me a free drink one time though and thanked me for my service - they saw the laptop and piv plugged in while I was working on the plane and thought I was military. I did correct them but also took the free drink.

saghm• 2 years ago

We're told to never use the PIV badge as a means of identification anywhere

I must be misunderstanding what you mean by this, because I'm struggling to fathom what possible use a "personal identity verification badge" could possibly have _other_ than as a means of identifying yourself.

aimonster2• 2 years ago

You don't use your PIV anywhere because you don't want your creds--certs, etc--to be swiped. You use it for facility access and PKI.

lxgr4• 2 years ago

Isn’t there a PIN to protect these? Also, I’m assuming GP meant “not visually displaying as ID”, not “trying to swipe the PIV at a random computer”?

hendler• 2 years ago

Not sure why this was posted and made it to the front page but identity is certainly critical infrastructure with further challenges coming soon.

Surprised no one has mentioned the open sourcing of the Orb in this context https://worldcoin.org/blog/engineering/worldcoin-foundation-...

deathanatos2• 2 years ago

I had to get one of these recently. (And thankfully, I am done with the government for a while.) If you want a process that will make you believe "wow, we have too much bureaucracy in this country", then get a PIV card. By the end, I thought I was definitely just being strung along in some sort of eternal joke, and had started joking that the reward for completing forms was more forms.

So many forms. Randomly imposed, arbitrary deadlines that were utterly impossible. (And … not really deadlines, since you can just email and say a polite "how about no" & magic extensions happen.) Forms that were submitted by encrypting them into a zip, and then sending zip+password in an email…?

The person who fingerprinted me was royally annoyed at me for showing up with all the materials their office had told me to show up with, but not having the materials that I wasn't told to show up with. (And that I wasn't "in the system" — okay. I'm new! I don't know why that is, nor who to ask, nor what 98% of the acronyms mean.)

You want to stop being a contractor, and give the PIV card back? More forms.

I started jokingly wondering when signatures in blood happen.

Definitely wasn't worth it, in my case.

Avamander2• 2 years ago

It's weird to read this coming from a country that basically bundles PIV with your ID. Once every few years you take a new picture and go grab it from a police station in half an hour and that's basically it.

And at the same time support this widespread would not exist without the U.S. using PIV, so I'm glad people bother :D I also recall some U.S. government site recommending a small and sleek card reader designed here (folds into an USB-stick shape).

Hopefully these processes improve and systems become more interoperable cross-borders at some point.

lxgr4• 2 years ago

What country, out of curiosity?

Mine used to issue PIV smartcards (I think; at least there was a PKCS#11 driver for it available), but discontinued it in favor of server-hosted “private keys” unlocked via SMS-OTP (I wish I was kidding).

2devnull• 2 years ago

“Forms that were submitted by encrypting them into a zip, and then sending zip+password in an email…?”

I suspect that’s not too uncommon.

lxgr4• 2 years ago

Yes, I’ve experienced it a few times as well. That doesn’t make it any less bizarre though.

deathanatos2• 2 years ago

I'd also add that the instructions were (paraphrased to show the absurdity of them)

  1. create a plaintext ZIP
  2. completely overwrite the file created in #1 with an encrypted ZIP

so if you followed the instructions, one of the steps was utterly pointless, too.

GauntletWizard• 2 years ago

I'm working on a personal project using PKCS11 stuff. I'm glad for the commonality of PIV cards - It's a terrible standard but it's intercompatible enough that it's made HSMs suitable for SMB very cheap.

rkeene27• 2 years ago

I do a lot of PKCS11 stuff, let me know if there's something I can help with.

EvanAnderson• 2 years ago

PIV cards in Windows work shockingly well out of the box. I bought some Taglio-branded PIV cards to play with and have certificate-based logon to my webserver going in just a couple of hours. Logon to Windows itself took more work but wasn't too difficult.

rkeene27• 2 years ago

That doesn't stop some people from installing other middleware like ActivClient (although it will let you change your PIN; no idea if this is in the Windows PIV driver since I mostly use my own (CACKey) and don't really use Windows)

lxgr4• 2 years ago

Even macOS supports them!

1attice2• 2 years ago

Does literally no one in the US federal government use online dating/hookup services? how is this called PIV. Like, the giggling alone would disqualify me from most jobs

SgtBastard• 2 years ago

The DoD also doesn’t employ 12 year olds that would giggle at that, so needn’t worry.

1attice2• 2 years ago

pity

NIST: Personal Identity Verification (PIV) of Federal Employees and Contractors

Related Stories