NIST SP 800-217 Initial Public Draft

Call for Comments on Initial Public Draft of SP 800-217

NIST requests comments on the initial public draft of Special Publication 800-217, Guidelines for the Use of Personal Identity Verification (PIV) Credentials with Federation. This publication complements FIPS 201-3, which defines the requirements and characteristics of government-wide interoperable identity credentials used by federal employees and contractors. The draft guidelines in SP 800-217 provide technical requirements on the use of federated PIV identity and the use of assertions to implement PIV federations backed by PIV identity accounts and PIV credentials.

NIST requests that all comments be submitted by 11:59pm Eastern Time on April 21, 2023. Please submit your comments to piv_comments@nist.gov. See the Note to Reviewers section below for specific topics about which NIST is seeking your feedback. NIST will review all comments and make them available at the NIST Computer Security Resource Center website. Commenters are encouraged to use the comment template provided with the document announcement.

Available Online

Draft NIST Special Publication 800-217, Guidelines for the Use of Personal Identity Verification (PIV) Credentials with Federation

PDF versions of these documents are available on the NIST Computer Security Resource Center.

Note to Reviewers

The family of PIV credentials includes a variety of form factors and authenticator types – as envisioned in OMB Memoranda M-19-22 and M-22-09 and subsequently outlined in FIPS 201-3. The cross-domain and interagency use of these credentials is provided by federation protocols outlined in this public draft SP 800-217 Guidelines for PIV Federation. The companion document, SP 800-157r1 Guidelines for Derived PIV Credentials, details the authenticators themselves. Both documents are closely aligned with draft release SP 800-63-4 Digital Identity Guidelines. NIST hopes that the draft documents enable a close alignment digital identity and federation technologies employed in the federal government, while maintaining a strong security posture.

NIST is specifically interested in comments on and recommendations for the following topics:

Home Agency Attributes:

• Are additional attributes needed in the guidelines to achieve interagency or cross-domain interoperability?
• Are additional attributes required for RP provisioning and access?

PIV Federation:

• Are additional process steps or mechanisms needed for the connection and communication between home IdP and PIV identity account?
• Do the required parameters for establishing trust agreements fit the use cases for PIV RPs?
• Are the required identity attributes sufficient for PIV use cases?
• Are the federated subject identifier requirements sufficient for PIV use cases?
• Is it clear how to apply the binding ceremony for RP-managed bound authenticators at FAL3 to PIV and non-PIV authenticators?

NOTE: All comments and responses are subject to release under the Freedom of Information Act (FOIA). A call for patent claims is included on page ii of each draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy — Inclusion of Patents in ITL Publications.