Navigate

IA-5(2)

IA-5(2): Pki-based Authentication

The information system, for PKI-based authentication:

(a): Validates certifications by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information;

(b): Enforces authorized access to the corresponding private key;

(c): Maps the authenticated identity to the account of the individual or group; and

(d): Implements a local cache of revocation data to support path discovery and validation in case of inability to access revocation information via the network.

Supplemental

Status information for certification paths includes, for example, certificate revocation lists or certificate status protocol responses. For PIV cards, validation of certifications involves the construction and verification of a certification path to the Common Policy Root trust anchor including certificate policy processing.

CIA Levels
Confidentiality	high
Integrity	high
Availability	unknown

Overlays
None

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to IA-5(2).

Control	Description
IA-6	The information system obscures feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.

Enhancements

The controls below (if any) add on to the requirements of IA-5(2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to IA-5(2).

CCI	Definition
CCI-000185	For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.
CCI-000186	For public key-based authentication, enforce authorized access to the corresponding private key.
CCI-000187	For public key-based authentication, map the authenticated identity to the account of the individual or group.
CCI-001991	The information system, for PKI-based authentication, implements a local cache of revocation data to support path discovery and validation in case of inability to access revocation information via the network.