Allow for PIV cards to be FIDO2 Authenticators about fips201 HOT 2 CLOSED

Recommend not accepting:

• While we contemplate FIDO authenticators being suitable Derived PIV credentials, if the PIV card itself is available, its native PIV capability should be used when possible rather than a derived PIV.
• When authenticating to a non-PIV relying party, the PIV card should not be used.
• The form factor of PIV cards is incompatible with most FIDO authenticators (except for possible use of NFC) unless an adapter is used.
• Provision would need to be made on the PIV card design for FIDO features such as the activation button when used.

from fips201.

Agree- not accept. The PIV specifications do not currently prohibit the inclusion of other functionality, like a FIDO applet, on a card. The topic of other authenticators will be covered by a revision to SP 800-157.

from fips201.