BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

6.2.1 Authentication Using Off-Card Biometric Comparison

NIST PIV and digital identity FIPS 201-2
All changes in this version
first version loaded 6 PIV Cardholder Authentication part of 6.2

Title

Authentication Using Off-Card Biometric Comparison

Control

The PIV Card Application hosts the signed fingerprint templates and, optionally, the signed iris images. Either biometric can be read from the card following cardholder-to-card (CTC) authentication using a PIN supplied by the cardholder. These PIV biometrics are designed to support a cardholder-to-external system (CTE) authentication mechanism through a match-off-card scheme. The following subsections define two authentication schemes that make use of the PIV biometrics. 31

Some characteristics of the PIV Biometrics authentication mechanisms (described below) are as follows:

31 As noted in Section 4.2.3.1, neither the fingerprint templates nor the iris images are guaranteed to be present on a PIV Card, since it may not be possible to collect fingerprints from some cardholders and iris images collection is optional. When biometric authentication cannot be performed, PKI-AUTH is the recommended alternate authentication mechanism.
• Strong resistance to use of unaltered card by non-owner since PIN and cardholder biometric are required.

• Digital signature on biometric, which is checked to further strengthen the mechanism.

• Slower mechanism, because it requires two interactions (e.g., presentation of PIN and biometric) with the cardholder.

• Does not provide protection against use of a revoked card.

• Applicable with contact card readers, and contactless card readers that support the virtual contact interface.