NIST PIV and digital identity FIPS 201-2
All1 Introduction2 Common Identification, Security, and Privacy Requirements3 PIV System Overview4 PIV Front-End Subsystem5 PIV Key Management Requirements6 PIV Cardholder Authentication
| Ref | Title | Text | |
|---|---|---|---|
| 1 | Introduction | Authentication of an individual’s identity is a fundamental component of physical and logical access control processes. When an individual attempts to access security-sensitive buildings, computer systems, or data, an access control decisio | |
| 1.1 in 1 |
Purpose | This Standard defines a reliable, government-wide identity credential for use in applications such as access to Federally controlled facilities and information systems. This Standard has been developed within the context and constraints of | |
| 1.2 in 1 |
Scope | Homeland Security Presidential Directive-12 [HSPD-12], signed by President George W. Bush on August 27, 2004, established the requirements for a common identification standard for identity credentials issued by Federal departments and agenc | |
| 1.3 in 1 |
Change Management | Every revision of this Standard introduces refinements and changes that may impact existing implementations. FIPS 201 and its normative specifications encourage implementation approaches that reduce the high cost of configuration and change | |
| 1.3.1 in 1.3 |
Backward Compatible Change | A backward compatible change is a change or modification to an existing feature that does not break the relying systems using this feature. For example, changing the Card Authentication certificate from optional to mandatory does not affect | |
| 1.3.2 in 1.3 |
Non-Backward Compatible Change | A non-backward compatible change is a change or modification to an existing feature such that the modified feature cannot be used with existing relying systems. For example, changing the format of the biometric data would not be compatible | |
| 1.3.3 in 1.3 |
New Features | New features are optional or mandatory features that are added to the Standard. New features do not interfere with backward compatibility because they are not part of the existing relying systems. For example, the addition of an optional on | |
| 1.3.4 in 1.3 |
Deprecated and Removed | When a feature is to be discontinued or is no longer needed, it is deprecated. In general, a feature that is currently in use by relying systems would only be deprecated if there were a compelling (e.g., security) reason to do so. Deprecate | |
| 1.3.5 in 1.3 |
FIPS 201 Version Management | Subsequent revisions of this Standard may necessitate FIPS 201 version management that introduces new version numbers for FIPS 201 products. Components that may be affected by version management include, for example, PIV Cards, PIV middlewa | |
| 1.4 in 1 |
Document Organization | This Standard describes the minimum requirements for a Federal personal identification system that meets the control and security objectives of [HSPD-12], including identity proofing, registration, and issuance. It provides detailed technic | |
| 2 | Common Identification, Security, and Privacy Requirements | This section addresses the fundamental control and security objectives outlined in [HSPD-12], including the identity proofing requirements for Federal employees and contractors. | |
| 2.1 in 2 |
Control Objectives | [HSPD-12] established control objectives for secure and reliable identification of Federal employees and contractors. These control objectives, provided in paragraph 3 of the directive, are quoted here: (3) "Secure and reliable forms of id | |
| 2.2 in 2 |
Credentialing Requirements | Federal departments and agencies shall use the credentialing guidance issued by the Director of the Office of Personnel Management (OPM) 4 and OMB 5 . | |
| 2.3 in 2 |
Biometric Data Collection for Background Investigations | The following biometric data shall be collected from each PIV applicant: + A full set of fingerprints. Biometric identification using fingerprints is the primary input to law enforcement checks. In cases where ten fingerprints are not avai | |
| 2.4 in 2 |
Biometric Data Collection for PIV Card | The following biometric data shall be collected from each PIV applicant: + Two fingerprints, for off-card comparison. These shall be taken either from the full set of fingerprints collected in Section 2.3, or collected independently. + An | |
| 2.5 in 2 |
Biometric Data Use | The full set of fingerprints shall be used for one-to-many identification in the databases of fingerprints maintained by the FBI. 4 For example, [SPRINGER MEMO] at http://www.opm.gov/investigate/resources/final_credentialing_standards.pdf | |
| 2.6 in 2 |
Chain-of-Trust | A card issuer may optionally maintain, for each PIV Card issued, a documentary chain-of-trust for the identification data it collects. The chain-of-trust is a sequence of related enrollment data records that are created and maintained throu | |
| 2.7 in 2 |
PIV Identity Proofing and Registration Requirements | Departments and agencies shall follow an identity proofing and registration process that meets the requirements defined below when issuing PIV Cards. + The organization shall adopt and use an identity proofing and registration process that | |
| 2.8 in 2 |
PIV Card Issuance Requirements | Departments and agencies shall meet the requirements defined below when issuing PIV Cards. The issuance process used when issuing PIV Cards shall be accredited by the department or agency as satisfying the requirements below and approved in | |
| 2.8.1 in 2.8 |
Special Rule for Pseudonyms | In limited circumstances Federal employees and contractors are permitted to use pseudonyms during the performance of their official duties with the approval of their employing agency. If an agency determines that use of a pseudonym is neces | |
| 2.8.2 in 2.8 |
Grace Period | In some instances an individual's status as a Federal employee or contractor will lapse for a brief time period. For example, a Federal employee may leave one Federal agency for another Federal agency and thus occur a short employment lapse | |
| 2.9 in 2 |
PIV Card Maintenance Requirements | The PIV Card shall be maintained using processes that comply with this section. The data and credentials held by the PIV Card may need to be updated or invalidated prior to the expiration date of the card. The cardholder may change his or | |
| 2.9.1 in 2.9 |
PIV Card Reissuance Requirements | Reissuance is the process by which a new PIV Card is issued to a cardholder without the need to repeat the entire identity proofing and registration procedure. The reissuance process may be used to replace a PIV Card that is nearing expirat | |
| 2.9.1.1 in 2.9.1 |
Special Rule for Name Change by Cardholder | Name changes frequently occur as a result of marriage, divorce, or as a matter of personal preference. In the event that a cardholder notifies a card issuer that his or her name has changed, and presents the card issuer with evidence of a f | |
| 2.9.2 in 2.9 |
PIV Card Post Issuance Update Requirements | A PIV Card post issuance update may be performed without replacing the PIV Card in cases where none of the printed information on the surface of the card is changed. The post issuance update applies to cases where one or more certificates, | |
| 2.9.3 in 2.9 |
PIV Card Verification Data Reset | The Personal Identification Number (PIN) on a PIV Card may need to be reset if the cardholder has forgotten the PIN or if PIN-based cardholder authentication has been disabled from the usage of an invalid PIN more than the allowed number of | |
| 2.9.4 in 2.9 |
PIV Card Termination Requirements | A PIV card is terminated when the department or agency that issued the card determines that the cardholder is no longer eligible to have a PIV Card. The PIV Card shall be terminated under the following circumstances: + a Federal employee s | |
| 2.10 in 2 |
Derived PIV Credentials Issuance Requirements | Valid PIV Cards may be used as the basis for issuing derived PIV credentials in accordance with NIST Special Publication 800-157, Guidelines for Derived Personal Identity Verification (PIV) Credentials [SP 800-157]. When a cardholder's PIV | |
| 2.11 in 2 |
PIV Privacy Requirements | HSPD-12 explicitly states that “protect[ing] personal privacy” is a requirement of the PIV system. As such, all departments and agencies shall implement the PIV system in accordance with the spirit and letter of all privacy controls specifi | |
| 3 | PIV System Overview | The PIV system is composed of components and processes that support a common (smart card-based) platform for identity authentication across Federal departments and agencies for access to multiple types of physical and logical access environ | |
| 3.1 in 3 |
Functional Components | An operational PIV system can be logically divided into the following three major subsystems: • PIV Front-End Subsystem —PIV Card, card and biometric readers, and PIN input device. The PIV cardholder interacts with these components to gain | |
| 3.1.1 in 3.1 |
PIV Front-End Subsystem | The PIV Card will be issued to the applicant when all identity proofing, registration, and issuance processes have been completed. The PIV Card has a credit card-size form factor, with one or more embedded integrated circuit chips (ICC) tha | |
| 3.1.2 in 3.1 |
PIV Card Issuance and Management Subsystem | The identity proofing and registration component in Figure 3-1 refers to the process of collecting, storing, and maintaining all information and documentation that is required for verifying and assuring the applicant’s identity. Various typ | |
| 3.1.3 in 3.1 |
PIV Relying Subsystem | The PIV relying subsystem includes components responsible for determining a particular PIV cardholder’s access to a physical or logical resource. A physical resource is the secured facility (e.g., building, room, parking garage) that the ca | |
| 3.2 in 3 |
PIV Card Lifecycle Activities | The PIV Card lifecycle consists of seven activities. The activities that take place during fabrication and pre-personalization of the card at the manufacturer are not considered a part of this lifecycle model. Figure 3-2 presents these PIV | |
| 4 | PIV Front-End Subsystem | This section identifies the requirements for the components of the PIV front-end subsystem. Section 4.1 provides the physical card specifications. Section 4.2 provides the logical card specifications. Section 4.3 specifies the requirements | |
| 4.1 in 4 |
PIV Card Physical Characteristics | References to the PIV Card in this section pertain to the physical characteristics only. References to the front of the card apply to the side of the card that contains the electronic contacts; references to the back of the card apply to th | |
| 4.1.1 in 4.1 |
Printed Material | The printed material shall not rub off during the life of the PIV Card, nor shall the printing process deposit debris on the printer rollers during printing and laminating. Printed material shall not interfere with the contact and contactle | |
| 4.1.2 in 4.1 |
Tamper Proofing and Resistance | The PIV Card shall contain security features that aid in reducing counterfeiting, are resistant to tampering, and provide visual evidence of tampering attempts. At a minimum, a PIV Card shall incorporate one such security feature. Examples | |
| 4.1.3 in 4.1 |
Physical Characteristics and Durability | The following list describes the physical requirements for the PIV Card. • The PIV Card shall contain a contact and a contactless ICC interface. • The card body shall be white in accordance with color representation in Section 4.1.5. Only | |
| 4.1.4 in 4.1 |
Visual Card Topography | The information on a PIV Card shall be in visual printed and electronic form. This section covers the placement of visual and printed information. It does not cover information stored in electronic form, such as stored data elements, and ot | |
| 4.1.4.1 in 4.1.4 |
Mandatory Items on the Front of the PIV Card | Zone 1F—Photograph . The photograph shall be placed in the upper left corner, as depicted in Figure 4-1, and be a full frontal pose from top of the head to shoulder. A minimum of 300 dots per inch (dpi) resolution shall be used. The backgro | |
| 4.1.4.2 in 4.1.4 |
Mandatory Items on the Back of the PIV Card | Zone 1B—Agency Card Serial Number . This item shall be printed as depicted in Figure 4-6 and contain the unique serial number from the issuing department or agency. The format shall be at the discretion of the issuing department or agency. | |
| 4.1.4.3 in 4.1.4 |
Optional Items on the Front of the PIV Card | This section contains a description of the optional information and machine-readable technologies that may be used and their respective placement. The storage capacity of all optional technologies is as prescribed by individual departments | |
| 4.1.4.4 in 4.1.4 |
Optional Items on the Back of the PIV Card | Zone 3B—Magnetic Stripe. If used, the magnetic stripe shall be high coercivity and placed in accordance with [ISO7811], as illustrated in Figure 4-7. Zone 4B—Return Address. If used, the “return if lost” language shall be generally placed | |
| 4.1.5 in 4.1 |
Color Representation | Table 4-2 provides quantitative specifications for colors in three different color systems: sRGB Tristimulus, sRGB ([IEC61966], Color management – default RGB color space), and CMYK (Cyan, Magenta, Yellow and Key or ‘blacK’). Since the card | |
| 4.2 in 4 |
PIV Card Logical Characteristics | This section defines logical identity credentials and the requirements for use of these credentials. To support a variety of authentication mechanisms, the PIV Card shall contain multiple data elements for the purpose of verifying the card | |
| 4.2.1 in 4.2 |
Cardholder Unique Identifier (CHUID) | The PIV Card shall include the CHUID as defined in [SP 800-73]. The CHUID includes the Federal Agency Smart Credential Number (FASC-N) and the Global Unique Identification Number (GUID), which uniquely identify each card as described in [SP | |
| 4.2.2 in 4.2 |
Cryptographic Specifications | The PIV Card shall implement the cryptographic operations and support functions as defined in [SP 800-78] and [SP 800-73]. The PIV Card must store private keys and corresponding public key certificates, and perform cryptographic operations | |
| 4.2.3 in 4.2 |
PIV Biometric Data Specifications | ||
| 4.2.3.1 in 4.2.3 |
Biometric Data Representation | The following biometric data shall be stored on the PIV Card: • Two fingerprint templates. If no fingerprint images meeting the quality criteria of [SP 800-76] are available, the PIV Card shall nevertheless be populated with fingerprint re | |
| 4.2.3.2 in 4.2.3 |
Biometric Data Protection | The integrity of all biometric data, except for fingerprint templates for on-card comparison, shall be protected using digital signatures as follows. The records shall be prepended with a Common Biometric Exchange Formats Framework (CBEFF) | |
| 4.2.3.3 in 4.2.3 |
Biometric Data Access | The PIV biometric data, except for fingerprint templates for on-card comparison, that is stored on the card • shall be readable through the contact interface and after the presentation of a valid PIN; and • may optionally be readable thro | |
| 4.2.4 in 4.2 |
PIV Unique Identifiers | A cardholder is authenticated through identification and authentication (I&A) using the PIV Card (and its identifier) in authentication mechanisms described in Section 6. The authenticated identity may then be used as the basis for making a | |
| 4.3 in 4 |
PIV Card Activation | The PIV Card shall be activated 27 to perform privileged 28 operations such as using the PIV Authentication key, digital signature key, and key management key. The PIV Card shall be activated for privileged operations only after authenticat | |
| 4.3.1 in 4.3 |
Activation by Cardholder | PIV Cards shall implement user-based cardholder activation to allow privileged operations using PIV credentials held by the card. At a minimum, the PIV Card shall implement PIN-based cardholder activation in support of interoperability acro | |
| 4.3.2 in 4.3 |
Activation by Card Management System | PIV Cards may support card activation by the card management system to support card personalization and post-issuance card update. To activate the card for personalization or update, the card management system shall perform a challenge resp | |
| 4.4 in 4 |
Card Reader Requirements | This section provides minimum requirements for the contact and contactless card readers. Also, this section provides requirements for PIN input devices. Further requirements are specified in [SP 800-96]. | |
| 4.4.1 in 4.4 |
Contact Reader Requirements | Contact card readers shall conform to the [ISO7816] standard for the card-to-reader interface. These readers shall conform to the Personal Computer/Smart Card (PC/SC) Specification [PCSC] for the reader- to-host system interface in general | |
| 4.4.2 in 4.4 |
Contactless Reader Requirements | Contactless card readers shall conform to [ISO14443] standard for the card-to-reader interface and data transmitted over the [ISO14443] link shall conform to [ISO7816]. In cases where these readers are connected to general-purpose desktop c | |
| 4.4.3 in 4.4 |
Reader Resilience and Flexibility | The international standard ISO/IEC 24727 [ISO24727] enables a high degree of interoperability between electronic credentials and relying subsystems by means of an adaptation layer. To make interoperability among PIV System middleware, card | |
| 4.4.4 in 4.4 |
Card Activation Device Requirements | When the PIV Card is used with OCC data or a PIN for physical access, the input device shall be integrated with the PIV Card reader. When the PIV Card is used with OCC data or a PIN for logical access (e.g., to authenticate to a Web site or | |
| 5 | PIV Key Management Requirements | PIV Cards consistent with this specification will have two or more asymmetric private keys. To manage the public keys associated with the asymmetric private keys, departments and agencies shall issue and manage X.509 public key certificates | |
| 5.1 in 5 |
Architecture | The CA that issues certificates to support PIV Card authentication shall participate in the hierarchical PKI for the Common Policy managed by the Federal PKI. Self-signed, self-issued, and CA certificates issued by these CAs shall conform t | |
| 5.2 in 5 |
PKI Certificate | All certificates issued to support PIV Card authentication shall be issued under the X.509 Certificate Policy for the U.S. Federal PKI Common Policy Framework [COMMON]. The requirements in this certificate policy cover identity proofing and | |
| 5.2.1 in 5.2 |
X.509 Certificate Contents | The required contents of X.509 certificates associated with PIV private keys are based on [PROF]. The relationship is described below: • Certificates containing the public key associated with an asymmetric Card Authentication private key s | |
| 5.3 in 5 |
X.509 CRL Contents | CAs that issue certificates corresponding to PIV private keys shall issue CRLs as specified in [COMMON]. The contents of X.509 CRLs shall conform to Worksheet 4: CRL Profile in [PROF]. | |
| 5.4 in 5 |
Legacy PKIs | For the purposes of this Standard, legacy PKIs are the PKIs of departments and agencies that have cross- certified with the Federal Bridge CA (FBCA) at the Medium Hardware or High Assurance Level. Legacy PKIs that issue PIV Authentication c | |
| 5.5 in 5 |
PKI Repository and OCSP Responder(s) | CAs that issue certificates to support PIV Card authentication shall operate repositories and Online Certificate Status Protocol (OCSP) responders that provide certificate status information for the certificates they issue to support high-a | |
| 5.5.1 in 5.5 |
Certificate and CRL Distribution | This Standard requires distribution of CA certificates and CRLs using HTTP. Specific requirements are found in the Shared Service Provider Repository Service Requirements [SSP REP]. Certificates that contain the FASC-N or UUID in the subjec | |
| 5.5.2 in 5.5 |
OCSP Status Responders | OCSP [RFC2560] status responders shall be implemented as a supplementary certificate status mechanism. The OCSP status responders must be updated at least as frequently as CRLs are issued. The definitive OCSP responder for each certificate | |
| 6 | PIV Cardholder Authentication | This section defines a suite of authentication mechanisms that are supported by all the PIV Cards, and their applicability in meeting the requirements for a set of graduated levels of identity assurance. This section also defines some authe | |
| 6.1 in 6 |
PIV Assurance Levels | This Standard defines four levels of assurance for identity authentication supported by the PIV Card Application. Each assurance level sets a degree of confidence established in the identity of the holder of the PIV Card. The entity perform | |
| 6.1.1 in 6.1 |
Relationship to OMB’s E-Authentication Guidance | The levels of identity authentication assurance defined within this Standard are closely aligned with Section 2 of OMB’s E-Authentication Guidance for Federal Agencies, M-04-04 [OMB0404]. Specifically, Table 6-1 shows the notional relations | |
| 6.2 in 6 |
PIV Card Authentication Mechanisms | The following subsections define the basic types of authentication mechanisms that are supported by the credential set hosted by the PIV Card Application. PIV Cards can be used for identity authentication in environments that are equipped w | |
| 6.2.1 in 6.2 |
Authentication Using Off-Card Biometric Comparison | The PIV Card Application hosts the signed fingerprint templates and, optionally, the signed iris images. Either biometric can be read from the card following cardholder-to-card (CTC) authentication using a PIN supplied by the cardholder. Th | |
| 6.2.1.1 in 6.2.1 |
Unattended Authentication Using PIV Biometric (BIO) | The following steps shall be performed for unattended authentication of the PIV biometric: • The CHUID or another data element 32 is read from the card and is checked to ensure the card has not expired and that it is from a trusted source. | |
| 6.2.1.2 in 6.2.1 |
Attended Authentication of PIV Biometric (BIO-A) | In this higher assurance variant, an attendant (e.g., security guard) supervises the use of the PIV Card and the submission of the biometric by the cardholder. Otherwise, the steps for this authentication mechanism are the same as for the u | |
| 6.2.2 in 6.2 |
Authentication Using On-Card Biometric Comparison (OCC-AUTH) | The PIV Card Application may host the optional on-card biometric comparison algorithm. In this case, on-card biometric comparison data is stored on the card, which cannot be read, but could be used for identity verification. A live-scan bio | |
| 6.2.3 in 6.2 |
Authentication Using PIV Asymmetric Cryptography | The PIV Card contains two mandatory asymmetric authentication private keys and corresponding certificates to support cardholder-to-external system (CTE) authentication, as described in Section 4. The following subsections shall be used to p | |
| 6.2.3.1 in 6.2.3 |
Authentication with the PIV Authentication Certificate Credential (PKI-AUTH) | The following steps shall be performed for PKI-AUTH: • The PIV Authentication certificate is read from the PIV Card Application. • The relying system validates the PIV Authentication certificate from the PIV Card Application using standar | |
| 6.2.3.2 in 6.2.3 |
Authentication with the Card Authentication Certificate Credential (PKI-CAK) | The following steps shall be performed for PKI-CAK: • The Card Authentication certificate is read from the PIV Card Application. • The relying system validates the Card Authentication certificate from the PIV Card Application using standa | |
| 6.2.4 in 6.2 |
Authentication with the Symmetric Card Authentication Key (SYM-CAK) | The PIV Card Application may host the optional symmetric Card Authentication key. In this case, the symmetric Card Authentication key shall be used for PIV cardholder authentication using the following steps: • The CHUID, PIV Authenticatio | |
| 6.2.5 in 6.2 |
Authentication Using the CHUID | The PIV Card provides a mandatory data element called the CHUID. As described in Section 4.2.1, the CHUID contains numerous data elements. The CHUID shall be used for PIV cardholder authentication using the following steps: • The CHUID is | |
| 6.2.6 in 6.2 |
Authentication Using PIV Visual Credentials (VIS) | Visual authentication of a PIV cardholder shall be used only to support access control to physical facilities and resources. The PIV Card has several mandatory topographical features on the front and back that support visual identification | |
| 6.3 in 6 |
PIV Support of Graduated Assurance Levels for Identity Authentication | The PIV Card supports a set of authentication mechanisms that can be used to implement graduated assurance levels for identity authentication. The following subsections specify which basic PIV authentication mechanisms may be used to suppor | |
| 6.3.1 in 6.3 |
Physical Access | The PIV Card may be used to authenticate the identity of the cardholder in a physical access control environment. For example, a Federal facility may have physical entry doors that have human guards at checkpoints, or may have electronic ac | |
| 6.3.2 in 6.3 |
Logical Access | The PIV Card may be used to authenticate the cardholder in support of decisions concerning access to logical information resources. For example, a cardholder may log in to his or her department or agency network using the PIV Card; the iden |
88 of 88.