2.9.3 PIV Card Activation Reset (was: PIV Card Verification Data Reset)
All changes in this version
Title changed
Before · FIPS 201-2
PIV Card Verification Data Reset
After · FIPS 201-3
PIV Card Verification DataActivation Reset
Control changed
Before · FIPS 201-2
The Personal Identification Number (PIN) on a PIV Card may need to be reset if the cardholder has forgotten the PIN or if PIN-based cardholder authentication has been disabled from the usage of an invalid PIN more than the allowed number of retries stipulated by the department or agency. 14 PIN reset may be performed in-person at the issuer’s facility, at an unattended kiosk operated by the issuer, or remotely via a general computing platform:
+ When PIN reset is performed in-person at the issuer's facility, before providing the reset PIV Card back to the cardholder, the issuer shall perform a 1:1 biometric match to ensure that the cardholder's biometric matches either the stored biometric on the PIV Card or biometric data stored in the chain- of-trust. In cases where a biometric match is not possible, the cardholder shall provide the PIV Card to be reset and another primary identity source document (as specified in Section 2.7). An attending operator shall inspect these and compare the cardholder with the facial image retrieved from the enrollment data record and the facial image printed on the card.
+ PIN reset at an unattended issuer-operated kiosk shall ensure that the PIV Card is authenticated and that the cardholder’s biometric matches either the stored biometric on the PIV Card, through an on- card 1:1 biometric match, or biometric data stored in the chain-of-trust, through an off-card 1:1
14 Cardholders may change their PINs anytime by providing the current PIN and the new PIN values. biometric match. If the biometric match or card authentication is unsuccessful, the kiosk shall not reset the PIV Card.
+ Remote PIN reset on a general computing platform (e.g., desktop, laptop) shall only be performed if the following requirements are met:
o the cardholder initiates a PIN reset with the issuer operator;
o the operator authenticates the owner of the PIV Card through an out-of-band authentication procedure (e.g., pre-registered knowledge tokens); and
o the cardholder’s biometric matches the stored biometric on the PIV Card through a 1:1 on- card biometric comparison.
The remote PIN reset operation shall satisfy the requirements for remote post issuance updates specified in Section 2.9.2.
Departments and agencies may adopt more stringent procedures for PIN reset (including disallowing PIN reset). PIN reset procedures shall be formally documented by each department and agency.
Verification data other than the PIN may also be reset (i.e., re-enrollment) by the card issuer. Before the reset, the issuer shall perform a 1:1 biometric match of the cardholder to reconnect to the chain-of-trust. The type of biometric used for the match shall not be the same as the type of biometric data that is being reset. For example, if fingerprint templates for on-card comparison are being reset, then a 1:1 iris match could be used to reconnect to the chain-of-trust. If no alternative biometric data is available, the cardholder shall provide the PIV Card to be reset and another primary identity source document (as specified in Section 2.7). An attending operator shall inspect these and compare the cardholder with the facial image retrieved from the enrollment data record and the facial image printed on the PIV Card.
New verification reference data shall be enrolled. The PIV Card’s activation methods associated with the verification data shall be reset and the new verification data shall be stored on the card.
Departments and agencies may adopt more stringent procedures for verification data reset (including disallowing verification data reset); such procedures shall be formally documented by each department and agency.
After · FIPS 201-3
TheBoth the Personal Identification Number (PIN) and OCC activation methods for a PIV Card can be reset in certain circumstances.
The PIN on a PIV Card may need to be reset if the cardholder has forgotten the PIN or if PIN-based cardholder authentication has been disabled fromby the usage of an invalid PIN more than the allowed number of retries stipulated by the department or agency. 14Fingers PINmight resetneed mayto be performed in-person at the issuer’s facility, at an unattended kiosk operated by the issuer, or remotely via a general computing platform:re-enrolled
+ When PIN reset is performed in-person at the issuer's facility, before providing the reset PIVCardfor backOCC toif the cardholder, the issuer shall perform a 1:1 biometric match to ensure that the cardholder's biometric matches either the stored biometric onhas theexperienced PIVepidermal Cardscarring or biometric data stored in the chain- of-trust. In cases where a biometric match issimilar notphysical possiblechanges, the cardholder shall provide the PIV Card to be reset and another primary identity source document (as specifiedresulting in Section 2.7). An attending operator shall inspect these and compare the cardholder with the facial image retrieved from the enrollment data record and the facial image printed on the card.false
+ PIN reset at an unattended issuer-operated kiosk shall ensure that the PIV Card is authenticated and that the cardholder’s biometric matches either the stored biometric on the PIV Card, through an on- card 1:1 biometric match,ornegative biometric data stored in theverification chain-of-trustdecisions, through an off-card 1:1or
14 Cardholders may change their PINs anytime by providing the current PIN and the new PIN values. biometric match. If the biometric match card authentication is unsuccessful, the kiosk shall not reset the PIV Card.if
+ Remote PIN reset on a general computing platform (e.g., desktop, laptop) shall only be performed the following requirements are met:OCC
o the cardholder initiates a PINresethas withbeen thedisabled issuerby operator;exceeding the
ooperator authenticates theallowed ownernumber of the PIV Card through an out-of-band authentication procedure (e.g., pre-registered knowledge tokens); andnegative biometric
o the cardholder’s biometric matches the stored biometric on the PIV Card through a 1:1 on- cardcomparison.verification
The remote PIN reset operation shall satisfy the requirements for remote post issuance updates specified in Section2.9.2decisions.
Departmentsand agencies may adoptNo more stringent procedures for PIN reset (including disallowing PIN reset). PIN reset proceduresthan shall10 beconsecutive formallyactivation documentedretries byfor each department and agency.of the
Verification data other thanPIN may also beactivation resetmethods (i.e., re-enrollment) by the card issuer. Before the reset, the issuer shall perform a 1:1 biometric match of the cardholder to reconnect to the chain-of-trust. The type of biometric used for the match shall not be the same as the type of biometric data that is being reset. For example, if fingerprint templates for on-card comparison are being reset, then aPIN 1:1and irisOCC matchattempts) couldSHALL be used to reconnect to the chain-of-trustpermitted. If no alternative biometric data is available, the cardholder shall provide the PIV Card to be reset and another primary identity source document (as specified in Section 2.7). An attending operator shall inspect these and compare the cardholder with the facial image retrieved from the enrollmentissuers dataMAY recordfurther andrestrict the facialmaximum imageretry printedlimit onto thea PIVlower Cardvalue.New verification reference data shallCardholders beMAY enrolled.change Thetheir PIVPINs Card’sat activationany methodstime associatedby withproviding the verification data shall becurrent resetPIN and the new verification dataPIN shallvalues, beas storedspecified onin the[SP card800-73].
Departments and agencies mayMAY adopt more stringent procedures for verificationPIN dataor OCC reset (including disallowing verification data resetresets); such procedures shallSHALL be formally documented by each department and agency.