BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4.2 PIV Card Logical Characteristics

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 4 PIV Front-End Subsystem part of 4

Title

PIV Card Logical Characteristics

Control changed

Before · FIPS 201-2

This section defines logical identity credentials and the requirements for use of these credentials.

To support a variety of authentication mechanisms, the PIV Card shall contain multiple data elements for the purpose of verifying the cardholder's identity at graduated assurance levels. The following mandatory data elements are part of the data model for PIV logical credentials that support authentication mechanisms interoperable across agencies:

• a PIN;

• a CHUID;

• PIV authentication data (one asymmetric private key and corresponding certificate);

• two fingerprint templates;

• an electronic facial image; and

21 Pantone is a registered name protected by law.
• card authentication data (one asymmetric private key and corresponding certificate).

This Standard also defines two data elements for the PIV data model that are mandatory if the cardholder has a government-issued email account at the time of credential issuance. These data elements are:

• an asymmetric private key and corresponding certificate for digital signatures; and

• an asymmetric private key and corresponding certificate for key management.

This Standard also defines optional data elements for the PIV data model. These optional data elements include:

• one or two iris images;

• one or two fingerprint templates for on-card comparison;

• a symmetric Card Authentication key for supporting physical access applications; and

• a symmetric PIV Card Application Administration key associated with the card management system.

In addition to the above, other data elements are specified in [SP 800-73].

PIV logical credentials fall into the following three categories:

1. credential elements used to prove the identity of the cardholder to the card (CTC authentication);

2. credential elements used to prove the identity of the card management system to the card (CMTC authentication); and

3. credential elements used by the card to prove the identity of the cardholder to an external entity (CTE authentication) such as a host computer system.

The PIN falls into the first category, the PIV Card Application Administration Key into the second category, and the CHUID, biometric credentials, symmetric keys, and asymmetric keys into the third. The fingerprint templates for on-card comparison fall into the first and third categories.

After · FIPS 201-3

This section defines the PIV Card’s logical identity credentials and the requirements for use of these credentials.

To support a variety of authentication mechanisms, the PIV Card shallSHALL contain multiple data elements for the purpose of verifying the cardholder'scardholder’s identity at graduated assurance levels. The following mandatory data elements are part of the data model for PIV Card logical credentials that support authentication mechanisms that are interoperable across agencies:

• a PIN;

,
• aPIV CHUID;

authentication data (one asymmetric private key and corresponding certificate),
• PIVcard authentication data (one asymmetric private key and corresponding certificate);

,
• two fingerprint biometric templates;

,
• an electronic facial image;, and
• a Cardholder Unique Identifier (CHUID). 27

2127 PantoneThe isCHUID aas registeredan nameauthentication protectedmechan byism lawin Section 6.
•2.5 cardhas authenticationbeen removed from this version of the Standard. The CHUID data (oneelement asymmetricitself, privatehowever, keyhas not been removed and correspondingcontinues certificate)to be mandatory as it supports other PIV authentication mechanisms.

 This Standard also defines two data elements for the PIV Card data model that are mandatory if the cardholder has a government-issued email account at the time of credentialPIV Card issuance. These data elements are:

• an asymmetric private key and corresponding certificate for digital signatures;, and


• an asymmetric private key and corresponding certificate for key management.

This Standard also defines optional data elements for the PIV Card data model. These optional data elements include:

• onean orelectronic twoimage of the left iris,
• images;

an electronic image of the right iris,
• one or two fingerprint biometric templates for on-card comparison;

OCC,
• a symmetric Cardcard Authenticationauthentication key for supporting 28 physical access applications;,
• an asymmetric key to establish secure messaging and

 authenticate the PIV Card in support of physical access applications, and
• a symmetric PIV Card Applicationapplication Administrationadministration key associated with the card management system.

In addition to the above, otherAdditional data elements are specified in [SP 800-73].

PIV Card logical credentials fall into the following three categories:

1.Cardholder-to-Card credential(CTC) authentication Credential elements used to prove the identity of the cardholder to the card, also known as card activation. Examples include the PIN and the fingerprint biometric templates for OCC.

Card-Management-to-Card (CTCCMTC) authentication);

2. credentialCredential elements used to prove the identity of the card management system to the card. (CMTCExamples authentication);include and

3the PIV Card application administration key.

Cardholder-to-External credential(CTE) authentication Credential elements used by the card to prove the identity of the cardholder to an external entity (CTE authentication), such as a host computer system.

The PIN fallsExamples intoinclude the first category,biometric thedata PIVrecords Cardfor ApplicationBIO Administrationand KeyBIO-A, intosymmetric thekeys, secondasymmetric categorykeys, and the CHUID,fingerprint biometric credentials,templates for OCC-AUTH.

28 The symmetric keys,card andauthentication asymmetrickey keyshas intobeen deprecated in this version of the thirdStandard. TheBoth fingerprintthe templatessymmetric forcard on-cardauthentication comparisonkey falland intoassociated theSYM-CAK firstauthentication andmechanism thirdmay categoriesbe removed in a future revision of the Standard.