BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4.2.3.2 Biometric Data Record Protection (was: Biometric Data Protection)

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 4 PIV Front-End Subsystem part of 4.2.3

Title changed

Before · FIPS 201-2

Biometric Data Protection

After · FIPS 201-3

Biometric Data Record Protection

Control changed

Before · FIPS 201-2

The integrity of all biometric data, except for fingerprint templates for on-card comparison, shall be protected using digital signatures as follows. The records shall be prepended with a Common Biometric Exchange Formats Framework (CBEFF) header (referred to as CBEFF_HEADER) and appended with the CBEFF signature block (referred to as the CBEFF_SIGNATURE_BLOCK) [CBEFF].

The format for a CBEFF_HEADER is specified in [SP 800-76].

The CBEFF_SIGNATURE_BLOCK contains the digital signature of the biometric data and thus facilitates the verification of integrity of the biometric data. The CBEFF_SIGNATURE_BLOCK shall be encoded as a CMS external digital signature as specified in [SP 800-76]. The algorithm and key size requirements for the digital signature and digest algorithm are detailed in [SP 800-78].

For signatures created before October 15, 2015, the public key required to verify the digital signature shall be contained in a content signing certificate, which shall be issued under the id-fpki-common-piv- contentSigning, id-fpki-common-devices, id-fpki-common-devicesHardware, id-fpki-common-hardware, or id-fpki-common-High policy of [COMMON]. 26 For signatures created on or after October 15, 2015, the public key required to verify the digital signature shall be contained in a content signing certificate, which shall be issued under the id-fpki-common-piv-contentSigning policy of [COMMON]. The content signing certificate shall also include an extended key usage ( extKeyUsage) extension asserting id-PIV- content-signing. If the signature on the biometric was generated with a different key than the signature on

25 The on-card and off-card fingerprint reference data are stored separately and, as conformant instances of different formal fingerprint standards, are syntactically different. This is described more fully in [SP 800-76]. 26 For legacy PKIs, as defined in Section 5.4, the certificates may be issued under a department or agency-specific policy that has been cross-certified with the Federal Bridge CA (FBCA) at the Medium Hardware or High Assurance Level. the CHUID, the certificates field of the CMS external digital signature shall include the content signing certificate required to verify the signature on the biometric. Otherwise, the certificates field shall be omitted. Additional descriptions for the PIV object identifiers are provided in Appendix B. The content signing certificate on a valid PIV Card (one that is neither expired nor revoked) shall not be expired.

After · FIPS 201-3

The integrity of all biometric data records, except for fingerprint biometric templates for on-card comparisonOCC, shallSHALL be protected using digital signatures as follows. The records shallSHALL be prepended with a Common Biometric Exchange Formats Framework (CBEFF) header (referred to as CBEFF_HEADER) and appended with the CBEFF signature block (referred to as the CBEFF_SIGNATURE_BLOCK) [CBEFFNISTIR 6529-A].

The format for a CBEFF_HEADERCBEFF header is specified in [SP 800-76].

The CBEFF_SIGNATURE_BLOCKCBEFF signature block contains the digital signature of the biometric data andrecord thusand facilitates the verification of the integrity of the biometric data record. The CBEFF_SIGNATURE_BLOCKCBEFF shallsignature block SHALL be encoded as a CMS external digital signature as specified in [SP 800-76]. The algorithm and key size requirements for the digital signature and digest algorithm are detailed in [SP 800-78].

For signatures created before October 15, 2015, the public key required to verify the digital signature shall be contained in a content signing certificate, which shall be issued under the id-fpki-common-piv- contentSigning, id-fpki-common-devices, id-fpki-common-devicesHardware, id-fpki-common-hardware, or id-fpki-common-High policy of [COMMON]. 26 For signatures created on or after October 15, 2015, theThe public key required to verify the digital signature shallSHALL be contained in a content signing certificate, which shallSHALL be issued under the id-fpki-common-piv-contentSigning policy of [COMMON]. The content signing certificate shalland alsoSHALL include an extended key usage ( extKeyUsage ) extension asserting id-PIV-id-PIV-content-signing content-signing. If theThe signature on the biometric wasdata record SHOULD be generated with athe differentsame signing key thanas the signature on

25 The on-cardthe andCHUID off-carddata fingerprintobject. referenceThe datapublic arekey storedrequired separatelyto and,verify asthe conformantdigital instancessignature ofis differentcontained formalin fingerprintthe standards,CHUID aredata syntacticallyobject’s different.content Thissigning iscertificate described33 moreas fullydetailed in [SPSection 800-76]4.2.1.

The 26use Forof legacyan PKIs,different ascontent definedsigning inkey Sectionfrom 5.4,that thewhich certificatessigns maythe beCHUID issuedis underdeprecated ain departmentthis orrevision agency-specificof policythe thatStandard. hasIf beenthe cross-certifiedsignature withon the Federalbiometric Bridgedata CArecord (FBCA)was atgenerated thewith Mediuma Hardwaredifferent orkey Highthan Assurancethe Level.signature on the CHUID, the certificates field of the CMS external digital signature shallSHALL include the content signing certificate required to verify the signature on the biometric data record. Otherwise, the certificates field shallSHALL be omitted.

Additional descriptions for the PIV object identifiers are provided in Appendix B. The content signing certificate onSHALL aNOT validexpire PIVbefore Cardthe (oneexpiration thatof the card authentication certificate.

32 The on-card and off-card fingerprint bio metric data records are stored separately and, as conformant instances of different formal fingerprint template standards, are syntactically different. This is neitherdescribed expiredmore norfully revoked)in shall[SP not800-76]. be33 expiredThe biometric record’s CMS external digital signature certificates field is omitted.