BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4.2.4 PIV Unique Identifiers

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 4 PIV Front-End Subsystem part of 4.2

Title

PIV Unique Identifiers

Control changed

Before · FIPS 201-2

A cardholder is authenticated through identification and authentication (I&A) using the PIV Card (and its identifier) in authentication mechanisms described in Section 6. The authenticated identity may then be used as the basis for making authorization decisions. Unique identifiers for both authentication and authorization are provided in this Standard in order to uniquely identify the cardholder. The two types of identifiers that serve as identification (of the cardholder) for authentication and authorization purposes, are described as follows:

+ Card identifiers

Each PIV card contains a UUID and a FASC-N that uniquely identify the card and, by correspondence, the cardholder. These two card identifiers are represented in all of the authentication data elements for the purpose of binding the PIV data elements to the same PIV Card.

+ Cardholder Identifiers

Other identifiers may be present in credentials on the PIV Card that identity the cardholder rather than the card. Examples include the subject name and names that may appear in the subjectAltName extension in the PIV Authentication certificate.

After · FIPS 201-3

A cardholder is authenticated through identification and authentication (I&A) using the PIV Card (and its identifier) in authentication mechanisms described in Section 6. The authenticated identity mayMAY then be used as the basis for making authorization decisions. Unique identifiers for both authentication and authorization are provided in this Standard in order to uniquely identify the cardholder. The two types of identifiers that serve as identification (of the cardholder) for authentication and authorization purposes, are described as follows:

+ Card identifiers

 Each PIV cardCard contains a card UUID and a FASC-N that uniquely identify the card and, by correspondence, the cardholder. These two card identifiers are represented in all of the authentication data elements for the purpose of binding the PIV data elements to the same PIV Card.

+ CardholderFor Identifiersexample, the card UUID is represented in the GUID data element of the CHUID, in the entryUUID attribute of CMS-signed biometric data records and in the subjectAltName extension of PIV authentication certificates. Similarly, the FASC-N is represented in the CHUID, in the pivFASC- N attribute of CMS-signed biometric data records, and in the subjectAltName extension of PIV authentication certificates.

Cardholder identifiers Other identifiers mayMAY be present in credentials on the PIV Card that identityidentify the cardholder rather than the card. Examples include the subjectcardholder nameUUID andthat may appear in the CHUID or the subject names that may appear in the subjectAltName extension in the PIV Authenticationauthentication certificate.