BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

6.2.1 Authentication Using O˙-Card Biometric One-to-One Comparison (was: Authentication Using Off-Card Biometric Comparison)

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 6 PIV Cardholder Authentication part of 6.2

Title changed

Before · FIPS 201-2

Authentication Using Off-Card Biometric Comparison

After · FIPS 201-3

Authentication Using Off-CardO˙-Card Biometric One-to-One Comparison

Control changed

Before · FIPS 201-2

The PIV Card Application hosts the signed fingerprint templates and, optionally, the signed iris images. Either biometric can be read from the card following cardholder-to-card (CTC) authentication using a PIN supplied by the cardholder. These PIV biometrics are designed to support a cardholder-to-external system (CTE) authentication mechanism through a match-off-card scheme. The following subsections define two authentication schemes that make use of the PIV biometrics. 31

Some characteristics of the PIV Biometrics authentication mechanisms (described below) are as follows:

31 As noted in Section 4.2.3.1, neither the fingerprint templates nor the iris images are guaranteed to be present on a PIV Card, since it may not be possible to collect fingerprints from some cardholders and iris images collection is optional. When biometric authentication cannot be performed, PKI-AUTH is the recommended alternate authentication mechanism.
• Strong resistance to use of unaltered card by non-owner since PIN and cardholder biometric are required.

• Digital signature on biometric, which is checked to further strengthen the mechanism.

• Slower mechanism, because it requires two interactions (e.g., presentation of PIN and biometric) with the cardholder.

• Does not provide protection against use of a revoked card.

• Applicable with contact card readers, and contactless card readers that support the virtual contact interface.

After · FIPS 201-3

The PIV Card Applicationapplication hosts the signed fingerprint templatesbiometric andtemplates, optionallyelectronic facial image, theand signedoptional electronic iris images. EitherThese biometric data records can be read from the card following cardholder-to-card (CTC) authentication using a PIN supplied by the cardholder. TheseThe PIVbiometric biometricsdata records are designed to support a cardholder-to-external systemthe (CTE) authentication mechanism through aan match-off-cardoff-card biometric one-to-one comparison scheme. The following subsections define two authentication schemesmechanisms that make use of thebiometric PIVdata biometricsrecords. 31

Some characteristics of the PIV Biometrics authentication mechanisms (described below) are as37 follows:

3137 As noted in Section 4.2.3.1, neither the fingerprint templates nor theb irisiometric imagestemplates are not guaranteed to be present oncontain abiometric PIVcharacteristic Card,data since it may not be possible to collect fingerprints from some cardholders. andAdditionally, electronic iris images collectionare not guaranteed to be present on a PIV Card since iris biometric capture is optional. When biometric authenticationverification cannot be performed, PKI-AUTH is the recommended alternate authentication mechanism.
 Some characteristics of the authentication mechanisms using biometric data are as follows:

• Strongstrong resistance to use of unalteredthe cardPIV Card by a non-owner since both PIN entry and cardholder biometric characteristics are required.

,
• Digitaldigital signature on biometric data records, which is checked to further strengthen the mechanism.

,
• Slower mechanism,slower becausesince it requires twomultiple interactions (e.g.,with the cardholder for presentation of the PIN and biometric)acquisition withof thea cardholder.

biometric sample,
• Doesdoes not provide protection against use of a revoked card.

, and
• Applicableusable with both contact card readers, and contactless card readers that support the virtual contact interface.