BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

6.2.1.1 Unattended Authentication Using Biometric Data (BIO) (was: Unattended Authentication Using PIV Biometric (BIO))

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 6 PIV Cardholder Authentication part of 6.2.1

Title changed

Before · FIPS 201-2

Unattended Authentication Using PIV Biometric (BIO)

After · FIPS 201-3

Unattended Authentication Using PIV Biometric Data (BIO)

Control changed

Before · FIPS 201-2

The following steps shall be performed for unattended authentication of the PIV biometric:

• The CHUID or another data element 32 is read from the card and is checked to ensure the card has not expired and that it is from a trusted source.

• The cardholder is prompted to submit a PIN, activating the PIV Card.

• The PIV biometric is read from the card.

• The signature on the biometric is verified to ensure the biometric is intact and comes from a trusted source. Note that the signature verification may require retrieval of the content signing certificate from the CHUID if the signature on the biometric was generated with the same key as the signature on the CHUID.

• The cardholder is prompted to submit a live biometric sample.

• If the biometric sample matches the biometric read from the card, the cardholder is authenticated to be the owner of the card.

• The FASC-N (or UUID) in the CHUID or other data element is compared with the FASC-N (or UUID) in the Signed Attributes field of the external digital signature on the biometric.

+ A unique identifier within the CHUID or other data element is used as input to the authorization check to determine whether the cardholder should be granted access.

After · FIPS 201-3

The following steps shallSHALL be performed for unattended authentication of the PIVusing biometric data:

• The CHUID or another data element 3238 is read from the card. andThe signature of the CHUID or another data element is checkedverified to ensure that the card has not expired and that itthe iscard comes from a trusted source.


• The cardholder is prompted to submitenter a PIN, activatingto activate the PIV Card.


• The PIV biometric data record is read from the card.


• The signature on the biometric data record is verified to ensure that the biometric data record is intact and comes from a trusted source. Note that the signature verification may require retrieval of the content signing certificate from the CHUID if the signature on the biometric data record was generated with the same key as the signature on the CHUID.


• The cardholder is prompted to submitcapture a livenew biometric sample.


• If the new biometric sample matches theelicits biometrica readpositive frombiometric theverification carddecision, the cardholder is authenticated to beas the owner of the card.


• The FASC-N (or the card UUID) in the CHUID or other data element is compared with the FASC-N (orcorresponding UUID)element in the Signedsigned Attributesattributes field of the external digital signature onin the biometric data record.

+
• A unique identifier within the CHUID or other data element is used as input to the authorization check to determine whether the cardholder should be granted access.

38 The PIV authentication certificate or car d authentication certificate may be used instead of the CHUID to verify that the card is not expired.