BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

6.2.2 Authentication Using On-Card Biometric One-to-One Comparison (OCC-AUTH) (was: Authentication Using On-Card Biometric Comparison (OCC-AUTH))

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 6 PIV Cardholder Authentication part of 6.2

Title changed

Before · FIPS 201-2

Authentication Using On-Card Biometric Comparison (OCC-AUTH)

After · FIPS 201-3

Authentication Using On-Card Biometric One-to-One Comparison (OCC-AUTH)

Control changed

Before · FIPS 201-2

The PIV Card Application may host the optional on-card biometric comparison algorithm. In this case, on-card biometric comparison data is stored on the card, which cannot be read, but could be used for identity verification. A live-scan biometric is supplied to the card to perform cardholder-to-card (CTC)

32 The PIV Authentication certificate or Card Authentication certificate may be leveraged instead of the CHUID to verify that the card is not expired. authentication and the card responds with an indication of the success of the on-card biometric comparison. The response includes information that allows the reader to authenticate the card. The cardholder PIN is not required for this operation. The PIV Card shall include a mechanism to block this authentication mechanism after a number of consecutive failed authentication attempts as stipulated by the department or agency. As with authentication using the PIV biometrics, if agencies choose to implement on-card biometric comparison, it shall be implemented as defined in [SP 800-73] and [SP 800-76].

Some of the characteristics of the on-card biometric comparison authentication mechanism are as follows:

• Highly resistant to credential forgery.

• Strong resistance to use of unaltered card by non-owner.

• Applicable with contact and contactless card readers.

After · FIPS 201-3

The PIV Card Applicationapplication mayMAY host thean optional on-card biometric comparisonOCC algorithm. In this case, on-card biometric comparisonOCC data is stored on the card, which cannot be read, from the card but could be used for identitybiometric verification. A live-scanfingerprint biometric template is supplied to the card to perform cardholder-to-card (CTC)

32 The PIV Authentication certificate or Card Authentication certificate may be leveraged instead of the CHUID to verify that the card is not expired. authentication, and the card responds with an indication of the successa ofpositive theor on-cardnegative biometric comparisonverification decision. The response includes information that allows the reader to authenticate the card. TheEntry of the cardholder PIN is not required for this operationOCC-AUTH. The PIV Card shallSHALL include a mechanism to block this authentication mechanism after a number of consecutive failed authentication attempts as stipulated by the department or agency. As with authentication using theBIO PIVand biometricsBIO-A, if agencies choose to implement on-card biometric comparisonOCC, it shallSHALL be implemented as defined in [SP 800-73] and [SP 800-76].

Some of the characteristics of the on-card biometric comparison authentication mechanismOCC-AUTH are as follows:

• Highlyhighly resistant to credential forgery.

;
• Strongstrong resistance to use of unaltered card by non-owner.

;
• Applicableusable with contact and contactless card readers; and
• privacy-enhancing, as the biometric template is compared directly on the PIV Card and never exported.