BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

6.3 PIV Support of Graduated Authenticator Assurance Levels (was: PIV Support of Graduated Assurance Levels for Identity Authentication)

NIST PIV and digital identity FIPS 201-3 against FIPS 201-2
All changes in this version
modified 6 PIV Cardholder Authentication part of 6

Title changed

Before · FIPS 201-2

PIV Support of Graduated Assurance Levels for Identity Authentication

After · FIPS 201-3

PIV Support of Graduated Authenticator Assurance Levels for Identity Authentication

Control changed

Before · FIPS 201-2

The PIV Card supports a set of authentication mechanisms that can be used to implement graduated assurance levels for identity authentication. The following subsections specify which basic PIV authentication mechanisms may be used to support the various levels of identity authentication assurance as defined in Section 6.1. Two or more complementing authentication mechanisms may be applied in unison to achieve a higher degree of assurance of the identity of the PIV cardholder. For example, PKI- AUTH and BIO may be applied in unison to achieve a higher degree of assurance in cardholder identity.

Adequately designed and implemented relying systems can achieve the PIV Card authentication assurance levels stated in Tables 6-2 (physical access) and 6-3 (logical access). Less adequately designed or implemented relying systems may only achieve lower authentication assurance levels. The design of components of relying systems, including card readers, biometric readers, cryptographic modules, and key management systems, involves many factors not fully specified by FIPS 201, such as correctness of the functional mechanism, physical protection of the mechanism, and environmental conditions at the authentication point. Additional standards and best practice guidelines apply to the design and implementation of relying systems, e.g., [FIPS140] and [SP 800-116].

After · FIPS 201-3

The PIV Card supports a set of authentication mechanisms that can be used to implement graduated assurance levels. The assurance levels used for remote/networked access within this Standard are closely aligned with NIST [SP 800-63], which specifies a digital identity authentication.risk management process that is cited by OMB [M-19-17].

The following subsections specify which basic PIV authentication mechanisms maycan be used to support the various levels of identity authentication assurance aslevels defineddescribed in Sectionthis 6.1section. Two or more complementing authentication mechanisms mayMAY be applied in unisontogether to achieve a higher degree ofadditional assurance of the identity of the PIV cardholder. For example, PKI- AUTHPKI-AUTH and BIO may be applied in unison to achieve a higher degree ofadditional assurance inof cardholder identity.

Adequately designed and implemented relying systems can achieve the PIV Card authentication assurance levels stated in TablesSection 6-26.3.1 (for physical access) and 6-3in (Section 6.3.2 for logical access). LessRelying adequatelysystems that are inadequately designed or implemented relying systems may only achieve lower authentication assurance levels. The design of the components of relying systems, —including card readers, biometric readerscapture devices, cryptographic modules, and key management systems, —involves many factors not fully specified by FIPS 201, such as correctness of the functional mechanism, physical protection of the mechanism, and environmental conditions at the authentication point. Additional standards and best practice guidelines (e.g., [SP 800-53], [FIPS 140], and [SP 800-116]) apply to the design and implementation of relying systems, e.g

The authentication mechanisms described in the subsections below apply specifically to the use of PIV Cards for physical and logical access., [FIPS140]Authentication mechanisms for physical and logical access using derived PIV credentials is described in [SP 800-116800-157].