6.3.2 Logical Access
All changes in this version
Title
Logical Access
Control changed
Before · FIPS 201-2
The PIV Card may be used to authenticate the cardholder in support of decisions concerning access to logical information resources. For example, a cardholder may log in to his or her department or agency network using the PIV Card; the identity established through this authentication process can be used for determining access to file systems, databases, and other services available on the network.
Table 6-3 describes the authentication mechanisms defined for this Standard to support logical access control. An authentication mechanism that is suitable for a higher assurance level can also be applied to meet the requirements for a lower assurance level.
Table 6-3. Authentication for Logical Access
PIV Assurance Level Required by Application/Resource Applicable PIV Authentication Mechanism
Local Workstation Environment Remote/Network System Environment LITTLE or NO confidence CHUID
SOME confidence PKI-CAK PKI-CAK
HIGH confidence BIO VERY HIGH confidence BIO-A, OCC-AUTH, PKI-AUTH PKI-AUTH Appendix A—PIV Validation, Certification, and Accreditation
This appendix provides compliance requirements for PIV validation, certification, and accreditation, and is normative.
A.1 Accreditation of PIV Card Issuers (PCI)
[HSPD-12] requires that all cards be issued by providers whose reliability has been established by an official accreditation process. The accreditation of the PIV Card issuer shall be reviewed through a third- party assessment to enhance the trustworthiness of the credential. To facilitate consistent independent validation of the PCI, NIST developed a set of attributes as the basis of reliability assessment of PIV Card issuers in SP 800-79 and published this document in July 2005. Subsequent lessons learned in implementation experience (in credential management and PIV Card issuance) of various agencies together with the evolution of PCI organizations motivated NIST to develop a new accreditation methodology that is objective, efficient, and will result in consistent and repeatable accreditation decisions and published the substantial revision as SP 800-79-1 in June 2008 [SP 800-79]. The new PCI accreditation methodology is built on a foundation of four major accreditation topics, 13 accreditation focus areas, and a total of 79 control requirements distributed under the various accreditation focus areas. Associated with each control requirement is a set of assessment methods, the exercise of the latter will result in outcomes that form the basis for accreditation decisions.
The four major accreditation topics identified in [SP 800-79] are:
• organizational preparedness;
• security management and data protection;
• infrastructure elements; and
• (PIV) processes.
The entire spectrum of activities in the PCI accreditation methodology is divided into the following four phases:
• initiation phase;
• assessment phase;
• accreditation phase; and
• monitoring phase.
The initiation phase involves communicating the goals of the assessment/accreditation to the key personnel of the PCI organization and the review of documents such as the PCI operations plan. In the assessment phase, the appropriate assessment methods stipulated in the methodology for each PCI control are carried out and the individual results recorded. The accreditation phase involves aggregating the results of assessment, arriving at an accreditation decision, and issuing the appropriate notification – the authorization to operate (ATO) or the denial of authorization to operate (DATO), that is consistent with the accreditation decision. A.2 Application of Risk Management Framework to IT System(s) Supporting PCI
The accreditation of the capability and reliability of a PCI using the methodology outlined in [SP 800-79] depends upon adequate security for the information systems that are used for PCI functions. The assurance that such a security exists in a PCI is obtained through evidence of the application of the Risk Management Framework guidelines specified in [SP 800-37]. The methodology in [SP 800-37] in turn was created pursuant to a mandate in Appendix III of Office of Management and Budget (OMB) Circular A-130. An Information system authorization decision together with evidence of security control monitoring compliant with [SP 800-37] guidelines signifies that a PCI organization’s official accepts responsibility for the security (in terms of confidentiality, integrity, and availability of information) of the information systems that will be involved in carrying out the PCI functions. Hence evidence of successful application of Risk Management Framework consistent with [SP 800-37] guidelines is mandatory for issuing PCI accreditation using [SP 800-79].
A.3 Conformance Testing of PIV Card Application and Middleware
Assurance of conformance of the PIV Card Application and PIV Middleware interfaces to this Standard and its associated technical specifications is needed in order to meet the security and interoperability goals of [HSPD-12]. To facilitate this, NIST has established the NIST Personal Identity Verification Program (NPIVP). Under this program NIST has developed test procedures in SP 800-85A, PIV Card Application and Middleware Interface Test Guidelines (SP 800-73 compliance) , and an associated toolkit for conformance testing of PIV Card Applications and PIV Middleware [SP 800-85A]. Commercial products under these two categories are tested by the set of accredited test laboratories, accredited under the National Voluntary Laboratory Accreditation Program (NVLAP) program, using the NIST supplied test procedures and toolkit. The outcomes of the test results are validated by NIST, which then issues validation certificates. Information about NPIVP is available at http://csrc.nist.gov/groups/SNS/piv/npivp.
A.4 Cryptographic Testing and Validation
All on-card cryptographic modules hosting the PIV Card Application and cryptographic modules of card issuance and maintenance systems shall be validated to [FIPS140] with an overall Security Level 2 (or higher). The facilities for [FIPS140] testing are the Cryptographic and Security Testing laboratories accredited by the NVLAP program of NIST. Vendors wanting to supply cryptographic modules can select any of the accredited laboratories. The tests conducted by these laboratories for all vendor submissions are validated and a validation certificate for each vendor module is issued by the Cryptographic Module Validation Program (CMVP), a joint program run by NIST and the Communications Security Establishment (CSE) of the Government of Canada. The details of the CMVP and NVLAP programs and the list of testing laboratories can be found at the CMVP Web site at http://csrc.nist.gov/groups/STM/cmvp/index.html .
A.5 FIPS 201 Evaluation Program
In order to evaluate the conformance of different families of products that support the PIV processes to this Standard and its associated technical specifications, the Office of Governmentwide Policy under GSA set up the FIPS 201 Evaluation Program. The product families currently include card personalization products, card readers, products involved in credential enrollment functions such as fingerprint and facial image capture equipment, biometric fingerprint template generators, etc. Products evaluated and approved under this program are placed on the FIPS 201 Approved Products List to enable procurement of conformant products by implementing agencies. The details of the program are available at http://fips201ep.cio.gov/. Appendix B—PIV Object Identifiers and Certificate Extension
This normative appendix provides additional details for the PIV objects identified in Section 4.
B.1 PIV Object Identifiers
Table B-1 lists details for PIV object identifiers.
Table B-1. PIV Object Identifiers
ID Object Identifier Description PIV eContent Types id-PIV-CHUIDSecurityObject 2.16.840.1.101.3.6.1 The associated content is the concatenated contents of the CHUID, excluding the authentication key map 36 and the asymmetric signature field. id-PIV-biometricObject 2.16.840.1.101.3.6.2 The associated content is the concatenated CBEFF_HEADER + STD_BIOMETRIC_RECORD. PIV Attributes pivCardholder-Name 2.16.840.1.101.3.6.3 The attribute value is of type DirectoryString and specifies the PIV cardholder’s name. pivCardholder-DN 2.16.840.1.101.3.6.4 The attribute value is an X.501 type Name and specifies the DN associated with the PIV cardholder in the PIV certificate(s). pivSigner-DN 2.16.840.1.101.3.6.5 The attribute value is an X.501 type Name and specifies the subject name that appears in the PKI certificate for the entity that signed the biometric or CHUID. pivFASC-N 2.16.840.1.101.3.6.6 The pivFASC-N OID may appear as a name type in the otherName field of the subjectAltName extension of X.509 certificates or a signed attribute in CMS external signatures. Where used as a name type, the syntax is OCTET STRING. Where used as an attribute, the attribute value is of type OCTET STRING. In each case, the value specifies the FASC-N of the PIV Card. PIV Extended Key Usage id-PIV-content-signing 2.16.840.1.101.3.6.7 This specifies that the public key may be used to verify signatures on CHUIDs and PIV biometrics. id-PIV-cardAuth 2.16.840.1.101.3.6.8 This specifies that the public key is used to authenticate the PIV Card rather than the PIV cardholder.
The OIDs for certificate policies are specified in [COMMON].
B.2 PIV Certificate Extension
The PIV NACI indicator (background investigation indicator) extension indicates whether the subject’s background investigation was incomplete at the time of credential issuance. The PIV NACI indicator (background investigation indicator) extension is always non-critical, and shall appear in all PIV
36 The authentication key map was deprecated in SP 800-73-2 and was removed from SP 800-73-3. Authentication certificates and Card Authentication certificates. The value of this extension is asserted as follows:
• TRUE if, at the time of credential issuance, (1) the FBI National Criminal History Fingerprint Check has completed, and (2) a background investigation has been initiated but has not completed.
• FALSE if, at the time of credential issuance, the subject’s background investigation has been completed and successfully adjudicated.
The PIV NACI indicator (background investigation indicator) extension is identified by the id-piv-NACI object identifier. The syntax for this extension is defined by the following ASN.1 module.
PIV-Cert-Extensions { 2 16 840 1 101 3 6 10 1 }
DEFINITIONS EXPLICIT TAGS ::=
BEGIN
-- EXPORTS ALL --
-- IMPORTS NONE --
id-piv-NACI OBJECT IDENTIFIER ::= { 2 16 840 1 101 3 6 9 1 }
NACI-indicator ::= BOOLEAN
END Appendix C—Glossary of Terms, Acronyms, and Notations
This informative appendix describes the vocabulary and textual representations used in the document.
C.1 Glossary of Terms
The following terms are used throughout this Standard.
Access Control: The process of granting or denying specific requests: 1) obtain and use information and related information processing services; and 2) enter specific physical facilities (e.g., Federal buildings, military establishments, border crossing entrances).
Applicant: An individual applying for a PIV Card/credential. The applicant may be a current or prospective Federal hire, a Federal employee, a government affiliate, or a contractor. 37
Application: A hardware/software system implemented to satisfy a particular set of requirements. In this context, an application incorporates a system used to satisfy a subset of requirements related to the verification or identification of an end user’s identity so that the end user’s identifier can be used to facilitate the end user’s interaction with the system.
Architecture: A highly structured specification of an acceptable approach within a framework for solving a specific problem. An architecture contains descriptions of all the components of a selected, acceptable solution while allowing certain details of specific components to be variable to satisfy related constraints (e.g., costs, local environment, user acceptability).
Asymmetric Keys: Two related keys, a public key and a private key, that are used to perform complementary operations, such as encryption and decryption or signature generation and signature verification.
Authentication: The process of establishing confidence of authenticity; in this case, in the validity of a person’s identity and the PIV Card.
Biometric: A measurable, physical characteristic or personal behavioral trait used to recognize the identity, or verify the claimed identity, of an applicant. Facial images, fingerprints, and iris image samples are all examples of biometrics.
Biometric Information: The stored electronic information pertaining to a biometric. This information can be in terms of raw or compressed pixels or in terms of some characteristic (e.g., patterns).
Capture: The method of taking a biometric sample from an end user. [INCITS/M1-040211]
Cardholder: An individual possessing an issued PIV Card.
Card Management System: The card management system manages the lifecycle of a PIV Card Application.
Certificate Revocation List: A list of revoked public key certificates created and digitally signed by a certification authority. [RFC5280]
37 See Page 2 of [OMB0524] for further details of individuals who are eligible to be issued PIV Cards. Certification: The process of verifying the correctness of a statement or claim and issuing a certificate as to its correctness.
Certification Authority: A trusted entity that issues and revokes public key certificates.
Chain-of-trust: The chain-of-trust is a sequence of related enrollment data sets that is created and maintained by PIV Card issuers.
Comparison: The process of comparing a biometric with a previously stored reference. See also “Identification” and “Identity Verification”. [INCITS/M1-040211]
Component: An element of a large system, such as an identity card, issuer, card reader, or identity verification support, within the PIV system.
Conformance Testing: A process established by NIST within its responsibilities of developing, promulgating, and supporting FIPS for testing specific characteristics of components, products, and services, as well as people and organizations for compliance with a FIPS.
Credential: Evidence attesting to one’s right to credit or authority; in this Standard, it is the PIV Card and data elements associated with an individual that authoritatively binds an identity (and, optionally, additional attributes) to that individual.
Cryptographic Key (Key): A parameter used in conjunction with a cryptographic algorithm that determines the specific operation of that algorithm.
E-Authentication Assurance Level: A measure of trust or confidence in an authentication mechanism defined in [OMB0404] and [SP 800-63], in terms of four levels:
• Level 1: LITTLE OR NO confidence
• Level 2: SOME confidence
• Level 3: HIGH confidence
• Level 4: VERY HIGH confidence Enrollment Data Set: A record including information about a biometric enrollment: name and role of the acquiring agent, office and organization, time, place, and acquisition method.
Federal Agency Smart Credential Number (FASC-N): As required by FIPS 201, one of the primary identifiers on the PIV Card for physical access control. The FASC-N is a fixed length (25 byte) data object, specified in [SP 800-73], and included in several data objects on a PIV Card.
Federal Information Processing Standards (FIPS): A standard for adoption and use by Federal departments and agencies that has been developed within the Information Technology Laboratory and published by NIST, a part of the U.S. Department of Commerce. A FIPS covers some topic in information technology to achieve a common level of quality or some level of interoperability.
Hash Function: A function that maps a bit string of arbitrary length to a fixed length bit string. Secure hash functions [FIPS180] satisfy the following properties:
After · FIPS 201-3
The PIV Card maycan be used to authenticate the cardholder in support of decisions concerningregarding access to logical information resources. For example, a cardholder may log inauthenticate to his or hertheir department or agency network using the PIV Card; the identity established through this authentication process can be used forto determiningdetermine access to fileinformation systems, databases, and other servicesapplications available on the network.
Table 6-36-2 describeslists the authentication mechanisms defined for this Standard to support logical access control for remote/networked access. An authentication mechanism that is suitable for a higher assurance level can also be applied to meet the requirements for a lower assurance level.
Table 6-36-2. Authentication for Logical AccessPIV Assurance Level Required by Application/Resource Applicable PIV Authentication MechanismMechanisms
Local WorkstationEnvironmentfor Remote/Network System Environment LITTLE or NO confidence CHUIDAccess
SOME confidence PKI-CAK PKI-CAK
HIGH confidence BIO VERY HIGH confidence BIO-A, OCC-AUTH, PKI-AUTH PKI-AUTH Appendix A—PIV Validation, Certification, and AccreditationThis appendix provides compliance requirements for PIV validation, certification, and accreditation,Authentication andMechanism isSupported normative.Authenticator
A.1AccreditationAssurance ofLevel PIVPKI-CAK CardAAL1 IssuersPKI-AUTH (PCI)AAL3[HSPD-12] requires that all cards be issued by providers whose reliability has been established by an official accreditation process. The accreditation of the PIV Card issuer shall be reviewed through a third- party assessment to enhance the trustworthiness of the credential. To facilitate consistent independent validation of the PCI, NIST developed a set of attributes as the basis of reliability assessment of PIV Card issuers in SP 800-79 and published this document in July 2005. Subsequent lessons learned in implementation experience (in credential management and PIV Card issuance) of various agencies together with the evolution of PCI organizations motivated NIST to develop a new accreditation methodology that is objective, efficient, and will result in consistent and repeatable accreditation decisions and published the substantial revision as SP 800-79-1 in June 2008 [SP 800-79800-63]. The new PCI accreditation methodology is built on a foundation of four major accreditation topics, 13 accreditation focus areas, and a total of 79 control requirements distributed under the various accreditation focus areas. Associated with each control requirement is a set of assessment methods, the exercise of the latter will result in outcomes that form the basis for accreditation decisions.defined
The four major accreditation topics identifiedinauthenticator [SPassurance 800-79]levels are:
•organizational preparedness;not
• security management and data protection;
• infrastructure elements; and
• (PIV) processes.
The entire spectrum of activities in the PCI accreditation methodology is divided into the following four phases:
• initiation phase;
• assessment phase;
• accreditation phase; and
• monitoring phase.
The initiation phase involves communicating the goals of the assessment/accreditation to the key personnel of the PCI organization and the review of documents such as the PCI operations plan. In the assessment phase, the appropriate assessment methods stipulated in themethodologyspecified for each PCI control are carried out and the individual results recorded. The accreditation phase involves aggregating the results of assessment, arriving at an accreditation decision, and issuing the appropriate notification – the authorization to operate (ATO) or the denial of authorization to operate (DATO), that is consistent with the accreditation decision. A.2 Application of Risk Managementlocal Frameworkauthentication touse ITcases System(s) Supporting PCIi.
The accreditation of the capability and reliability of a PCI using the methodology outlined in [SP 800-79] depends upon adequate security for the information systems that are used for PCI functions The assurance that such a security exists in a PCI is obtained through evidence of the application of the Risk Management Framework guidelines specified in [SP 800-37]e. The methodology in [SP 800-37] in turn was created, pursuantauthentication to a mandate in Appendix III of Office of Management and Budget (OMB) Circular A-130. An Information system authorization decision together with evidence of security control monitoring compliant with [SP 800-37] guidelines signifies that a PCI organization’s official accepts responsibility for the security (in terms of confidentiality, integrity, and availability of information) of the information systems that will be involved in carrying out the PCI functions. Hence evidence of successful application of Risk Management Frameworkresource consistentco-located with [SP 800-37] guidelines is mandatory for issuing PCI accreditation using [SP 800-79].the
A.3 Conformance Testing of PIV Card Application and Middleware
Assurance of conformance of PIV Card Application and PIV Middleware interfaces to this Standard and its associated technical specifications is needed in order to meet the security and interoperability goals of [HSPD-12]. To facilitate this, NIST has established the NIST Personal Identity Verification Program (NPIVP). Under this program NIST has developed test procedures in SP 800-85A, PIV Card Application and Middleware Interface Test Guidelines (SP 800-73 compliance) , and an associated toolkit for conformance testing of PIV Card Applications and PIV Middleware [SP 800-85A]. Commercial products under these two categories are tested by the set of accredited test laboratories, accredited under the National Voluntary Laboratory Accreditation Program (NVLAPcardholder) program, using the NIST supplied test procedures and toolkit. The outcomes of the test results are validated by NISTNevertheless, which then issues validation certificates. Information about NPIVP is available at http://csrc.nist.gov/groups/SNS/piv/npivp.the PIV
A.4 Cryptographic Testing and Validation
All on-card cryptographic modules hosting Card Application and cryptographic modules of card issuance and maintenance systems shall be validated to [FIPS140] with an overall Security Level 2 (or higher).authentication Themechanisms facilitiesprovide for [FIPS140] testing are the Cryptographic and Security Testing laboratories accredited by the NVLAP program of NIST. Vendors wanting to supply cryptographic modules can selectgraduated anylevels of the accredited laboratories. The tests conducted by these laboratories for all vendor submissions are validated and a validationauthentication certificateassurance for each vendor module is issued by the Cryptographic Module Validation Program (CMVP), a joint program run by NIST and the Communications Security Establishment (CSE) of the Government of Canada. The details of the CMVP and NVLAP programs and the list of testing laboratories can be found at the CMVP Web site at http://csrc.nist.gov/groups/STM/cmvp/index.html .local
A.5 FIPS 201 Evaluation Program
In order to evaluate the conformance of different families of products that support the PIV processes to this Standard and its associated technical specifications, the Office of Governmentwide Policy under GSA set up the FIPS 201 Evaluation Program. The product families currently include card personalization products, card readers, products involved in credential enrollment functions such as fingerprint and facial image capture equipment, biometric fingerprint template generators, etc. Products evaluated and approved underthisauthentication programuse arecases placedbased on the FIPS 201 Approved Products List to enable procurement of conformant products by implementing agencies. The details of the program are available at http://fips201ep.cio.gov/. Appendix B—PIV Object Identifiers and Certificate Extensiontheir
This normative appendix provides additional details for the PIVobjectscharacteristics identifiedoutlined in Section 4.6.
B.1 PIV Object Identifiers
Table B-1 lists details for PIV object identifiers.
Table B-1. PIV Object Identifiers
ID Object Identifier Description PIV eContent Types id-PIV-CHUIDSecurityObject 2.16.840.1.101.3.1 The associated content is the concatenated contents of the CHUID, excluding the authentication key map 36 and the asymmetric signature field. id-PIV-biometricObject 2.16.840.1.101.3.6.2 The associated content is the concatenated CBEFF_HEADER + STD_BIOMETRIC_RECORD. PIV Attributes pivCardholder-Name 2.16.840.1.101.3.6.3 The attribute value is of type DirectoryString and specifies the PIV cardholder’s name. pivCardholder-DN 2.16.840.1.101.3.6.4 The attribute value is an X.501 type Name and specifies the DN associated with the PIV cardholder in the PIV certificate(s). pivSigner-DN 2.16.840.1.101.3.6.5 The attribute value is an X.501 type Name and specifies the subject name that appears in the PKI certificate for the entity that signed the biometric or CHUID. pivFASC-N 2.16.840.1.101.3.6.6 The pivFASC-N OID may appear as a name type in the otherName field of the subjectAltName extension of X.509 certificates or a signed attribute in CMS external signatures. Where used as a name type, the syntax is OCTET STRING. Where used as an attribute, the attribute value is of type OCTETassurance STRING.provided Inby each case, the value specifies the FASC-N of the PIV Card. PIV Extended Key Usage id-PIV-content-signing 2.16.840.1.101.3.6.7 This specifies that the public key may be used to verify signatures on CHUIDs and PIV biometrics. id-PIV-cardAuth 2.16.840.1.101.3.6.8 This specifies that the public key is used to authenticate the PIV Card rather than the PIV cardholder.authentication
TheOIDsmechanisms for certificate policies are specified in [COMMON].local authentication
B.2 PIV Certificate Extension
The PIV NACI indicator (background investigation indicator) extension indicates whether the subject’s background investigation was incomplete at the time of credential issuance. The PIV NACI indicator (background investigation indicator) extension is always non-critical, and shall appear in all PIV
36 Thekey map was deprecated in SP 800-73-2 and was removed from SP 800-73-3. Authentication certificates and Card Authentication certificates. The value of thisuse extensioncases is asserted as follows:summarized
• TRUE if, at the time of credential issuance, (1) the FBI National Criminal History Fingerprint Check has completed, and (2) a background investigation has been initiated buthasin notTable completed6-3.• FALSE if, at the time of credential issuance, the subject’s background investigation has been completed and successfullyTable adjudicated6-3.
TheNACI indicator (background investigation indicator) extension is identified by the id-piv-NACI object identifier. TheAuthentication syntaxMechanisms for this extension is defined by the following ASN.1 module.Local
PIV-Cert-Extensions { 2 16 840 1 101 3 6 10 1 }
DEFINITIONS EXPLICIT TAGS ::=
BEGIN
-- EXPORTS ALL --
-- IMPORTS NONE --
id-piv-NACI OBJECT IDENTIFIER ::= { 2 16 840 1 101 3 6 9 1 }
NACI-indicator ::= BOOLEAN
END Appendix C—Glossary of Terms, Acronyms, and Notations
This informative appendix describes the vocabulary and textual representations used in the document.
C.1 Glossary of Terms
The following terms are used throughoutthisWorkstation Standard.Access Control: The process of granting or denying specific requests: 1) obtain and use information and related information processing services; and 2) enter specific physical facilities (e.g., Federal buildings, military establishments, border crossing entrances).Applicant: An individual applying for a PIV Card/credential. The applicant may be a current or prospective Federal hire, a Federal employee, a government affiliate, or a contractor. 37Authentication
Application: A hardware/software system implemented to satisfy a particular set of requirements. In this context, an application incorporates a system used to satisfy a subset of requirements related to the verification or identification of an end user’s identity so that the end user’s identifier can be used to facilitate the end user’s interaction with the system.
Architecture: A highly structured specification of an acceptable approach within a framework for solving a specific problem. An architecture contains descriptions of all the components of a selected, acceptable solution while allowing certain details of specific components to be variable to satisfy related constraints (e.g., costs, local environment, user acceptability).
Asymmetric Keys: Two related keys, a public key and a private key, that are used to perform complementary operations, such as encryption and decryption or signature generation and signature verification.: The process of establishing confidenceMechanism ofAssurance authenticity;Provided inPKI-CAK thisSome case,confidence in the validity of a person’s identity and the PIV Card.asserted identity
Biometric: A measurable, physical characteristic or personal behavioral trait used to recognize the identity, or verify the claimed, of an applicant. Facial images, fingerprints, and iris image samples are all examples of biometrics.BIO
Biometric Information: The stored electronic information pertaining to a biometric. This information can be in terms of raw or compressedpixelsMedium orconfidence in terms of some characteristic (e.g., patterns).the
Capture: The method of taking a biometric sample from an end user. [INCITS/M1-040211]
Cardholder: An individual possessing an issued PIV Card.
Card Management System: The card management system manages lifecycle of a PIV Card Application.asserted identity
Certificate Revocation List: A list of revoked public key certificates created and digitally signed by a certification authority. [RFC5280]
37 See Page 2 of [OMB0524] for further details of individuals who are eligible to be issued PIV Cards. Certification: The process of verifying the correctness of a statement or claim and issuing a certificate as to its correctness.
Certification Authority: A trusted entity that issues and revokes public key certificates.
Chain-of-trust: The chain-of-trust is a sequence of related enrollment data sets that is created and maintained by PIV Card issuers.
Comparison: The process of comparing a biometric with a previously stored reference. See also “Identification” and “Identity Verification”. [INCITS/M1-040211]
Component: An element of a large system, such as an identity card, issuer, card reader, orverification support, within the PIV system.BIO-A
Conformance Testing: A process established by NIST within its responsibilities of developing, promulgating, and supporting FIPS for testing specific characteristics of components, products, and services, as well as people and organizations for compliance with a FIPS.
Credential: Evidence attesting to one’s right to creditorHigh authority;confidence in this Standard, it is the PIV Card and data elements associated with an individual that authoritatively binds anasserted identity (and, optionally, additional attributes) to that individual.OCC-AUTH
Cryptographic Key (Key): A parameter used in conjunction with a cryptographic algorithm that determines the specific operation of that algorithm.
E-Authentication Assurance Level: A measure of trust or confidence in an authentication mechanism defined in [OMB0404] and [SP 800-63], in terms of four levels:
• Level 1: LITTLE OR NO confidence
• Level 2: SOME confidence
• Level 3: HIGH confidence
• Level 4: VERYHIGHHigh confidence Enrollment Data Set: A record including information about a biometric enrollment: name and role of the acquiring agent, office and organization, time, place, and acquisition method.in
Federal Agency Smart Credential Number (FASC-N): As required by FIPS 201, one of the primary identifiers on the PIV Card for physical access control. The FASC-N is a fixed length (25 byte) data object, specified [SP 800-73], and included in several data objects on a PIV Card.the
Federal Information Processing Standards (FIPS): A standard for adoption and use by Federal departments and agencies that has been developed within Information Technology Laboratory and published by NIST, a part of the U.S. Department of Commerce. Aasserted FIPSidentity coversPKI-AUTH someHigh topicconfidence in information technology to achieve a common level of quality or some level of interoperability.the
Hash Function: A function that maps a bit string of arbitrary length to a fixed length bit string. Secure hash functions [FIPS180] satisfy followingasserted properties:identity