BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

Appendix B PIV Authentication Mechanisms

NIST PIV and digital identity SP 800-73-5 against SP 800-73-4
All changes in this version
added Appendix B PIV Authentication Mechanisms

Title changed

Before · SP 800-73-4

After · SP 800-73-5

PIV Authentication Mechanisms

Control changed

Before · SP 800-73-4

After · SP 800-73-5

PIV authentication mechanisms and application scenarios are described in this section to provide guidelines on the usage and behavior supported by the PIV Card. FIPS 201 describes PIV authentication as “the process of establishing confidence in the identity of the cardholder presenting a PIV Card” [FIPS201] . The fundamental goal of using the PIV Card is to authenticate the identity of the cardholder to a system or person that is controlling access to a protected resource or facility. This end goal MAY be reached by various combinations of one or more of the validation steps described below:

• Card Validation (CardV) — This is the process of verifying that a PIV Card is authentic (i.e., not a counterfeit card). Card validation mechanisms include:

o Visual inspection of the tamper-proofing and tamper-resistant features of the PIV Card, per Section 4.1.2 of FIPS 201

o Use of cryptographic challenge-response schemes with symmetric keys

o Use of asymmetric authentication schemes to validate private keys embedded within the PIV Card

• Credential Validation (CredV) — This is the process of verifying the various types of credentials (e.g., visual credentials, biometrics, and certificates) held by the PIV Card. Credential validation mechanisms include:

o Verification of certificates on the PIV Card

o Verification of signatures on the PIV biometrics and the CHUID

o Checking the expiration date

o Checking the revocation status of the credentials on the PIV Card

o Visual inspection of PIV Card visual elements 32

32 This has been deprecated per FIPS 201-3. (e.g., the photo, the printed name, rank).

• Cardholder Validation (HolderV) — This is the process of establishing that the PIV Card is in the possession of the individual to whom the card was issued. Classically, identity authentication is achieved using one or more of these factors: a) something you have, b) something you know, and c) something you are. The assurance of the authentication process increases with the number of factors used. In the case of the PIV Card, these three factors translate as follows: a) something you have — possession of a PIV Card, b) something you know — knowledge of the PIN, and c) something you are — the live fingerprint, facial image, or iris image samples provided by the cardholder. Thus, mechanisms for PIV cardholder validation include:

o Presentation of a PIV Card by the cardholder o Matching the PIN provided with the PIN on the PIV Card

o Matching the live fingerprint, facial image, or iris image samples provided by the cardholder with the biometric information embedded within the PIV Card

o Matching the visual characteristics of the cardholder with the photo on the PIV Card 33

33 Use of the photo on the PIV Card for visual authentication has been deprecated in FIPS 201-3 and may be removed from a future edition of the standard.