12 References

Before · SP 800-76-1

After · SP 800-76-2

References

Before · SP 800-76-1

After · SP 800-76-2

800-73 NIST Special Publication 800-73-4, Interfaces for Personal Identity Verification. There are currently three parts: Pt. 1- PIV Card Application Namespace, Data Model & Representation Pt. 2- PIV Card Application Card Command Interface Pt. 3- PIV Client Application Programming Interface http://csrc.nist.gov/publications/PubsSPs.html 800-78 NIST Special Publication 800-78-4, Cryptographic Algorithms and Key Sizes for Personal Identity Verification http://csrc.nist.gov/publications/PubsSPs.html 800-85 NIST Special Publication 800-85 A-2, PIV Card Application and Middleware Interface Test Guidelines (SP800-73-3 Compliance), July 2010

NIST Special Publication 800-85 B, PIV Data Model Test Guidelines, Jul 2006 http://csrc.nist.gov/publications/PubsSPs.html AN2011 ANSI/NIST-ITL 1-2011 – Data Format for the Interchange of Fingerprint, Facial & Other Biometric Information, NIST Special Publication 500-290, 2011. This supersedes SP 500-245. http://www.nist.gov/itl/iad/ig/ansi_standard.cfm APP/F See EBTS entry below. BAZIN A. Bazin and T. Mansfield. An investigation of minutiae interoperability. In Proc. Fifth IEEE Workshop on Automated Identification Advanced Technologies, June 2007. AUTO-ID 2007, Alghero Italy. BIAS Biometric Identity Assurance Services (BIAS) SOAP Profile, Version 1.0, OASIS Standard, 24 May 2012, https://www.oasis-open.org/standards#biasv1.0 NOTE: This normatively cites the INCITS 442:2010 standard for higher level requirements and architecture, biometric operations, and data element for biometrics. INCITS 442 will be succeeded by ISO/IEC 30108 now under development. A reference implementation is available here: http://nist.gov/itl/iad/ig/upload/BIAS_20110608.zip BIOAPI ISO/IEC 19784-1:2006[2007] BioAPI – Biometric Application Programming Interface – Part 1: BioAPI Specification http://webstore.ansi.org/ BIOAPI-ARCH ISO/IEC 19784-2:2007[2008] Biometric Application Programming Interface (BioAPI) – Part 2: Biometric Archive Function Provider Interface http://webstore.ansi.org/ BIOAPI-GUI ISO/IEC 19784- 1:2006/AM1 -2007 [2008 ], Information technology - BioAPI - Biometric Application Programming Interface - Part 1: BioAPI Specification - Amendment 1: BioGUI specification BIOAPI-FF ISO/IEC 19784-1, Amd. 2 19784-1:2006, Amd. 2:2009 [2009] - - Information technology - Biometric application programming interface – Part 1: BioAPI specification – Amendment 2: Framework-free BioAPI http://webstore.ansi.org/ BIOAPI-SEC ISO/IEC 19784-1, Amd. 3 19784-1:2006, Amd. 3:2010 - Information technology -Biometric application programming interface – Part 1: BioAPI specification – Amendment 3: Support for interchange of certificates and security assertions, and other security aspects http://webstore.ansi.org/ BIOAPI-SENS BIOAPI-SFPI: ISO/IEC 19784-4:2011 Biometric Application Programming Interface (BioAPI) – Part 4: Biometric Sensor Function Provider Interface http://webstore.ansi.org/ BIOAPI-US ANSI INCITS 358-2002 (R2007) Information technology - BioAPI Specification (Version 1.1) and its amendment ANSI INCITS 358-2002/AM1-2007 - Amendment 1: Support for Biometric Fusion. BIOCTS F. Podio, D. Yaga, and C. J. McGinnis, NIST/ITL CSD Conformance Test Architectures (CTA) and Test Suites (CTS) for Biometric Data Interchange Formats http://www.nist.gov/itl/csd/biometrics/biocta_download.cfm BSI-FACE Markus Nuppeney, Marco Breitenstein and Matthias Niesing, EasyPASS - Evaluation of face recognition performance in an operational automated border control system. BSI and Secunet, DE. http://biometrics.nist.gov/cs_links/ibpc2010/pdfs/Nuppeney_Marcus_IBPC2010_EasyPASS_Talk_Website.pdf This presentation is accompanied by a supporting paper. http://biometrics.nist.gov/cs_links/ibpc2010/pdfs/Nuppeney2_Marcus_IBPC2010_EasyPASS_Paper_final.pdf CARD-BIO ISO/IEC 7816-11:2004 Identification cards -- Integrated circuit cards -- Part 11: Personal verification through biometric methods http://webstore.iec.ch/preview/info_isoiec7816-11%7Bed1.0%7Den.pdf CARD-CMD ISO/IEC 7816-4:2005 Identification cards -- Integrated circuit cards -- Part 4: Organization, security and commands for interchange http://webstore.iec.ch/preview/info_isoiec7816-4%7Bed2.0%7Den.pdf CARD-MIN ISO/IEC 19794-2:2011 Information technology -- Biometric data interchange formats -- Part 2: Finger minutiae data. This standard is not INCITS 378 nor ISO/IEC 19794-2:2005. CBEFF INCITS 398-2005, American National Standard for Information Technology - Common Biometric Exchange Formats Framework (CBEFF) http://webstore.ansi.org EBTS AFIS-DOC-01078-9.1 CJIS-RS-0010 (V9. 1 ) – Electronic Biometric Transmission Specification, Criminal Justice Information Services, Federal Bureau of Investigation, Department of Justice, May 25, 2010. Linked from here https://fbibiospecs.fbi.gov/file-repository/ebts/ebts_v9-1_final.pdf Implementers should consul t https://fbibiospecs.fbi.gov/ or request the full EBTS documentation from the FBI. Cited in this document are: Appendix F - FBI/CJIS IMAGE QUALITY SPECIFICATIONS Appendix N - DESCRIPTORS AND FIELD EDIT SPECIFICATIONS FOR TYPE-14 LOGICAL RECORDS Appendix C - DESCRIPTORS AND FIELD EDIT SPECIFICATIONS FOR TYPE-2 LOGICAL RECORDS

Other USG agencies have their own EBTS variants. These are not relevant to PIV. FACEPERF P. Grother, G.W. Quinn, and P. J. Phillips. Evaluation of 2D still-image face recognition algorithms. NIST Interagency Report 7709, National Institute of Standards and Technology, August 2010. http://face.nist.gov/mbe .

See also the FRVT tests published here: http://www.nist.gov/itl/iad/ig/frvt-home.cfm FACESTD INCITS 385-2004, American National Standard for Information Technology - Face Recognition Format for Data Interchange http://webstore.ansi.org FINGSTD INCITS 381-2004, American National Standard for Information Technology - Finger Image-Based Data Interchange Format http://webstore.ansi.org FIPS FIPS 201-2, Personal Identity Verification, National Institute of Standards and Technology, 2013. As of the publication of this document (i.e., SP 800-76-2), FIPS 201-1 remains the formal published standard. FIPS 201-2 is expected to be released in 2013. http://csrc.nist.gov/publications/PubsFIPS.html HSPD-12 The text of HOMELAND SECURITY PRESIDENTIAL DIRECTIVE/HSPD-12 of August 27, 2004 appears in an attachment to OMB's August 5, 2005 Memorandum M-05-24 Implementation of HSPD 12 - Policy for a Common Identification Standard for Federal Employees and Contractors linked from http://csrc.nist.gov/drivers/documents/Presidential-Directive-Hspd-12.html and http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2005/m05-24.pdf ICAO ICAO Doc 9303, Machine Readable Travel Documents: Part 1- Machine Readable Passports. Volume 2 - Specifications for Electronically Enabled Passports with Biometric Identification Capability http://www.icao.int/publications/pages/publication.aspx?docnum=9303 ICS Methods for Testing and Specification (MTS); Implementation Conformance Statement (ICS) Proforma style guide. EG 201 058 V1.2.3 (1998-04) IDQT D. Potter, P. Grother, E. Tabassi, Imaging Criteria and Test Methods for Qualification of Iris Cameras , NIST Special Publication 500-XXX. This specification is under development (July 2013) – Latest editions of the document will be published here: http://www.nist.gov/itl/iad/ig/idqt.cfm This specification has been developed by DHS Science & Technology Directorate (S&T) and NIST. ICNIRP-LED ICNIRP Statement on Light-Emitting Diodes, Implications for Hazard Assessment http://www.icnirp.de/documents/led.pdf ICNIRP-BB ICNIRP Statement on Light-Emitting Diodes, Guidelines on Limits of Exposure to Broadband Incoherent Optical Radiation, http://www.icnirp.de/documents/broadband.pdf IECLAMP IEC 62471 Ed. 1.0 b:2006 Photobiological safety of lamps and lamp systems, Edition: 1.0 International Electrotechnical Commission / 26-Jul-2006 / 89 pages This document derives some of its content from: Threshold Limit Values for Chemical Substances and Physical Agents & Biological Exposure Indices, 2007, ACGIH Worldwide www.acgih.org (American Conference of Governmental Industrial Hygienists). ANSI/IESNA RP-27.1-05 Recommended Practice for Photobiological Safety for Lamps and Lamp Systems, http://webstore.ansi.org/RecordDetail.aspx?sku=ANSI%2FIESNA+RP-27.1-05 IREX-I P. Grother, E. Tabassi, G. W. Quinn, and W. Salamon. IREX-I: Performance of Iris Recognition Algorithms on Standard Images. Technical Report NIST Interagency Report 7629, http://iris.nist.gov/irex/, October 2009. IREX-II E. Tabassi, P. Grother, and W. Salamon. IREX-II: Iris Quality Calibration and Evaluation (IQCE), Performance of Iris Image Quality Assessment Algorithms, NIST Interagency Report 7820, September 30, 2011 IREX-III P. Grother, G.W. Quinn, J. Matey, M. Ngan, W. Salamon, G. Fiumara, C. Watson, Iris Exchange III, Performance of Iris Identification Algorithms, NIST Interagency Report 7836, April 9, 2012. http://iris.nist.gov/irex IREX-IV IREX IV Part 1: Evaluation of Iris Identification Algorithms, George W. Quinn and Patrick Grother, NIST Interagency Report XXX. July 2013. http://iris.nist.gov/irex IREX IV Part 2: Compression profiles for iris image recognition, George W. Quinn, Patrick Grother, Mei Ngan, and Nick Rymer, NIST Interagency Report XXX, August 2013 http://iris.nist.gov/irex IREX-V IREX V - Best Practices for Iris Image Collection, James Matey, Elham Tabassi, George W. Quinn, Patrick Grother NIST Interagency Report XXX September 2013 http://iris.nist.gov/irex IREX-VI IREX VI - Temporal Stability of Iris Recognition Accuracy, NIST Interagency Report XXXX P. Grother J. R. Matey E. Tabassi G. W. Quinn and M. Chumakov http://iris.nist.gov/irex IRISSTD ISO/IEC 19794-6:2011 Information technology -- Biometric data interchange formats -- Part 6: Iris image data This document revises and replaces the 2005 iris standard. Published September 29, 2011.

This standard is being amended, with publication expected 2014. The amendment does two things: It establishes conformance tests for 19794-6 iris records and, in support of that, clarifies the Image Type 7 appearance requirements. In particular it emphasizes that the sclera shall be masked. The title of the amendment is: Information Technology — Biometric data interchange formats — Part 6: Iris image format - Amendment 1: Conformance testing methodologies. IRISQUAL ISO/IEC 29794-6:2014 (est. date) Information technology -- Biometric sample quality -- Part 6: Iris image quality This standard is currently nearing completion, at the Draft IS level. MANSFIELD T. Mansfield et al. Research report on minutiae interoperability tests. Technical report, Minutiae Template Interoperability Testing, 2007. http://www.mtitproject.com/DeliverableD62.pdf MINEX04 P. Grother et al., Minutiae Interoperability Exchange Test, Evaluation Report: NISTIR 7296. The report is archived here: http://www.nist.gov/customcf/get_pdf.cfm?pub_id=150619 The ongoing assessment of minutiae algorithms is housed here: http://www.nist.gov/itl/iad/ig/ominex.cfm MINEX II P. Grother, W. Salamon, C. Watson, M. Indovina, and P. Flanagan, MINEX II Performance of Fingerprint Match-on- Card Algorithms Phase II / III / IV Report NIST Interagency Report 7477 (Revision I+II) http://www.nist.gov/itl/iad/ig/minexii.cfm MINUSTD INCITS 378-2004, American National Standard for Information Technology - Finger Minutiae Format for Data Interchange http://webstore.ansi.org NFACS IAFIS-DOC-07054-1.0, Criminal Justice Information Services, Federal Bureau of Investigation, Department of Justice, April 2004. NEXUS Canada Border Services Agency. Nexus. Expedited border clearance for pre-approved travelers into Canada and United States. 2003–2013. http://www.cbsa-asfc.gc.ca/prog/nexus/menu-eng.html. NFIQ E. Tabassi and C. Wilson - NISTIR 7151 - Fingerprint Image Quality, NIST Interagency Report, August 2004 http://www.nist.gov/itl/iad/ig/bio_quality.cfm NFIQ SUMMARY E. Tabassi and P. Grother - NISTIR 7422 Quality Summarization - Recommendations on Biometric Quality Summarization across the Application Domain PERFSCEN ISO/IEC 19795-2:2007 Information technology -- Biometric performance testing and reporting -- Part 2: Testing methodologies for technology and scenario evaluation http://webstore.ansi.org PERFSWAP ISO/IEC 19795-4:2008 Information Technology -- Biometric Performance Testing and Reporting -- Part 4: Interoperability Performance Testing http://webstore.ansi.org REVFACE A. Adler, Sample images can be independently restored from face recognition templates , Proc. Canadian Conference Electronic and Computer Engineering, 1163–1166 (2003) REVFING Jianjiang Feng, A. K. Jain, A.K. Fingerprint Reconstruction: From Minutiae to Phase, IEEE Transactions on Pattern Analysis and Machine Intelligence, Volume: 33 , Issue: 2, pp. 209 – 223. Feb. 2011

R. Cappelli, A. Lumini, D Maio, Evaluating Minutiae Template Vulnerability to Masquerade Attack IEEE Workshop on Automatic Identification Advanced Technologies, 7-8 June 2007 pp. 174 - 179 REVIRIS S. Venugopalan, M. Savvides, How to Generate Spoofed Irises From an Iris Code Template, IEEE Transactions on Information Forensics and Security, Volume: 6 , Issue: 2, pp. 385 – 395, June 2011 , RF5652 Cryptographic Message Syntax (CMS), Internet Engineering Task Force, September 2009, http://tools.ietf.org/html/rfc5652 SBMOC D. Cooper, H. Dang, P. Lee, W. MacGregor, and K. Mehta. Secure Biometric Match-on-Card Feasibility Report. Technical report, National Institute of Standards and Technology, November 2007. Published as NIST Interagency Report 7452. SINGFING See "Personal Identity Verification (PIV): Image Quality Specifications For Single Finger Capture Devices". https://fbibiospecs.fbi.gov/file-repository/specifications/pivspec.pdf 10 July 2006 UKIRIS Home Office UK Border Agency. UK IRIS. Automated registered passenger entry to the UK, 2005–2013. http://www.ukba.homeoffice.gov.uk/customs-travel/EnteringtheUK/usingiris. VOCABSTD Part 37 of the ISO/IEC 2382 Vocabulary Standard covering Biometrics was published in December 2012. http://www.iso.org/iso/home/store/catalogue_tc/catalogue_detail.htm?csnumber=55194 WSBD Ross J. Micheals, Kevin Mangold, Matt Aronoff, Kayee Kwong, and Karen Marshall, Specification for WS- Biometric Devices (WS-BD), NIST Special Publication 500-288, Version 1, 3/27/2012, http://www.nist.gov/itl/iad/ig/bws.cfm WSQ31 WSQ Gray-Scale Fingerprint Image Compression Specification, IAFIS-IC-0110(V3), October 4, 2010. https://fbibiospecs.fbi.gov/file-repository/specifications/wsq_gray-scale_specification_version_3_1_final.pdf Annex A. Fingerprint minutiae performance testing and certification procedures

A.1 Scope This Annex gives normative specifications for tests used to certify implementations that generate and/or match the mandatory minutia-based biometric elements specified by [FIPS], i.e., the two fingerprint minutiae templates placed on the PIV Card for either off-card comparison, or on-card. That is, this annex regulates the test itself, and the testing laboratory, not the products under test, and the data specifications here should not be confused with those given in Section 2.3 for fielded PIV implementations.

A.2 PIV authentication The fingerprint templates conform to [MINUSTD] as profiled in Section 3.2.2 . The use cases given in [800-73, Appendix C] detail how the templates and the PIV Card are used for interoperable authentication. Authentication may involve one or both of the fingers whose data is encoded in a PIV Card record. These will be compared with newly acquired (i.e., live) fingerprint images of either or both of the primary and secondary fingers. The inclusion of the finger position in the [MINUSTD] header allows the system to prompt the user for one or more specific fingers. Authentication performance is quantified in terms of both the false reject rate (FRR) and the false accept rate (FAR). In PIV, FRR is the proportion of legitimate cardholders incorrectly denied access; the latter would be the proportion of impostors incorrectly allowed access. The error rates depend on a number of factors including: the environment, the number of attempts (i.e., finger placements on the sensor), the sensor itself, the quality of the PIV Card templates' parent images, the number of fingerprints invoked, and the familiarity of users with the process. The use of two fingers in all authentication transactions offers substantially improved performance over single-finger authentication. The intent of the [FIPS] specification of an interoperable biometric is to support cross-vendor and cross-agency authentication of PIV Cards. This plural aspect introduces a source of accuracy variation [MINEX04] because template generators report minutia (locations) idiosyncratically.

A.3 Test overview This Section specifies procedures for the certification of generators and matchers of [MINUSTD] templates. Interoperability testing requires exchange of templates between products, which shall therefore be tested as a group. Accordingly, the testing laboratory shall conduct a first round of testing to establish a primary group of interoperable template generators and matchers. Certification shall be determined quantitatively at the conclusion of the test. Thereafter certification requires interoperability with previously certified products. The certification procedure shall be conducted offline. This allows products to be certified using very large biometric data sets, in repeatable, deterministic and therefore auditable evaluations. Offline evaluation is needed to measure performance when template data is exchanged between all pairs of interoperable products. Large populations shall be used to quantify the effect of sample variance on performance. A template generator is logically a converter of images to templates. A template matcher logically compares one or two templates with one or two templates to produce a similarity score. Template generators and template matchers shall be certified separately. This aspect is instituted because: 1. Template generation is procedurally, algorithmically and physically distinct from matching. 2. Template generation is required by [FIPS], but matching is not.