BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

9.3 The CBEFF Signature Block

NIST PIV and digital identity SP 800-76-2 against SP 800-76-1
All changes in this version
added 9 Common header for PIV biometric data part of 9

Title changed

Before · SP 800-76-1

After · SP 800-76-2

The CBEFF Signature Block

Control changed

Before · SP 800-76-1

After · SP 800-76-2

The CBEFF_SIGNATURE_BLOCK contains the digital signature of the biometric data and thus facilitates the verification of the integrity of the biometric data. The process of generating a CBEFF_SIGNATURE_BLOCK is described as follows. The CBEFF_SIGNATURE_BLOCK shall be encoded as a CMS external digital signature as defined in [RFC5652]. The digital signature shall be computed over the entire CBEFF structure except the CBEFF_SIGNATURE_BLOCK itself (which means that it shall include the CBEFF_HEADER and the biometric records). The algorithm and key size specifications for the digital signature shall be implemented according to [800-78]. The CMS encoding of the CBEFF_SIGNATURE_BLOCK is as a SignedData type, and shall include the following information: ― The message shall include a version field specifying version v3 ― The digestAlgorithms field shall be as specified in [SP 800-78] ― The encapcontentInfo shall: − Specify an eContentType of id-PIV-biometricObject − Omit the eContent field ― If the signature on the biometric was generated with the same key as the signature on the CHUID, the certificates field shall be omitted ― If the signature on the biometric was generated with a different key than the signature on the CHUID, the certificates field shall include only a single certificate, which can be used to verify the signature in the SignerInfo field. The certificate shall be an X.509 digital signature certificate that has been issued in accordance with Section 4.2.1 of FIPS 201-2 ― The crls field shall be omitted ― signerInfos shall be present and include only a single SignerInfo ― The SignerInfo shall:

22 The eight year duration comes from a study of the effect of face ageing on recognition accuracy [FACEPERF]. Because face- based manual verification is common, this duration is adopted as a default. Iris seems to have longer-term stability [IREX-VI]. There are no published studies of long term fingerprint stability. − Use the issuerAndSerialNumber choice for SignerIdentifier − Specify a digestAlgorithm in accordance with [800-78] − Include, at a minimum, the following signed attributes: − A MessageDigest attribute containing the hash of the concatenated CBEFF_HEADER + Biometric Record − A pivFASC-N attribute containing the FASC-N of the PIV Card (to link the biometric data and PIV Card) − An entryUUID attribute [RFC4530] containing the 16-byte representation of the UUID value that appears in the GUID data element of the PIV Card's CHUID data element. − A pivSigner-DN attribute containing the subject name that appears in the PKI certificate for the entity that signed the biometric data − Include the digital signature.