13 CAK BIO-A CPB
All changes in this version
Title changed
Before · SP 800-116
CAK BIO-A CPB
After · SP 800-116 Rev. 1
CAK BIO-A CPB
Control changed
Before · SP 800-116
14 CAK PKI BIO-A 15 CAK CPB → 16 CAK CPB BIO-A 17 CAK CPB PKI 18 CAK CPB CPB 19 BIO BIO-A PKI 20 BIO BIO-A CPB 21 BIO PKI → 22 BIO PKI BIO-A 23 BIO PKI PKI 24 BIO PKI CPB Access Point A (Controlled) Access Point B (Limited) Access Point C (Exclusion) 25 BIO CPB → 26 BIO CPB BIO-A 27 BIO CPB PKI 28 BIO CPB CPB 29 BIO-A → PKI 30 BIO-A → CPB 31 BIO-A BIO PKI 32 BIO-A BIO CPB 33 BIO-A PKI → 34 BIO-A PKI BIO-A 35 BIO-A PKI PKI 36 BIO-A PKI CPB 37 BIO-A CPB → 38 BIO-A CPB BIO-A 39 BIO-A CPB PKI 40 BIO-A CPB CPB 41 PKI → BIO-A 42 PKI → CPB 43 PKI BIO BIO-A 44 PKI BIO PKI 45 PKI BIO CPB 46 PKI BIO-A → 47 PKI BIO-A BIO-A 48 PKI BIO-A PKI 49 PKI BIO-A CPB 50 PKI PKI BIO-A 51 PKI PKI CPB 52 PKI CPB → 53 PKI CPB BIO-A 54 PKI CPB PKI 55 PKI CPB CPB 56 CPB → → 57 CPB BIO BIO-A 58 CPB BIO PKI 59 CPB BIO CPB 60 CPB BIO-A → 61 CPB BIO-A BIO-A 62 CPB BIO-A PKI 63 CPB BIO-A CPB 64 CPB PKI → 65 CPB PKI BIO-A 66 CPB PKI PKI 67 CPB PKI CPB 68 CPB CPB → 69 CPB CPB BIO-A 70 CPB CPB PKI 71 CPB CPB CPB The table below provides the effect of combination of PIV authentication mechanisms. The entry in the box corresponds to the result achieved after combination of two mechanisms represented in the row and column. For example, when PKI is combined with BIO the result is the same as CPB. The table below can be summarized as follows:
+ When CAK is combined with CV, the result is equivalent to CAK.
+ When BIO is combined with CV, the result is equivalent to BIO-A.
+ When PKI or CAK is combined with BIO or BIO-A, the result is equivalent to CPB.
+ When PKI is combined with CV or CAK, the result is equivalent to PKI.
+ When CPB is combined with any other PIV authentication mechanism, the result is equivalent to CPB.
CV CAK BIO BIO-A PKI CPB CV CAK CAK BIO BIO-A CPB BIO-A BIO-A CPB BIO-A PKI PKI PKI CPB CPB CPB CPB CPB CPB CPB CPB Appendix D—R eferences
[FIPS199] Federal Information Processing Standard 199, Standards for Security Categorization of Federal Information and Information System, February 2004. See < http://csrc.nist.gov/ >. [FIPS201] Federal Information Processing Standard 201-1, Change Notice 1, Personal Identity Verification (PIV) of Federal Employees and Contractors, March 2006. See < http://csrc.nist.gov/ >. [FISMA] Federal Information Security Management Act of 2002. See < http://csrc.nist.gov/policies/HR2458-final.pdf >. [FIPS 201 Evaluation Program] See < http://fips201ep.cio.gov/index.php >. [HSPD-12] Homeland Security Presidential Directive 12, Policy for a Common Identification Standard for Federal Employees and Contractors, August 27, 2004. [ISO/IEC7816] ISO/IEC 7816 (Parts 3, 4, 5, 6, 8, and 9), Information technology — Identification cards — Integrated circuit(s) cards with contacts. [ISO/IEC14443] ISO/IEC 14443 (Parts 1, 2, 3, and 4):2000 Identification cards - Contactless integrated circuit(s) cards – Proximity cards. [M-04-04] OMB Memorandum M-04-04, E-Authentication Guidance for Federal Agencies, December 2003. See < http://www.whitehouse.gov/omb/memoranda/fy04/m04-04.pdf >. [M-05-24] OMB Memorandum M-05-24, Implementation of Homeland Security Presidential Directive 12—Policy for a Common Identification Standard for Federal Employees and Contractors, August 2005. See < http://www.whitehouse.gov/omb/memoranda/fy2005/m05- 24.pdf >. [M-08-01] OMB Memorandum M-08-01, HSPD-12 Implementation Status, October 2007. See < http://www.whitehouse.gov/omb/memoranda/fy2008/m08-01.pdf >. [MINEXII] NIST Interagency Report 7477, Performance of Fingerprint Match-on-Card Algorithms, Phase II Report, February 2008. See < http://fingerprint.nist.gov/minexII/minex_report.pdf > [PHYSEC] Field Manual 3-19.30. Physical Security . Headquarters, Department of the Army, United States of America. 8 January 2001. [SBMOC] NIST Interagency Report 7452, Secure Biometric Match-on-Card Feasibility Report, November 2007. [SECTION508] 1998 Amendment to Section 508 of the Rehabilitation Act, 29 U.S.C. ‘ 794d, see < www.section508.gov >. [SKIMMER] How to Build a Low-Cost, Extended-Range RFID Skimmer, Ilan Kirschenbaum and Avishai Wool, Proceedings of the 15th Conference on USENIX Security Symposium - Volume 15. Vancouver, B.C., Canada. 8 May 2006. [SP800-73] NIST Special Publication 800-73 Revision 2, Interfaces for Personal Identity Verification, September 2008. [SP800-76] NIST Special Publication 800-76 Revision 1, Biometric Data Specification for Personal Identity Verification, January 2007. [SP800-78] NIST Special Publication 800-78 Revision 1, Cryptographic Algorithms and Key Sizes for Personal Identity Verification, August 2007. [SP800-79] NIST Special Publication 800-79 Revision 1, Guidelines for the Accreditation of Personal Identity Verification (PIV) Card Issuers (PCI’s), June 2008. [SP800-87] NIST Special Publication 800-87 Revision 1, Codes for the Identification of Federal and Federally-Assisted Organizations, April 2008. [TIG SCEPACS] PACS v2.2, Technical Implementation Guidance: Smart Card Enabled Physical Access Control Systems , Version 2.2, The Government Smart Card Interagency Advisory Board’s Physical Security Interagency Interoperability Working Group, July 27, 2004. (see http://www.smart.gov/information/TIG_SCEPACS_v2.2.pdf ) Appendix E—A bbreviations and Acronyms
ACL Access Control List ANSI American National Standards Institute BIO Biometrics BIO-A Biometrics with Attendant BIO (-A) a short-hand to represent both BIO and BIO-A authentication mechanism BIO-O Biometric Match-On-Card CAK Card Authentication Key CCA Clinger-Cohen Act CHUID Cardholder Unique Identifier COOP Continuity of Operations CPB Combination of CAK + BIO (-A) Authentication Mechanism CPIC Capital Planning and Investment Control CRL Certificate Revocation List CV a short-hand to represent CHUID + VIS authentication mechanism DHS Department of Homeland Security DoD Department of Defense DOJ Department of Justice DUNS Data Universal Numbering System ECDSA Elliptic Curve Digital Signature Algorithm FASC-N Federal Agency Smart Credential Number FIPS Federal Information Processing Standards FISMA Federal Information Security Management Act FSL Facility Security Level GSA General Services Administration GUID Global Unique Identifier HSPD Homeland Security Presidential Directive ID Identification IEC International Electrotechnical Commission IPv6 Internet Protocol version 6 ISO International Organization for Standardization IT Information Technology ITL Information Technology Laboratory LB Lower Bound NIST National Institute of Standards and Technology OCSP Online Certificate Status Protocol OID Object Identifier OMB Office of Management and Budget PACS Physical Access Control System PC Personal Computer PCI PIV Card Issuer PIMM PIV Implementation Maturity Model PIN Personal Identification Number PIV Personal Identity Verification RF Radio Frequency RSA Rivest, Shamir, Aldeman SBMOC Secure Biometric Match-On-Card SKI Symmetric Key Infrastructure SP Special Publication SSA Social Security Administration TCO Total Cost of Ownership UB Upper Bound UUID Universal Unique Identifier VIP Very Important Person VIS Visual Inspection
After · SP 800-116 Rev. 1
14 CAK PKI BIO-A 15 CAK CPB → 16 CAK CPB BIO-A 17 CAK CPB PKI 18 CAK CPB CPB 19 BIO BIO-A PKI 20 BIO BIO-A CPB 21 BIO PKI → 22 BIO PKI BIO-A 23 BIO PKI PKI 24 BIO PKI CPB Access Point A (Controlled) Access Point B (Limited) Access Point C (Exclusion) 25 BIO CPB → 26 BIO CPB BIO-A 27 BIO CPB PKI 28 BIO CPB CPB 29 BIO-A → PKI 30 BIO-A → CPB 31 BIO-A BIO PKI 32 BIO-A BIO CPB 33 BIO-A PKI → 34 BIO-A PKI BIO-A 35 BIO-A PKI PKI 36 BIO-A PKI CPB 37 BIO-A CPB → 38 BIO-A CPB BIO-A 39 BIO-A CPB PKI 40 BIO-A CPB CPB 41 PKI → BIO-A 42 PKI → CPB 43 PKI BIO BIO-A 44 PKI BIO PKI 45 PKI BIO CPB 46 PKI BIO-A → 47 PKI BIO-A BIO-A 48 PKI BIO-A PKI 49 PKI BIO-A CPB 50 PKI PKI BIO-A 51 PKI PKI CPB 52 PKI CPB → 53 PKI CPB BIO-A 54 PKI CPB PKI 55 PKI CPB CPB 56 CPB → → 57 CPB BIO BIO-A 58 CPB BIO PKI 59 CPB BIO CPB 60 CPB BIO-A → 61 CPB BIO-A BIO-A 62 CPB BIO-A PKI 63 CPB BIO-A CPB 64 CPB PKI → 65 CPB PKI BIO-A 66 CPB PKI PKI 67 CPB PKI CPB 68 CPB CPB → 69 CPB CPB BIO-A 70 CPB CPB PKI 71 CPB CPB CPB The table below provides the effect of combination of PIV authentication mechanisms. The entry in the box corresponds to the result achieved after combination of two mechanisms represented in the row and column. For example, when PKI is combined with BIO the result is the same as CPB. The table below can be summarized as follows:
+ When CAK is combined with CV, the result is equivalent to CAK.
+ When BIO is combined with CV, the result is equivalent to BIO-A.
+ When PKI or CAK is combined with BIO or BIO-A, the result is equivalent to CPB.
+ When PKI is combined with CV or CAK, the result is equivalent to PKI.
+ When CPB is combined with any other PIV authentication mechanism, the result is equivalent to CPB.
CV CAK BIO BIO-A PKI CPB CV CAK CAK BIO BIO-A CPB BIO-A BIO-A CPB BIO-A PKI PKI PKI CPB CPB CPB CPB CPB CPB CPB CPB Appendix D—R eferences
[FIPS199] Federal Information Processing Standard 199, Standards for Security Categorization of Federal Information and Information System, February 2004. See < http://csrc.nist.gov/ >. [FIPS201] Federal Information Processing Standard 201-1, Change Notice 1, Personal Identity Verification (PIV) of Federal Employees and Contractors, March 2006. See < http://csrc.nist.gov/ >. [FISMA] Federal Information Security Management Act of 2002. See < http://csrc.nist.gov/policies/HR2458-final.pdf >. [FIPS 201 Evaluation Program] See < http://fips201ep.cio.gov/index.php >. [HSPD-12] Homeland Security Presidential Directive 12, Policy for a Common Identification Standard for Federal Employees and Contractors, August 27, 2004. [ISO/IEC7816] ISO/IEC 7816 (Parts 3, 4, 5, 6, 8, and 9), Information technology — Identification cards — Integrated circuit(s) cards with contacts. [ISO/IEC14443] ISO/IEC 14443 (Parts 1, 2, 3, and 4):2000 Identification cards - Contactless integrated circuit(s) cards – Proximity cards. [M-04-04] OMB Memorandum M-04-04, E-Authentication Guidance for Federal Agencies, December 2003. See < http://www.whitehouse.gov/omb/memoranda/fy04/m04-04.pdf >. [M-05-24] OMB Memorandum M-05-24, Implementation of Homeland Security Presidential Directive 12—Policy for a Common Identification Standard for Federal Employees and Contractors, August 2005. See < http://www.whitehouse.gov/omb/memoranda/fy2005/m05- 24.pdf >. [M-08-01] OMB Memorandum M-08-01, HSPD-12 Implementation Status, October 2007. See < http://www.whitehouse.gov/omb/memoranda/fy2008/m08-01.pdf >. [MINEXII] NIST Interagency Report 7477, Performance of Fingerprint Match-on-Card Algorithms, Phase II Report, February 2008. See < http://fingerprint.nist.gov/minexII/minex_report.pdf > [PHYSEC] Field Manual 3-19.30. Physical Security . Headquarters, Department of the Army, United States of America. 8 January 2001. [SBMOC] NIST Interagency Report 7452, Secure Biometric Match-on-Card Feasibility Report, November 2007. [SECTION508] 1998 Amendment to Section 508 of the Rehabilitation Act, 29 U.S.C. ‘ 794d, see < www.section508.gov >. [SKIMMER] How to Build a Low-Cost, Extended-Range RFID Skimmer, Ilan Kirschenbaum and Avishai Wool, Proceedings of the 15th Conference on USENIX Security Symposium - Volume 15. Vancouver, B.C., Canada. 8 May 2006. [SP800-73] NIST Special Publication 800-73 Revision 2, Interfaces for Personal Identity Verification, September 2008. [SP800-76] NIST Special Publication 800-76 Revision 1, Biometric Data Specification for Personal Identity Verification, January 2007. [SP800-78] NIST Special Publication 800-78 Revision 1, Cryptographic Algorithms and Key Sizes for Personal Identity Verification, August 2007. [SP800-79] NIST Special Publication 800-79 Revision 1, Guidelines for the Accreditation of Personal Identity Verification (PIV) Card Issuers (PCI’s), June 2008. [SP800-87] NIST Special Publication 800-87 Revision 1, Codes for the Identification of Federal and Federally-Assisted Organizations, April 2008. [TIG SCEPACS] PACS v2.2, Technical Implementation Guidance: Smart Card Enabled Physical Access Control Systems , Version 2.2, The Government Smart Card Interagency Advisory Board’s Physical Security Interagency Interoperability Working Group, July 27, 2004. (see http://www.smart.gov/information/TIG_SCEPACS_v2.2.pdf ) Appendix E—A bbreviations and Acronyms
ACL Access Control List ANSI American National Standards Institute BIO Biometrics BIO-A Biometrics with Attendant BIO (-A) a short-hand to represent both BIO and BIO-A authentication mechanism BIO-O Biometric Match-On-Card CAK Card Authentication Key CCA Clinger-Cohen Act CHUID Cardholder Unique Identifier COOP Continuity of Operations CPB Combination of CAK + BIO (-A) Authentication Mechanism CPIC Capital Planning and Investment Control CRL Certificate Revocation List CV a short-hand to represent CHUID + VIS authentication mechanism DHS Department of Homeland Security DoD Department of Defense DOJ Department of Justice DUNS Data Universal Numbering System ECDSA Elliptic Curve Digital Signature Algorithm FASC-N Federal Agency Smart Credential Number FIPS Federal Information Processing Standards FISMA Federal Information Security Management Act FSL Facility Security Level GSA General Services Administration GUID Global Unique Identifier HSPD Homeland Security Presidential Directive ID Identification IEC International Electrotechnical Commission IPv6 Internet Protocol version 6 ISO International Organization for Standardization IT Information Technology ITL Information Technology Laboratory LB Lower Bound NIST National Institute of Standards and Technology OCSP Online Certificate Status Protocol OID Object Identifier OMB Office of Management and Budget PACS Physical Access Control System PC Personal Computer PCI PIV Card Issuer PIMM PIV Implementation Maturity Model PIN Personal Identification Number PIV Personal Identity Verification RF Radio Frequency RSA Rivest, Shamir, Aldeman SBMOC Secure Biometric Match-On-Card SKI Symmetric Key Infrastructure SP Special Publication SSA Social Security Administration TCO Total Cost of Ownership UB Upper Bound UUID Universal Unique Identifier VIP Very Important Person VIS Visual Inspection