BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4.1 Identifier Collisions

NIST PIV and digital identity SP 800-116 Rev. 1 against SP 800-116
All changes in this version
removed 4 Threat Environment part of 4

Title changed

Before · SP 800-116

Identifier Collisions

After · SP 800-116 Rev. 1

Identifier Collisions

Control changed

Before · SP 800-116

By definition, a unique identifier for a PIV Card is a data artifact with a fixed value unique to one particular PIV Card. PCIs create unique identifiers during the card issuance process. The presence of a unique identifier allows a PIV Card to be uniquely identified by a relying system, such as a PACS. If the unique identifier is ever truncated, compressed, hashed, or modified, information could be lost. If information is lost from the unique identifier before it is compared against Access Control List (ACL) entries, multiple cards may generate the same reduced identifier. This is called an identifier collision . A collision means that multiple PIV Cards will appear to belong to the same person, and will all be granted the same access privileges. The PIV Card mitigates the risk of collision by defining a unique FASC-N Identifier for the purposes of physical access control decisions. To prevent collisions, all access control decisions should be made by comparing the 14 decimal digit FASC-N Identifier, and optionally the values of additional FASC-N fields, against the ACL entries. See Appendix B for details and examples.

After · SP 800-116 Rev. 1

By definition, a unique identifier for a PIV Card is a data artifact with a fixed value unique to one particular PIV Card. PCIs create unique identifiers during the card issuance process. The presence of a unique identifier allows a PIV Card to be uniquely identified by a relying system, such as a PACS. If the unique identifier is ever truncated, compressed, hashed, or modified, information could be lost. If information is lost from the unique identifier before it is compared against Access Control List (ACL) entries, multiple cards may generate the same reduced identifier. This is called an identifier collision . A collision means that multiple PIV Cards will appear to belong to the same person, and will all be granted the same access privileges. The PIV Card mitigates the risk of collision by defining a unique FASC-N Identifier for the purposes of physical access control decisions. To prevent collisions, all access control decisions should be made by comparing the 14 decimal digit FASC-N Identifier, and optionally the values of additional FASC-N fields, against the ACL entries. See Appendix B for details and examples.