BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4.8 Electronic Counterfeiting

NIST PIV and digital identity SP 800-116 Rev. 1 against SP 800-116
All changes in this version
removed 4 Threat Environment part of 4

Title changed

Before · SP 800-116

Electronic Counterfeiting

After · SP 800-116 Rev. 1

Electronic Counterfeiting

Control changed

Before · SP 800-116

An attacker could construct a battery-powered, microprocessor-based device that emulates a PIV Card for purposes of the CHUID authentication mechanism. The attacker could program the microprocessor to generate and test CHUIDs repetitively against a PACS reader, changing the FASC-N credential identifier on each trial. This approach would not require prior capture of a valid CHUID, but since the counterfeit CHUIDs would not possess valid issuer signatures, a successful exploit depends on the absence of signature verification in the CHUID processing done by the reader. The PIV Card mitigates the risk of electronic counterfeiting by storing a CHUID with a digital signature field. Electronic counterfeiting will be extremely difficult if CHUID signature verification is done, although signature verification is not required by FIPS 201. Moreover, since many CHUIDs may be presented while an attacker probes for a valid CHUID, the PACS should employ methods to detect, alarm, and block repeated unsuccessful CHUID presentations.

After · SP 800-116 Rev. 1

An attacker could construct a battery-powered, microprocessor-based device that emulates a PIV Card for purposes of the CHUID authentication mechanism. The attacker could program the microprocessor to generate and test CHUIDs repetitively against a PACS reader, changing the FASC-N credential identifier on each trial. This approach would not require prior capture of a valid CHUID, but since the counterfeit CHUIDs would not possess valid issuer signatures, a successful exploit depends on the absence of signature verification in the CHUID processing done by the reader. The PIV Card mitigates the risk of electronic counterfeiting by storing a CHUID with a digital signature field. Electronic counterfeiting will be extremely difficult if CHUID signature verification is done, although signature verification is not required by FIPS 201. Moreover, since many CHUIDs may be presented while an attacker probes for a valid CHUID, the PACS should employ methods to detect, alarm, and block repeated unsuccessful CHUID presentations.