5.6 Deployed Non-PIV PACS Cards and PIV Card Differences
All changes in this version
Title changed
Before · SP 800-116
Deployed Non-PIV PACS Cards and PIV Card Differences
After · SP 800-116 Rev. 1
Deployed Non-PIV PACS Cards and PIV Card Differences
Control changed
Before · SP 800-116
The list below compares the basic differences in the technology offerings between the deployed Non-PIV PACS cards and the PIV Card. + Some deployed PACS use site-specific card technology, with the result that a card cannot be used at sites with incompatible PACS. For example, a magnetic stripe card cannot be used at a proximity card site, and a magnetic stripe card from one vendor cannot be used at a site with magnetic stripe equipment from another vendor.
+ Deployed PACS readers can read an identifying number from a card, but in most cases they do not perform a cryptographic challenge/response exchange. Many Non-PIV PACS cards can be copied easily.
+ When two sites use compatible card technology, the risk of duplicate site identifiers for cards is always present. Without government-wide coordination of identifiers, the same identifier could be used on multiple cards at different sites.
+ To achieve government-wide coordination of cardholder identifiers, enough identifiers must be available for all government-issued credentials. Many deployed PACS have a limit on the number of sites (256) and the number of users per site (65,536) that is too small for government-wide use and can lead to the same identifiers being issued to different individuals.
+ Deployed PACS control expiration of credentials through an expiration date stored in a site database, whereas with PIV Cards expiration dates can be obtained from the cards themselves. There is no simple way to synchronize the expiration of credentials for a Federal employee or contractor with access to multiple sites unless all sites are tied into a centralized database for the deployed PACS.
+ Use of PINs, public key infrastructure, and biometrics with deployed PACS is managed on a site-specific basis at the PACS server. Individuals must enroll PINs, keys, or biometrics at each site. Since PINs, keys, and biometrics are often stored in a site database, they may not be technically interoperable with the requirements of other sites.
FIPS 201-conformant PACS eliminate or substantially reduce each of these limitations, relative to deployed PACS installations.
After · SP 800-116 Rev. 1
The list below compares the basic differences in the technology offerings between the deployed Non-PIV PACS cards and the PIV Card. + Some deployed PACS use site-specific card technology, with the result that a card cannot be used at sites with incompatible PACS. For example, a magnetic stripe card cannot be used at a proximity card site, and a magnetic stripe card from one vendor cannot be used at a site with magnetic stripe equipment from another vendor.
+ Deployed PACS readers can read an identifying number from a card, but in most cases they do not perform a cryptographic challenge/response exchange. Many Non-PIV PACS cards can be copied easily.
+ When two sites use compatible card technology, the risk of duplicate site identifiers for cards is always present. Without government-wide coordination of identifiers, the same identifier could be used on multiple cards at different sites.
+ To achieve government-wide coordination of cardholder identifiers, enough identifiers must be available for all government-issued credentials. Many deployed PACS have a limit on the number of sites (256) and the number of users per site (65,536) that is too small for government-wide use and can lead to the same identifiers being issued to different individuals.
+ Deployed PACS control expiration of credentials through an expiration date stored in a site database, whereas with PIV Cards expiration dates can be obtained from the cards themselves. There is no simple way to synchronize the expiration of credentials for a Federal employee or contractor with access to multiple sites unless all sites are tied into a centralized database for the deployed PACS.
+ Use of PINs, public key infrastructure, and biometrics with deployed PACS is managed on a site-specific basis at the PACS server. Individuals must enroll PINs, keys, or biometrics at each site. Since PINs, keys, and biometrics are often stored in a site database, they may not be technically interoperable with the requirements of other sites.
FIPS 201-conformant PACS eliminate or substantially reduce each of these limitations, relative to deployed PACS installations.