6.3 Benefits of the Complete Implementation
All changes in this version
Title changed
Before · SP 800-116
Benefits of the Complete Implementation
After · SP 800-116 Rev. 1
Benefits of the Complete Implementation
Control changed
Before · SP 800-116
The complete PIV System will be an identity infrastructure that is attractive to Federal agencies, application owners, and contractors because of these benefits: + Enhanced trust. PIV Cards will be issued in accordance with a standardized, audited process, which will exceed the best practice level for low- and moderate-impact applications today, and equal best practice reached for high-impact applications.
+ Resistance to misuse and cloning. Electronic validation of the PIV Card, using digital signatures, makes it tamper-resistant. Cryptographic challenge/response protocols make the PIV Card counterfeit-resistant. Biometric authentication makes the PIV Card non- transferable.
+ Status and revocation. PIV Card Issuer process assurance will extend beyond the issuance action to PIV Card validation and revocation services. These services are required elements of the PIV infrastructure, and will be implemented, monitored, and audited with the same care as the PIV issuance process.
+ Standard identity infrastructure. Application developers will assume, as a default, that registration and authentication will use a PIV Card identity, reducing development cost, registration time, and the application learning curve for new subjects.
+ Integrated system. PACS will be fully integrated with other PIV system components that perform provisioning, enrollment, and finalization.
+ Fewer passwords. A single PIV Card provides a small set of authentication methods that are applicable to many applications and in many contexts. This means significantly fewer passwords and account enrollments.
Each of these points both enhances security and creates efficiency of operation. Reducing passwords and password helpdesk calls, reusing identity enrollment across multiple applications, collapsing redundant status and revocation processes (separate processes for revocation on termination across multiple applications), and replacing authentication credentials that are easily shared or transferred will reduce operating costs borne by Federal agencies. Availability of a skilled workforce familiar with the standardized PIV identity infrastructure, implementation of PIV issuance with a standardized identity verification methodology, the existence of high- availability on-line services for PIV Card status and validation, and pre-enrollment in a graduated, multi-factor authentication scheme all enhance security current practice in many applications. The replacement of password (single-factor) authentication with PIV Card (one, two, or three-factor) authentication is a fundamental advance in authentication assurance. Biometric enrollment is mandatory for the PIV Card. Every government employee and contractor who can provide at least one fingerprint image of acceptable quality will be pre-enrolled for biometric authentication. 5 In the complete PIV System, the marginal cost for biometric enrollment to the application owner, relative to other authentication mechanisms, is near zero, enabling more applications to gain the benefits of biometric authentication. Recommendation: Operational metrics should be designed to measure actual benefits over the operational lifetime of the PIV System. They may be derived by formulating each of the expected benefits above as a service quality metric, e.g., for “integrated system”, service quality could be defined as the percentage of
5 [FIPS201] Section 4.4.1 states that “In cases where there is difficulty in collecting even a single fingerprint of acceptable quality, the department or agency shall perform authentication using asymmetric cryptography as described in Section 6.2.4.” Also, see [SP800-76] Section 3.3 and 3.4. PACS registrations that are performed automatically by provisioning from the PIV issuance system.
After · SP 800-116 Rev. 1
The complete PIV System will be an identity infrastructure that is attractive to Federal agencies, application owners, and contractors because of these benefits: + Enhanced trust. PIV Cards will be issued in accordance with a standardized, audited process, which will exceed the best practice level for low- and moderate-impact applications today, and equal best practice reached for high-impact applications.
+ Resistance to misuse and cloning. Electronic validation of the PIV Card, using digital signatures, makes it tamper-resistant. Cryptographic challenge/response protocols make the PIV Card counterfeit-resistant. Biometric authentication makes the PIV Card non- transferable.
+ Status and revocation. PIV Card Issuer process assurance will extend beyond the issuance action to PIV Card validation and revocation services. These services are required elements of the PIV infrastructure, and will be implemented, monitored, and audited with the same care as the PIV issuance process.
+ Standard identity infrastructure. Application developers will assume, as a default, that registration and authentication will use a PIV Card identity, reducing development cost, registration time, and the application learning curve for new subjects.
+ Integrated system. PACS will be fully integrated with other PIV system components that perform provisioning, enrollment, and finalization.
+ Fewer passwords. A single PIV Card provides a small set of authentication methods that are applicable to many applications and in many contexts. This means significantly fewer passwords and account enrollments.
Each of these points both enhances security and creates efficiency of operation. Reducing passwords and password helpdesk calls, reusing identity enrollment across multiple applications, collapsing redundant status and revocation processes (separate processes for revocation on termination across multiple applications), and replacing authentication credentials that are easily shared or transferred will reduce operating costs borne by Federal agencies. Availability of a skilled workforce familiar with the standardized PIV identity infrastructure, implementation of PIV issuance with a standardized identity verification methodology, the existence of high- availability on-line services for PIV Card status and validation, and pre-enrollment in a graduated, multi-factor authentication scheme all enhance security current practice in many applications. The replacement of password (single-factor) authentication with PIV Card (one, two, or three-factor) authentication is a fundamental advance in authentication assurance. Biometric enrollment is mandatory for the PIV Card. Every government employee and contractor who can provide at least one fingerprint image of acceptable quality will be pre-enrolled for biometric authentication. 5 In the complete PIV System, the marginal cost for biometric enrollment to the application owner, relative to other authentication mechanisms, is near zero, enabling more applications to gain the benefits of biometric authentication. Recommendation: Operational metrics should be designed to measure actual benefits over the operational lifetime of the PIV System. They may be derived by formulating each of the expected benefits above as a service quality metric, e.g., for “integrated system”, service quality could be defined as the percentage of
5 [FIPS201] Section 4.4.1 states that “In cases where there is difficulty in collecting even a single fingerprint of acceptable quality, the department or agency shall perform authentication using asymmetric cryptography as described in Section 6.2.4.” Also, see [SP800-76] Section 3.3 and 3.4. PACS registrations that are performed automatically by provisioning from the PIV issuance system.