7.1 Authentication Factors
All changes in this version
Title changed
Before · SP 800-116
Authentication Factors
After · SP 800-116 Rev. 1
Authentication Factors
Control changed
Before · SP 800-116
One of the functions of the PACS application is to verify the identity of the cardholder presenting a PIV Card. The PACS application may perform one or more authentication mechanisms using the PIV Card to establish confidence in the identity of the cardholder. The authentication of an identity is based on the verification of one, two, or three of these factors: a) “something you have”, for example, possession of the PIV Card; b) “something you know”, for example, knowledge of the PIN; and c) “something you are”, for example, presentation of live fingerprints by a cardholder. The PIV Card authentication mechanisms operate in several different ways, as defined in [FIPS201], [SP800-73], and [SP800-76]. For example, a data object may be read from the PIV Card and its signature verified (CHUID authentication mechanism). A private key on the PIV Card may be used to sign a challenge (PKI and CAK authentication mechanisms). A valid biometric may be read from the card and compared against a live fingerprint scan (BIO and BIO- A authentication mechanisms). Also, PIV Card authentication mechanisms may be performed by different entities, referred to here as verifiers. For example, a PACS application verifies the signature on a data object, or the signing of a challenge using a private key or comparison of biometric templates. The verifier can also be the PIV Card itself. For example, the PIN is verified by the PIV Card. The PIN verification by the PIV Card should be trusted by the PACS only if the card is trusted to be a valid PIV Card. For example, when PKI + BIO(-A) authentication mechanisms are combined, or CAK + BIO(-A) authentication mechanisms are combined, all three factors are achieved. The PIN verification by the card can be trusted by the PACS because the PIV Card has authenticated to the PACS using the PKI or CAK authentication mechanisms, respectively. The confidence in the cardholder’s identity increases with the number of factors used to authenticate the PIV Card. Table 7-1 provides a list of PIV authentication mechanisms and their authentication factors. Note that CAK + BIO(-A) authentication mechanism is recognized as a unique combination in this table. This is due to the fact that neither CAK nor BIO(-A) individually provide “something you know” authentication factor, but when they are used together, PIN verification provides this factor. Many different combinations of the Table 7-1 authentication mechanisms are possible and an exhaustive list of combinations is provided in Appendix C. Table 7-1. Authentication Factors of PIV Authentication Mechanisms
PIV Authentication Mechanism Have Know Are Authentication Factors (HKA Vector) Interface
CAK + BIO (-A) x x x 3 Contact BIO-A x x 2 Contact PKI x x 2 Contact BIO x 1 Contact CAK x 1 Contact/ Contactless CHUID + VIS x 1 Contact/ Contactless
Each of the above PIV authentication mechanisms is described further in the following sections.
After · SP 800-116 Rev. 1
One of the functions of the PACS application is to verify the identity of the cardholder presenting a PIV Card. The PACS application may perform one or more authentication mechanisms using the PIV Card to establish confidence in the identity of the cardholder. The authentication of an identity is based on the verification of one, two, or three of these factors: a) “something you have”, for example, possession of the PIV Card; b) “something you know”, for example, knowledge of the PIN; and c) “something you are”, for example, presentation of live fingerprints by a cardholder. The PIV Card authentication mechanisms operate in several different ways, as defined in [FIPS201], [SP800-73], and [SP800-76]. For example, a data object may be read from the PIV Card and its signature verified (CHUID authentication mechanism). A private key on the PIV Card may be used to sign a challenge (PKI and CAK authentication mechanisms). A valid biometric may be read from the card and compared against a live fingerprint scan (BIO and BIO- A authentication mechanisms). Also, PIV Card authentication mechanisms may be performed by different entities, referred to here as verifiers. For example, a PACS application verifies the signature on a data object, or the signing of a challenge using a private key or comparison of biometric templates. The verifier can also be the PIV Card itself. For example, the PIN is verified by the PIV Card. The PIN verification by the PIV Card should be trusted by the PACS only if the card is trusted to be a valid PIV Card. For example, when PKI + BIO(-A) authentication mechanisms are combined, or CAK + BIO(-A) authentication mechanisms are combined, all three factors are achieved. The PIN verification by the card can be trusted by the PACS because the PIV Card has authenticated to the PACS using the PKI or CAK authentication mechanisms, respectively. The confidence in the cardholder’s identity increases with the number of factors used to authenticate the PIV Card. Table 7-1 provides a list of PIV authentication mechanisms and their authentication factors. Note that CAK + BIO(-A) authentication mechanism is recognized as a unique combination in this table. This is due to the fact that neither CAK nor BIO(-A) individually provide “something you know” authentication factor, but when they are used together, PIN verification provides this factor. Many different combinations of the Table 7-1 authentication mechanisms are possible and an exhaustive list of combinations is provided in Appendix C. Table 7-1. Authentication Factors of PIV Authentication Mechanisms
PIV Authentication Mechanism Have Know Are Authentication Factors (HKA Vector) Interface
CAK + BIO (-A) x x x 3 Contact BIO-A x x 2 Contact PKI x x 2 Contact BIO x 1 Contact CAK x 1 Contact/ Contactless CHUID + VIS x 1 Contact/ Contactless
Each of the above PIV authentication mechanisms is described further in the following sections.