BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

7.1.3 Cardholder Unique Identifier (CHUID) Authentication

NIST PIV and digital identity SP 800-116 Rev. 1 against SP 800-116
All changes in this version
removed 7 PIV Authentication Mechanisms part of 7.1

Title changed

Before · SP 800-116

Cardholder Unique Identifier (CHUID) Authentication

After · SP 800-116 Rev. 1

Cardholder Unique Identifier (CHUID) Authentication

Control changed

Before · SP 800-116

The CHUID, as defined in FIPS 201, is one of the data objects on PIV credentials. The CHUID includes a FASC-N data element that uniquely identifies the PIV Card. The CHUID also uniquely identifies an individual since each PIV Card is issued to an individual. The CHUID data object is signed by the issuer so alterations or modifications to a CHUID can be detected. The CHUID is standardized by FIPS 201; therefore, a CHUID data object can be counterfeited easily with the exception of the issuer signature. A counterfeit CHUID would not possess a valid issuer signature. The CHUID is a free read object on the PIV Card; therefore, it can be read or cloned easily. Because of the risk of CHUID counterfeiting or cloning, the CHUID authentication mechanism, used in isolation, provides a confidence level that is comparable to proximity cards in widespread use today. However, if the CHUID signature verification is performed, the PACS can be sure the CHUID came from a valid issuer and it has not been altered. Reading the CHUID from a PIV Card is not sufficient to establish confidence in cardholder’s identity. Therefore, in order to achieve single-factor authentication with CHUID, the relying parties must validate the signature on the CHUID.

After · SP 800-116 Rev. 1

The CHUID, as defined in FIPS 201, is one of the data objects on PIV credentials. The CHUID includes a FASC-N data element that uniquely identifies the PIV Card. The CHUID also uniquely identifies an individual since each PIV Card is issued to an individual. The CHUID data object is signed by the issuer so alterations or modifications to a CHUID can be detected. The CHUID is standardized by FIPS 201; therefore, a CHUID data object can be counterfeited easily with the exception of the issuer signature. A counterfeit CHUID would not possess a valid issuer signature. The CHUID is a free read object on the PIV Card; therefore, it can be read or cloned easily. Because of the risk of CHUID counterfeiting or cloning, the CHUID authentication mechanism, used in isolation, provides a confidence level that is comparable to proximity cards in widespread use today. However, if the CHUID signature verification is performed, the PACS can be sure the CHUID came from a valid issuer and it has not been altered. Reading the CHUID from a PIV Card is not sufficient to establish confidence in cardholder’s identity. Therefore, in order to achieve single-factor authentication with CHUID, the relying parties must validate the signature on the CHUID.