7.1.7 BIO-A Authentication
All changes in this version
Title changed
Before · SP 800-116
BIO-A Authentication
After · SP 800-116 Rev. 1
BIO-A Authentication
Control changed
Before · SP 800-116
This authentication mechanism is the same as BIO authentication but an attendant supervises the use of the PIV Card and the submission of the PIN and the sample biometric by the cardholder. Some fingerprint biometric readers have been shown to accept fake or synthetic fingerprints; others may allow access to internal wiring with relative ease. The presence of an attendant during BIO-A authentication serves to mitigate these risks. Moreover, the presence of an attendant also provides increased assurance, relative to BIO, that a fake card is not being used, which accounts for an additional authentication factor of “something you have.” Since the PIN is verified by the PIV Card and the card itself is not verified by PACS, the “something you know” authentication factor is not validated. In summary, the BIO-A authentication mechanism benefits from a presence of visual, but not from a strong challenge/response authentication, with the PIV Card. Therefore, BIO-A is considered a two-factor authentication mechanism.
7 Pre-enrolling a certificate is not the same as pre-authorizing the identity for access. Pre-enrolling means only that a valid identity is known to the PACS. Authorization decisions for known identities are made separately. 8 There will be instances where a PIV Card does not store two fingerprint templates with an acceptable quality score. In these cases, follow the recommendations stated in FIPS 201 Section 4.4.1, "In cases where there is difficulty in collecting even a single fingerprint of acceptable quality, the department or agency shall perform authentication using asymmetric cryptography as described in Section 6.2.4." and [SP800-76] Sections 3.3 and 3.4. Alternatively, agency security policy may require additional authentication mechanisms in consideration of impact-based security management.
After · SP 800-116 Rev. 1
This authentication mechanism is the same as BIO authentication but an attendant supervises the use of the PIV Card and the submission of the PIN and the sample biometric by the cardholder. Some fingerprint biometric readers have been shown to accept fake or synthetic fingerprints; others may allow access to internal wiring with relative ease. The presence of an attendant during BIO-A authentication serves to mitigate these risks. Moreover, the presence of an attendant also provides increased assurance, relative to BIO, that a fake card is not being used, which accounts for an additional authentication factor of “something you have.” Since the PIN is verified by the PIV Card and the card itself is not verified by PACS, the “something you know” authentication factor is not validated. In summary, the BIO-A authentication mechanism benefits from a presence of visual, but not from a strong challenge/response authentication, with the PIV Card. Therefore, BIO-A is considered a two-factor authentication mechanism.
7 Pre-enrolling a certificate is not the same as pre-authorizing the identity for access. Pre-enrolling means only that a valid identity is known to the PACS. Authorization decisions for known identities are made separately. 8 There will be instances where a PIV Card does not store two fingerprint templates with an acceptable quality score. In these cases, follow the recommendations stated in FIPS 201 Section 4.4.1, "In cases where there is difficulty in collecting even a single fingerprint of acceptable quality, the department or agency shall perform authentication using asymmetric cryptography as described in Section 6.2.4." and [SP800-76] Sections 3.3 and 3.4. Alternatively, agency security policy may require additional authentication mechanisms in consideration of impact-based security management.