BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

7.2 Multi-Factor Authentication

NIST PIV and digital identity SP 800-116 Rev. 1 against SP 800-116
All changes in this version
removed 7 PIV Authentication Mechanisms part of 7

Title changed

Before · SP 800-116

Multi-Factor Authentication

After · SP 800-116 Rev. 1

Multi-Factor Authentication

Control changed

Before · SP 800-116

Possession of a valid PIV Card as evidenced by visual inspection of the card, reading a signed object from the card, or performing challenge/response authentication with the card, provides one-factor authentication. For this reason, the VIS, CHUID, and CAK authentication mechanisms provide one-factor authentication. VIS provides weak one-factor authentication since the card verification is subjective. CHUID also provides weak one-factor authentication since it could be cloned or counterfeited (in absence of signature verification). The BIO mechanism provides one-factor authentication since the reference biometric template is compared against the sample biometric template. The PKI authentication mechanism provides two-factor authentication since it requires possession of the PIV Card and knowledge of the PIN. The BIO- A mechanism provides two-factor authentication since the reference biometric template is compared with the sample biometric template in the presence of an attendant. The BIO-A mechanism requires a PIV Card, knowledge of a PIN, and live fingerprint. The knowledge of a PIN, the third factor of authentication, can only be trusted by combining PKI + BIO(-A) or CAK + BIO(-A) authentication mechanisms. The next section describes the use of multi-factor authentication in the PACS environment.

After · SP 800-116 Rev. 1

Possession of a valid PIV Card as evidenced by visual inspection of the card, reading a signed object from the card, or performing challenge/response authentication with the card, provides one-factor authentication. For this reason, the VIS, CHUID, and CAK authentication mechanisms provide one-factor authentication. VIS provides weak one-factor authentication since the card verification is subjective. CHUID also provides weak one-factor authentication since it could be cloned or counterfeited (in absence of signature verification). The BIO mechanism provides one-factor authentication since the reference biometric template is compared against the sample biometric template. The PKI authentication mechanism provides two-factor authentication since it requires possession of the PIV Card and knowledge of the PIN. The BIO- A mechanism provides two-factor authentication since the reference biometric template is compared with the sample biometric template in the presence of an attendant. The BIO-A mechanism requires a PIV Card, knowledge of a PIN, and live fingerprint. The knowledge of a PIN, the third factor of authentication, can only be trusted by combining PKI + BIO(-A) or CAK + BIO(-A) authentication mechanisms. The next section describes the use of multi-factor authentication in the PACS environment.