NIST SP 800-76-2 日本語訳

Patrick Grother Wayne Salamon

Ramaswamy Chandramouli

Patrick Grother Wayne Salamon

Information Access Division Information Technology Laboratory

Ramaswamy Chandramouli Computer Security Division Information Technology Laboratory

July 2013

U.S. Department of Commerce Penny Pritzker, Secretary

National Institute of Standards and Technology

Patrick D. Gallagher, Under Secretary of Commerce for Standards and Technology and Director

National Institute of Standards and Technology Special Publication 800-76-2 Natl. Inst. Stand. Technol. Spec. Publ. 800-76-2, 61 pages (July 2013) CODEN: NSPUE2 http://dx.doi.org/10.6028/NIST.SP.800-76-2

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by Federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, Federal agencies may wish to closely follow the development of these new publications by NIST.

Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. All NIST Computer Security Division publications, other than the ones noted above, are available at http://csrc.nist.gov/publications.

National Institute of Standards and Technology Attn: Information Access Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8940) Gaithersburg, MD 20899-8940

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in Federal information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Homeland Security Presidential Directive HSPD-12, Policy for a Common Identification Standard for Federal Employees and Contractors [HSPD-12], called for Homeland Security Presidential Directive HSPD-12, Policy for a Common Identification Standard for Federal Employees and Contractors [HSPD-12], called for new standards to be adopted governing interoperable use of identity credentials to allow physical and logical access to Federal government locations and systems. The Personal Identity Verification (PIV) standard for Federal Employees and Contractors, Federal Information Processing Standard Personal Identity Verification (PIV) of Federal Employees and Contractors (FIPS 201), was developed to define procedures and specifications for issuance and use of an interoperable identity credential. This document, Special Publication 800-76 (SP 800-76), is a companion document to FIPS 201. It describes technical acquisition and formatting specifications for the PIV system, including the PIV Card itself. It also establishes minimum accuracy specifications for deployed biometric authentication processes. The approach is to enumerate procedures and formats for collection and preparation of fingerprint, iris and facial data, and to restrict values and practices included generically in published biometric standards. The primary design objective behind these particular specifications is to enable high performance and universal interoperability. The introduction of iris and face specifications into the current edition adds alternative modalities for biometric authentication and extends coverage to persons for whom fingerprinting is problematic. The addition of on-card comparison offers an alternative to PIN-mediated card activation as well as an additional authentication method.

biometrics; credentials; identity management

The authors from the National Institute of Standards and Technology (NIST) wish to thank their colleagues who reviewed drafts of this document and contributed to its development. Particular thanks go to the many external commenters who produced detailed comments on the drafts, to Charles Wilson who directed the development of the original SP 800-76 and its early update, SP 800-76-1, and to R. Michael McCabe for his extensive knowledge of various fingerprint standards and the Federal Bureau of Investigation's procedures. The authors also gratefully acknowledge and appreciate the many contributions from the public and private sectors for the continued interest and involvement in the development of this publication.

Executive Summary

Scope: Homeland Security Presidential Directive 12, Policy for a Common Identification Standard for Federal Employees and Contractors [HSPD-12], called for new standards to be adopted governing interoperable use of identity credentials to allow physical and logical access to Federal government locations and systems. The Personal Identity Verification (PIV) standard for Federal Employees and Contractors, Federal Information Processing Standard 201, Personal Identity Verification (PIV) of Federal Employees and Contractors (FIPS 201), was developed to define procedures and specifications for issuance and use of an interoperable identity credential. This document, Special Publication 800-76 (SP 800-76), is a companion document to FIPS 201. It describes technical acquisition and formatting specifications for the PIV system, including the PIV Card¹ itself. It also establishes minimum accuracy specifications for deployed biometric authentication processes.

Approach: The approach is to enumerate procedures and formats for collection and preparation of fingerprint, iris and facial data, and to restrict values and practices included generically in published biometric standards. The primary design objective behind these particular specifications is to enable high performance and universal interoperability. The introduction of iris and face specifications into the current edition adds additional modalities for biometric authentication and extends coverage to persons for whom fingerprinting is problematic. The addition of on-card biometric comparison offers an alternative to PIN-mediated card activation as well as an additional authentication method. For the preparation of biometric data suitable for the Federal Bureau of Investigation (FBI) background check, SP 800-76 references the ANSI/NIST Fingerprint Standard [AN2011] and the FBI's Electronic Biometric Transmission Specification [EBTS].

Domain of use: Recognizing that PIV specifications are sometimes leveraged in other identity management applications, it should be noted that derivative programs should adopt these PIV-specifications with appropriate deliberative technical augmentation. The biometric data elements contained in this standard are suitable for one-to-one verification of document holders when other application-specific factors are maintained. But, for example, if the fingerprint templates mandated here are used in conjunction with fingerprints captured on non-PIV compliant fingerprint sensors, there may be systematic degradations in recognition accuracy. Similarly, while it would be appropriate to take the compressed iris specification defined here for use on a nation state's e-Passports², it would be technically suboptimal to then copy those iris images to be the enrollment samples of an expedited traveler program running in one-to-many single-factor mode (i.e., the mode of [NEXUS,UKIRIS]).

Biometric data used outside the PIV Data Model is not within the scope of this standard.

This document has been developed by the National Institute of Standards and Technology (NIST) in furtherance of its statutory responsibilities under the Federal Information Security Management Act (FISMA) of 2002, Public Law 107-347.

NIST is responsible for developing standards and guidelines, including minimum requirements, for providing adequate information security for all agency operations and assets, but such standards and guidelines shall not apply to national security systems. This recommendation is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), Securing Agency Information Systems, as analyzed in A-130, Appendix IV: Analysis of Key Sections. Supplemental information is provided in A-130, Appendix III.

This recommendation, prepared for use by federal agencies, may be used by non-governmental organizations on a voluntary basis and is not subject to copyright. Nothing in this document should be taken to contradict standards and guidelines made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority. Nor should this recommendation be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the Office of Management and Budget, or any other Federal official.

FIPS 201 [FIPS], Personal Identity Verification (PIV) for Federal Employees and Contractors, defines procedures for the PIV lifecycle activities including identity proofing, registration, PIV Card issuance and re-issuance, chain-of-trust operations, and PIV Card usage. [FIPS] also defines an identity credential that includes biometric data. Requirements on interfaces are described in [800-73, parts 1-3]. Those on cryptographic protection of the biometric data are described in [FIPS] and in [800-78].

This document contains technical specifications for biometric data mandated or allowed in [FIPS]. These specifications reflect the design goals of interoperability, performance and security of the PIV Card and PIV processes. This specification addresses iris, face and fingerprint image acquisition to variously support background checks, fingerprint template creation, retention, and authentication. These goals are addressed by normatively citing and mandating conformance to biometric standards and by enumerating requirements where the standards include options and branches. In such cases, a biometric profile can be used to declare what content is required and what is optional. This document goes further by constraining implementers' interpretation of the standards. Such restrictions are designed to ease implementation, assure conformity, facilitate interoperability, and ensure performance, in a manner tailored for PIV applications.

The biometric data specifications herein are mandatory for biometric data carried in the PIV Data Model (Appendix A of [800-73, Part 1]). Biometric data used outside the PIV Data Model is not within the scope of this standard.

This document does however specify that most biometric data in the PIV Data Model shall be embedded in the Common Biometric Exchange Formats Framework [CBEFF] structure of Section 9. This supports record integrity (using digital signatures) and multimodal encapsulation.

This document provides an overview of the strategy that can be used for testing conformance to the standard. It is not meant to be a comprehensive set of test requirements that can be used for certification or demonstration of compliance to the specifications in this document. NIST Special Publications 800-85A and 800-85-B [800-85] implements those objectives.

This document is targeted at Federal agencies and implementers of PIV systems. In addition, it should be of interest to the biometric access control industry. Readers are assumed to have a working knowledge of biometric standards and applications.

This document defines:

― In Section 2, acronyms and terms; ― in Section 3, the fingerprint acquisition process, requirements for transmission of data to FBI, and a format for agency-optional image retention; ― in Section 4, the format of the PIV Card minutiae templates for off-card authentication, and specifications for algorithms used in the generation and matching of such; ― in Section 5, the formats and data structures for minutiae used in on-card comparison operations, and specifications for algorithms used in the generation and matching of such; ― in Section 6, the format for iris data stored on and off PIV Cards, and specifications for cameras and algorithms used for the collection, preparations and matching of such; ― in Section 7, the format and data structures for facial images on PIV Cards, and specifications for collection thereof; ― in Section 8, interface specifications for biometric sensors; ― in Section 9, the CBEFF header and footer supporting digital signatures on all PIV biometric data; ― in Section 10, minimum accuracy specifications; ― in Section 11, additional conformance information, beyond the specifications embedded in Sections 4 through 7; ― in Section 12, references. Figure 1 gives an approximate procedure for biometric data acquisition and disposition.

Figure 1 − PIV biometric data flow

Iris specifications are included, in Section 6, to support biometric authentication of individuals. [FIPS] allows use of iris for this purpose. The recommendation to agencies to install and operate iris equipment in its PIV issuance processes allows agencies to additionally populate PIV Cards with iris as an alternative authentication modality. [FIPS] requires the cardholder to enter a PIN number to release the templates. When the card is cryptographically authenticated, this constitutes multi-factor authentication.

[FIPS] requires fingerprint templates of Section 4 as the mandatory biometric element for PIV. These templates are intended to be compared on a reader device with templates collected in an authentication attempt. [FIPS] requires the cardholder to enter a PIN number to release the templates. When the card is cryptographically authenticated, this constitutes multi-factor authentication.

Agencies may additionally choose to populate the card with an on-card comparison algorithm, and on-card comparison templates. The specifications for these appear in Section 5. [FIPS] does not require PIN entry ahead of a fingerprint minutiae on-card comparison transaction. Indeed, [FIPS] extends on-card comparison as an alternative to PIN entry in altering the security state of the PIV Card.

Agencies should consider economics of on vs. off card comparison. Particularly, a security flaw, for example, in a card may have different remediation cost than in a card reader.

Table 1 describes the differences between the off-card and on-card specifications.

Table 1 − Summary of properties and roles of on- and off-card fingerprint comparison

[FIPS] advances a PIV concept of biometric operations that is three-factor³: A PIN verification is required before biometric data is read from the PIV Card and matched in a 1:1 mode during authentication. In other programs, biometrics are sometimes stored on a central server, or read from a card and cached on one. In others, the biometric is matched in a one-to-many mode without presentation of a card to claim an identity. There are tradeoffs with such approaches.

― PIV Card read times are replaced with network transmission times. ― PIN entry times are eliminated but the something-you-know additional factor is lost. ― The remote server is subject to physical or logical attack (e.g., a denial-of-service attack). Many kinds of templates stored on a server can be reversed to produce a matchable-sample [REVFING, REVIRIS, REVFACE]. Formal template protection schemes, which mitigate the effect of compromise of a database, require further testing. ― If the PIV Card is not used to make an explicit claim to one of the N enrolled identities, the biometric-only one-to-many authentication loses the something-you-have factor, and necessitates mitigation of a N-fold increase in false match rates. ― Such use cases are not addressed by this specification.

Since the first publication of SP 800-76 in 2005, considerable effort has been dedicated to the development of second-generation biometric data interchange standards. These are the various parts of ISO/IEC 19794, as revised, and updates to the analogous INCITS standards in c. 2009. These standards have not been adopted here as replacements for the extant PIV biometric standards - INCITS 385:2004 (face), INCITS 381:2004 (fingerprint image), and INCITS 378:2004 (fingerprint minutiae) – because ― they are not binary compatible with the earlier standards, ― deployed infrastructure (readers) would need to be updated to support both the legacy and second generation standards, and ― they confer essentially no performance advantages over the earlier standards. For data elements that were not included in the 2005 PIV specifications, i.e., images to support iris recognition and minutia data to support on-card comparison, this specification adopts the latest ISO/IEC 19794 Part 2 and Part 6 standards [CARD-MIN, IRISSTD].

Other biometrics-related terms are defined and harmonized in [VOCABSTD].

The specifications in this Section pertain to the production of the mandatory PIV biometric enrollment data. That is, this Section provides specifications for acquisition, formatting, and storage of fingerprint images and templates. The following is an overview of the material covered in this Section.

Although FBI requirements drive the sensor specifications, the permanent electronic storage format specified in sub-Section 3.3 is an INCITS standard record and is therefore specified independently.

If an agency retains fingerprint templates, in either proprietary or standardized formats, then they shall be embedded in the [CBEFF] header of Section 9 which requires integrity protection and allows for encryption of the records.

This Section specifies the capture of a full set of fingerprint images for PIV registration. A subject's fingerprints shall be collected according to one of the three imaging modes enumerated in Table 2.

Table 2 − Fingerprint acquisition protocols

INFORMATIVE NOTES:

For Options 1 and 2 the devices used for capture of the fingerprints shall have been certified by the FBI to conform to Appendix F of the FBI’s Electronic Biometric Transmission Specification [EBTS, Appendix F]. For Option 3, a scan of the inked card shall be performed to effect conversion to electronic form. The scanner shall be certified by the FBI as being compliant with [EBTS, Appendix F]. The scanning is needed to produce fingerprints in the digital formats of Sub-sections 3.3 and 3.4. The FBI specifications include width and height specifications for the imaging surface. The native scanning resolution of the device shall be 197 pixels per centimeter (500 pixels per inch) in both the horizontal and vertical directions. These specifications comply with the FBI submission requirements and with the Image Acquisition Setting Level 31 of the Finger Image-Based Data Interchange Format standard, INCITS 381 [FINGSTD].

For live-scan acquisition i.e., options 1 and 2, the enrollment client software should display the images to the attending operator. The operator should repeat acquisition if the ridge structure is not clear, broken, or incomplete in the displayed images.

The procedure for the collection of fingerprints, presented in Table 3, shall be followed. The procedure shall employ the NIST Fingerprint Image Quality [NFIQ] algorithm⁴ to initiate any needed reacquisition of the images. An attending official shall be present at the time of fingerprint capture. The agency shall employ measures to ensure the quality of acquisition and guard against faulty presentation, whether malicious or unintentional. Quality assessment might be an integral function of the acquisition device or might be implemented by the attending official. In any case, the agency shall ensure that the applicant does not swap finger positions or hands, occlude fingers, or misalign or misplace the fingers. Particularly, because it is common during collection of multi-finger plain impressions for little fingers (i.e., positions 05 and 10) to not be long enough to reach the imaging platen, it is accepted practice for the hand to be placed at an angle to the horizontal to ensure imaging of all four fingers. Although this is not needed with newer large-platen devices the official shall in all cases take care to image all fingers completely. The procedure requires segmentation of the multi-finger plain impressions; this operation may be assisted by the attending official.

Table 3 − Quality control procedure for acquisition of a full set of fingerprint images

Ordinarily, all ten fingerprints shall be imaged in this process; however, if one or more fingers are not available (for instance, because of amputation) then as many fingers as are available shall be imaged. When fewer than ten fingers are collected, the FBI background transaction of Sub-section 3.4 requires field AMP 2.084 of the accompanying Type 2 record [see EBTS, Appendix C] to have labels indicating fingers that are amputated or otherwise not imaged.

Quality of the biometric data is critical to the success of a biometric application. This is particularly true for enrollment data that typically persists for years. As enrollment is an attended operation, the operator is important to the collection of high quality data. Attending staff should be trained to maintain and clean the sensor, and to collect in accordance with manufacturer's guidance and this document. Specifically Agencies shall apprise staff that: ― Low humidity - typical in winter – causes dry fingers from which good images are more difficult to collect. This risk can be mitigated by measurement and appropriate use of supplemental humidification. Fingers may be lightly moisturized. ― Exposure of biometric equipment to bright light sources, such as direct sunlight, is generally adverse for collection of fingerprints. ― The background check can be defeated by mutilation of the fingerprints e.g.,either temporarily (e.g.,by burns or abrasives) or permanently (e.g.,by surgical means). In addition certain medications can cause loss of fingerprint ridge structure. It is recommended that collection of fingerprints from applicants with finger injuries be delayed until the fingers heal.

In order to track enrollment quality over time, a numerical summary of operational quality may be computed as a management indicator. If computed, this summary shall be computed from the NFIQ values of primary fingers of all PIV Card applicants processed in each calendar month. If computed, the summary shall be computed using the method of NIST Interagency Report 7422 [NFIQ SUMMARY] which uses a simple formula to aggregate NFIQ values. This calculation is readily automated.

Managers can track this over time, across collection sites or stations, over different populations (e.g., contractors vs. employees), across functions (PIV issuance vs. re-issuance), or even across fingers. Managers can use aggregated quality indicators as a tool to identify fingerprint collection problems. These may be due to changes in the physical environment or unintended changes in operating procedures.

This Section specifies a common data format record for the retention of the fingerprint images collected in Sub-section 3.2. Specifically any fingerprint images enrolled or otherwise retained by agencies shall be formatted according to the INCITS 381-2004 finger image based interchange format standard [FINGSTD]. This set should include single-finger images. These shall be obtained by segmentation of the plain multi-finger images gathered in accordance with Options 1, 2 or 3 of Table 2, and the single plain thumb impressions from presentations 4 & 5 of Options 2 and 3. These images shall be placed into a single [FINGSTD] record. The record may also include the associated multi-finger plain impressions and the rolled images. This document ([800-76]) does not specify uses for any single-finger rolled images gathered according to Options 2 or 3 of Table 2. The record shall be wrapped in the CBEFF structure described in Section 9. Agencies may encrypt this data per the provisions of Section 9, Table 14, Note 2.

Table 4 is a clause-by-clause profile of [FINGSTD] for PIV. Its structure is as follows. ― Rows 1-10 give normative content in INCITS 381 on the kind of images to be acquired. ― Row 11 requires the CBEFF structure of Section 9 (i.e., header of Table 14, digital signature of Section 9.3). ― Rows 12-27 give PIV specifications for the fields of the General Record Header of [FINGSTD, Table 2]. These are common to all images in the record. ― Similarly, rows 28-36 provide specifications for the Finger Image Header Record in Table 4 of [FINGSTD]. The "PIV Conformance" column provides PIV specific practice and parameter defaults of the standard. While INCITS 381 has been revised by the INCITS M1 committee, the 2004 edition is sufficient for PIV so the 2009 revision is irrelevant to PIV; however implementations should respect the version number on Line 14 of Table 4.

To assist implementers, NIST has made [FINGSTD] sample data available⁶.

Table 4 − INCITS 381 profile for agency retention of fingerprint Images

NORMATIVE NOTES:

PIV fingerprint images transmitted to the FBI as part of the background checking process shall be formatted according to the ANSI/NIST-ITL 1-2011 standard [AN2011] and the CJIS-RS-0010 [EBTS] specification. Such records shall be prepared from, and contain, only those images collected per specifications in Section 3.2.

Table 5 enumerates the appropriate transaction formats for the three acquisition options of Section 3.2. The FBI documentation [EBTS] should be consulted for definitive requirements.

Table 5 − Record types for background checks

This Section specifies how the PIV mandatory biometric elements specified in [FIPS] are to be generated and stored. This specification applies to templates stored within the PIV Card, and to [MINUSTD] templates otherwise retained by agencies. The templates constitute the enrollment biometrics for PIV authentication and as such are supported by a high quality image acquisition specification, and an FBI-certified compression format. The specification of a standardized template here enables use of the PIV Card in a multi-vendor product environment.

Two [MINUSTD] fingerprint templates shall be stored on the PIV Card; these are hereafter referred to as PIV Card templates. These shall be prepared from images of the primary and secondary fingers. These fingers should be selected on the basis of:

― Availability: Ability of individuals to mechanically place the finger on a generic sensor – this contraindicates ring fingers, and sometimes thumbs. ― Quality: High quality fingers, preferably those of NFIQ = 1 or 2, should be used. Lower quality fingers should only be used if recapture (per Section 3.2.1) has failed and if other items in this list preclude use of better quality fingers. ― Control: Ability to use fine motor control in placing the finger on a sensor – for most individuals this indicates use of index fingers. ― Handedness: Individuals should favor their preferred hand, for most people this is the right hand. ― Injury: Presence of permanent or temporary injury to the friction ridge structure, or the finger itself – this contraindicates use of afflicted fingers. ― Area: Physical area of the finger's volar pad – this favors use of thumbs, and contraindicates little "pinky" fingers. ― Two-finger sensors: If two-finger sensors are deployed and used, adjacent fingers can be placed simultaneously. ― Sensor placement: If the fingerprint sensor is to the side of a user vs. in front (as for the driver of a vehicle), the fingers from the same hand might be used. Thus a PIV Card applicant, in consultation with an attending operator, should select primary and secondary fingers with the following being the default, in descending order of priority.

These images shall be either: ― those obtained by segmenting the initial plain impressions of the full set of fingerprints captured during PIV Registration and stored in Row 8 of Table 3, or ― new images collected and matched against the initial plain impressions (see [FIPS]). Significant rotation, exceeding 30 degrees, of the multi-finger plain impressions (for example, that which can occur when four fingers are imaged using a narrow platen) shall be removed prior to, or as part of, the generation of the mandatory minutiae templates. The rotation angle shall be that which makes the inter-phalangeal creases approximately horizontal or, equivalently, the inter-finger spaces approximately vertical. This requirement supports interoperable fingerprint matching.

[FIPS] establishes requirements on authentication of card applicants for example to bind the PIV Cardholder to the individual whose background was checked. This authentication shall use images collected using either a [EBTS, Appendix F] multi-finger fingerprint imaging device of Section 3.2, or a [SINGFING] device of Section 4.7.

PIV Card templates shall be a conformant instance of the INCITS 378-2004 [MINUSTD] minutiae template standard. A standard record is used to satisfy global interoperability objectives. Second generation standards have been published since the first PIV specification appeared in 2005; these standards are not cited in SP 800-76-2 for the reasons given in Section 1.6. Implementations shall therefore respect the version number on Line 14 of Table 6.

The minutiae from both the primary and secondary fingers shall reside within a single INCITS 378 record. This means that there will be one instance of the "General Record Header" [MINUSTD, 6.2-6.4], and two instances of the "Finger View Record" [MINUSTD, 6.5]. The entire Table 6 record shall be wrapped in a single instance of the CBEFF structure specified in Section 8 prior to storage on the PIV Card. The PIV Card templates shall not be encrypted.

Table 6 is a profile of the generic [MINUSTD] standard. Its specifications shall apply to all minutiae templates placed on PIV Cards. These constraints are included to promote highly accurate and interoperable personal identity verification. This document recommends that the minutiae records should be prepared soon after the images are captured and before they are compressed for storage. To assist implementers, NIST has made [MINUSTD] sample data available⁷. Implementers should buy [MINUSTD] for information such as the number of bits used in each field.

Table 6 − INCITS 378 profile for PIV Card templates

NORMATIVE NOTES:

The angle of the minutiae is determined by constructing three virtual rays originating at the bifurcation point and extending to the end of each leg. The smallest of the three angles formed by the rays is bisected to indicate the minutiae direction.

Figure 2 − Minutiae angle determination

Extensive, refined and complete guidance on minutia detection and estimation appears in INCITS 378:2009 Clause 6. That standard is the revision of INCITS 378-2004 [MINUSTD]. While PIV still requires [MINUSTD] for off-card comparison template formatting, the 2009 standard might be consulted because it gives elaborate information on the semantic (placement + selection) aspects associated with this note.

If two fingerprints have never been collected (e.g., because of injury, amputation, or persistent poor quality), or all fingerprint authentication attempts fail during Section 4.3 card issuance, then the PIV Card shall be populated with the standardized minutia record of Section 4.4 which

[FIPS] allows iris or face biometrics (see Sections 6 and 7) for some PIV operations for applicants with unavailable or unusable fingerprints.

If only one finger is available, the first view shall be populated and the second view shall be empty, as above. Authentication systems encountering cards populated with empty minutia templates might use iris authentication, if the data is present on card.

NOTE Minutia detection and matching algorithms continue to improve. Their accuracies have been measured on reference data sets [MINEX04]. Some certified implementations are significantly more accurate than others, affording lower false match rates for equal false rejection rates.

The intent of the [FIPS] specification of a government-wide interoperable biometric is to support cross-vendor and cross-agency authentication of PIV Cards. These multi-party aspects cause fingerprint recognition accuracy to vary, as documented in [MINEX04]. To mitigate against poor authentication performance this document requires template generators (minutia detection algorithms) and template matchers to produce low verification error rates in interoperability tests. These specifications apply to off-card comparison of templates - separate specifications are advanced for on-card comparison in Section 5.7. For off-card comparison, these components shall perform according to

The criteria implement the core government-wide interoperability objectives of HSPD-12 by populating PIV Cards with interoperable enrollment templates. This is necessary to exclude systematically incorrect implementations of the underlying [MINUSTD] from PIV. The effect of this is to give increased assurance of low operational error rates.

The core cross-vendor interoperability specification is met by establishing requirements on template generators and template matchers as described in the following two sub-sections.

A template generator is certified on the basis of the conformance of its output, its speed of computation, and on the error rates observed when its templates are matched. A template generator shall be certified only if

A template matcher is certified on the basis of its speed of computation, and on the error rates observed when it matches templates in interoperability tests. A template matcher shall be certified only if

The interoperability criterion of Section 4.5.2.2⁹ is designed to support low false rejection when templates can come from many sources (i.e., conformant [MINUSTD] template generators). This FMR value, however, is too high for operational application i.e., it is higher than the minimum accuracy requirements of Section 10. To support actual authentication of PIV Card templates, a template generator and matcher-pair shall be certified if

The performance specifications of sections 4.5.2.1, 4.5.2.2 and referred to as Level 1 accuracy specifications. The specifications of Section 4.5.3 are referred to as Level 2 accuracy specifications. Both Level 1 and Level 2 criteria shall be tested as defined in Annex A.

INFORMATIVE NOTE NIST's MINEX III program¹⁰ implements these tests [MINEX-III] – see Section A.6.

Off-card fingerprint authentication implementations shall be configured according to the specifications of Section 10.

This Section gives specifications for fingerprint sensors used for capture of single finger images. These sensors shall not be used for collection of images for use in the background check i.e., the specifications are unrelated to those of Section 2.3 which govern ten-print enrollment. This document does not establish specifications on performance of four-finger segmentation algorithms.

Fingerprint sensors used for PIV authentication shall conform to the FBI's Image Quality Specifications For Single Finger Capture Devices [SINGFING]. The [SINGFING] specification establishes minimum sizes for the imaging platen and for the scanning resolution.

[FIPS] allows (but does not require) Agencies to use on-card comparison (OCC) of fingerprint minutiae. This Section gives specifications for OCC for PIV. This specification includes enrollment data to be placed on the card, authentication data to be sent to the card, and OCC certification information. This Section also specifies the data structure for the storage of card parameters, and the procedure for preparation of OCC fingerprint minutiae templates from those for off-card comparisons.

[800-73] indicates where OCC data is stored and that this data is separate and different from the mandatory off-card comparison fingerprint templates. [800-73, Part 2] specifies the secure channel mechanisms to realize on-card comparison over the [FIPS]-specified interfaces.

NIST conducted two studies to support the use of on-card biometric comparison in identity management applications. ― The Secure Biometric Match on Card¹¹ activity engaged commercial providers to execute fingerprint authentication over a contactless interface within a specific time limit. The study required privacy protection via secured communication protocols and integrity protection using cryptographic signatures computed from the biometric data. In addition, the card was authenticated to the reader. The activity has been published as NIST Interagency Report 7452 [SBMOC]. ― The MINEX II evaluation was initiated to measure the core algorithmic speed and accuracy of fingerprint minutia matchers running on ISO/IEC 7816 smartcards. Conducted in phases, the test required card- and fingerprint matcher-provider teams to submit on-card comparison enabled cards. The latest results were reported in NIST Interagency Report 7477 [MINEX II]. The main attraction of on-card comparison has been that someone who finds a card has only a small chance of authenticating to it with fingerprints (related to the configured false match rate) – the fact that template data never leaves the card means that the attacker has no prior knowledge. See the related discussion in Section 5.4. In the off-card comparison world, the PIN entry requirement is used to mitigate this risk.

The PIV specification for on-card matching leverages international standards. Specifically, PIV Cards shall ― be prepared and used by executing the commands of ISO/IEC 7816-4:2005 [CARD-CMD] per [800-73, Part 2] ― embed the biometric data in the data structures defined in ISO/IEC 7816-11:2004 [CARD-BIO], ― use the core three-byte-per-minutia format defined in the ISO/IEC 19794-2:2011 [CARD-MIN] standard¹² (implementers may choose to prepare these from INCITS 378:2004 templates, as shown in Figure 3), and ― adopt certain defined constants from ISO/IEC 19785-3:2007.

For conversion ISO/IEC 19794-2:2011 PIV Card for On-Card

Parent fingerprint images:

Card Minutiae

Comparison

see Section 5.5

Section 3.2 Live capture, OR

Section 5.4

Section 3.4 ANSI/NIST Type 14, OR Section 3.4 ANSI/NIST Type 4, OR

INCITS 378:2004

PIV Card for Off-Card

Section 3.3 INCITS 381:2004

Minutiae

Comparison

Section 4.4

Figure 3 − Preparation of PIV Fingerprint Minutia Templates

This document recommends that different fingers should be imaged for off-card and on-card comparison. This mitigates an attack where off-card templates are stolen (after PIN release) and used to prepare spoofs via [REVFING] for use in on-card comparison (which is not preceded by PIN entry). This document nevertheless allows data from the same fingers in on-card and off-card comparison operations for two reasons. First is to mitigate a usability issue, namely that users might be confused as to which fingers should be presented. Second, there is always the possibility that fingerprints are stolen from other sources (including latent acquisition) and used in a spoof attack.

Each submitted card shall be populated with Biometric Information Templates (BITs) grouped under the BIT Group Template of Table 7 according to the requirements of [CARD-CMD, Tables 1 and 2]. The number of BITs shall be equal to 2, one for each finger.

Table 7 − BIT group template and profile

NORMATIVE NOTES:

Table 8 − ISO/IEC 19794-2 and ISO/IEC 19785-3 finger position codes

PIV readers involved in on-card and off-card authentication attempts shall heed Table 8 to correctly prompt users for which finger to present.

Note that the penultimate (i.e., FDIS) draft of ISO/IEC 19785-3:2007 erroneously set bit six to 1. The final standard and the PIV specification require that bits 6, 7 and 8 shall be 0.

This Section defines the data to be used for on-card comparison implementations. It is included here because ISO/IEC 19794-2:2011 [CARD-MIN] and its antecedents defined multiple variants¹³.

On-card comparison data in PIV shall conform to the ISO/IEC 19794-2:2011, Clause 9 compact on-card comparison format [CARD-MIN]. This format encodes the x and y coordinates, minutia type, and minutia angle of each minutia point in 3 bytes. This format also allows encoding of cores, deltas and ridge counts. Two cases exist: ― Data stored on-card (i.e., enrollment data): Neither this document nor [800-73] regulate what data must be stored on card; instead this specification only requires that the authentication instruction of [800-73, Part 2] shall be operable. Thus a card might validly be populated with minutiae, cores, and ancillary proprietary data. ― Data sent to card during operations (for comparison): This minutia data shall be included in the APDU specified in [800-73, Part 2] and shall consist of exactly 3N bytes from N minutia as specified in [CARD-MIN]. No leading tagged header information is necessary. Extended and proprietary data shall not be sent to the card. The BITs of Section 5.5.1 shall parameterize the production of templates that a reader, or other system, sends to the PIV Card – see Section 5.6.2. This applies to both the reference templates stored on the card, and those produced during, for example, an authentication transaction.

Existing PIV equipment produces (CBEFF-wrapped) [MINUSTD] instances of Table 6 for off-card comparison. An OCC process may choose to use such equipment in which case [CARD-MIN] data would appropriately be prepared from live [MINUSTD] templates via the non-trivial conversion of Figure 4. The conversion operation proceeds with a pruning operation (Sec. 5.6.2.1 and 5.6.2.2), a re-encoding (conversion of 8 bit to 6 bit minutia angle, conversion from 14 bit to 8 bit position coordinates), and a sorting operation (Sec. 5.6.2.3). The order matters here due to arithmetic rounding.

Figure 4 − Conversion of INCITS 378 to ISO/IEC 19794-2 card data

The number of minutiae sent to a PIV Card for on-card comparison is not limited by this document. However, the number may be subject to limits implied by the interface specifications of [800-73, Part 2].

INFORMATIVE NOTE 1 Leading commercial minutia detectors produce a median of 41 minutiae from plain impression images with the 5% and 95% quantiles being 24 and 61 respectively over four large operational single index finger datasets.

INFORMATIVE NOTE 2 A short-length APDU command constrains the maximum number of three-byte minutiae. Implementers should consult [800-73, Part 2] on the availability of command chaining [CARD-CMD] for larger templates.

Because some templates will naturally contain 0 minutiae (i.e., the algorithm does not find any), the (off-card) client shall respect the minimum number indicated by the card in its BIT structure. The client shall either terminate the minutia-based authentication attempt or prompt for (re-)presentation of one of the enrolled fingers.

Minutiae shall be removed according to the specifications of [CARD-MIN, Clause 9.3.2]. Note that because the parent [MINUSTD] template allows larger spatial extent (14 bit integers at 197 pixels cm-1 off card), very large fingers may yield minutiae outside the maximum possible spatial extent that can be encoded here (8 bit integers at 100 pixels cm-1 on card). The pruning mechanism of Sections 5.6.2.1 and 5.6.2.2 shall be used to remove such minutiae.

The BIT associated with the on-card comparison algorithm shall indicate how minutiae must be sorted according to the options extended in [CARD-MIN, Clause 9.4]. However, because single finger PIV images have widths of fewer than 500 pixels when scanned at 19.7 pixels mm-1, all possible minutiae coordinates shall be encoded in 8 bits, and the modulo sorting technique defined in [CARD-MIN] shall not be used.

INFORMATIVE NOTE Open-source INCITS 378 "C" code is maintained in http://www.nist.gov/itl/iad/ig/biomdi.cfm . On-card biometric comparison client software is here: http://www.nist.gov/itl/iad/ig/bioapp.cfm.

Minutia template generators and minutia matching algorithms used for on-card comparison shall perform according to the interoperability specifications of Section 5.7.3, and the accuracy specifications of Section 5.7.4. The accuracy specifications are intended to afford low operational error rates by assuring highly accurate matching in typical authentication scenarios.

NIST conducted tests of on-card comparison performance [MINEX-II]. Over four phases conducted between 2007 and 2010, the tests showed that four implementations would have attained the cross-provider interoperability specifications of Section 4.5.2.

In parallel, NIST's Secure Biometrics Match-on-Card program demonstrated cryptographic protection of the template data, and transactional durations below two seconds [SBMOC].

The core cross-vendor interoperability specification is met by establishing requirements on paired template generators and on-card matchers as described in the following two Sub-sections.

Template generators shall conform to the specification of Section 4.5.2.1 for off-card authentication (because on-card comparison templates are generated off-card). No additional conformance specifications are defined here.

A template matcher shall be certified if

The performance specifications shall be tested according to the test defined by Annex A modified to use [CARD-MIN] templates. This test shall conform to the requirements of the ISO/IEC 19795-7 testing standard.

INFORMATIVE NOTE NIST's MINEX IV program¹⁵ implements this test [MINEX-IV] – see Annex A.6.

To support operational authentication of PIV Card templates against live samples, a template generator and matcher-pair shall be certified if

The performance specifications shall be tested according to the test defined by Annex A.

INFORMATIVE NOTE NIST's MINEX IV program implements this test [MINEX-IV] – see Section A.6.

On-card comparison authentication implementations shall be configured according to the specifications of Section 10.

On-card comparison shall be implemented using the fingerprint sensors specified in Section 4.7.

[FIPS] establishes requirements on interfaces to OCC implementations.

This Section standardizes specifications for use of iris images as allowed by [FIPS]. The Section includes specifications ― for iris images stored on and off PIV Cards, ― for iris capture devices, and ― for components involved in automated recognition of PIV iris imagery. The specifications extend the format requirements of ISO/IEC 19794-6:2011 with image quality related properties. The capture device specifications concern imaging properties of the iris camera, and software interfaces around it. The recognition component is specified in terms of minimum authentication accuracy and processing speed.

This document makes no mention of an iris template. In iris recognition, templates are proprietary non-standardized mathematical encodings¹⁶ of information extracted from the formally standardized images that are defined in this document. Templates are not interoperable. Interoperability is achieved with standardized images. Agencies electing to retain only templates are vulnerable to supplier lock-in, and an inability to benefit from technology updates.

Iris recognition affords highly accurate recognition of individuals. It has been used both for 1:1 verification and 1:N identification [UKIRIS, IREX-III] and has proven stable [NEXUS, IREX-VI] for over a decade. Moreover, iris images can be compressed to achieve small sizes [IREX-I, IREX-IV] affording rapid transmission across band-limited networks and storage on identity credentials. This aspect is leveraged below.

Digital representations of rectilinear images of the human iris have been formally standardized as ISO/IEC 19794-6:2011 [IRISSTD]. This standard, which replaces earlier editions, is a necessary component in an interoperable marketplace of iris cameras and iris recognition algorithms. The standard is used because it includes specialized image formats that support compact storage¹⁷ on ISO/IEC 7816 Integrated Circuit cards. The PIV formats are shown in Figure 5.

Figure 5 − Image formats of ISO/IEC 19794-6:2011

Iris images on PIV Cards shall conform to the requirements expressed in the Table 9 profile of the ISO/IEC 19794-6:2011 standard. Where required values and practice are not stated, the underlying requirements of the base standard shall apply. The profile defines a standard record that contains one or two specialized iris images each of size around 3 kilobytes. These images shall follow the semantic requirements of Image Type 7 images defined in the standard. The objective of these specifications is to afford maximum possible iris accuracy, low storage requirements, and corresponding fast read times. These requirements include centering and masking of the eyelid and sclera regions (an example is shown in Figure 5, column B). The masked regions can be very efficiently compressed. This affords small record sizes and, vitally, preservation of the iris texture.

Table 9 − ISO/IEC 19794-6 profile for iris images stored on PIV Cards

NORMATIVE NOTES:

In cases where an Agency elects to place iris records on PIV Cards, there may be a few instances where iris images cannot be captured (for example, due to rare medical conditions). In these cases the Card should nevertheless be populated with the special "null" iris record of Table 10. This defines an empty but conformant instance of [IRISSTD] with an image of width and height equal to 1 pixel. The reason for doing this is to ensure that a cryptographically signed record exists on the PIV Card where it should. Implementations shall check the digital signature and shall reject all iris-based attempts at authentication

Table 10 − ISO/IEC 19794-6 profile for a null iris image stored on PIV Cards