Personal Identity Verification Guide Introduction

These Personal Identity Verification (PIV) Guides are intended to help you implement common PIV configurations at your organization. These guides are open source and a work in progress and we welcome contributions from our colleagues.

The guides focus on using PIV credentials for logical access such as authenticating to networks or applications or digitally signing and encrypting. Using PIV for physical access is available in the PACS Guide.

If you cannot find a particular topic, it may still be in development. Review the Issues for questions and lessons that are in progress. Create a new Issue to ask a question or share information with others.

Read on to learn more about PIV credentials.

What Is a PIV Credential?

A PIV credential is a U.S. federal government-wide credential used to access federally controlled facilities and information systems at the appropriate security level.

PIV credentials have certificates and key pairs, pin numbers, biometrics like fingerprints and pictures, and other unique identifiers. When these items are put together in a PIV credential, the credential provides the capability to implement multifactor authentication for networks, applications, and buildings.

What Information Is in These PIV Guides?

First, we cover the basics of PIV credentials, including:

• What PIV is, contains, and looks like;
• The basics of getting started with PIV credentials; and
• Using PIV for network authentication (smart card logon).

We also cover applications and guidance for developers and users—which need your input!

Why Is PIV Usage Important?

Agency security is enhanced when PIV credentials are used for authentication to agency systems and facilities. PIV credentials allow for a high level of assurance in the individuals who that access your resources, because the credentials are only issued by trusted providers to individuals who that have been verified in person. PIV credentials are highly resistant to identity fraud, tampering, counterfeiting, and exploitation.

PIV credentials are standardized as well. PIV credentials might be issued by different organizations using different commercial or open source products, on different form factors (cards, mobile devices, etc.). However, PIV credentials are standardized—every PIV credential is required to have specific information, using technology that is interoperable.

Your PIV credential from one agency will have the same basic required format, information, and technology as a PIV credential from your partner agencies. This allows us to trust each other, share applications, and architect and implement systems using common patterns for authentication.

What Systems Should Use PIV?

Any system at your organization that requires heightened security for determining who should gain access can and should use PIV for authentication. While PIV credentials can be used for authentication on almost any system, they are especially useful for systems that protect sensitive information.

PIV should be used for:

• All authentication for all privileged users, including servers, networks, and applications;
• All network authentication for all users;
• All application authentication for all users of an application that protects or contains sensitive information; and
• Access to facilities and buildings.

Where Can I Find the Standards?

Review the information on this site if you are interested in PIV credentials or work on using PIV credentials.

If you are interested in the bits and bytes of PIV credentials, you can review the standards (see below), particularly if you develop products such as hardware or software that are specific to PIV credentials for the U.S. federal government. (For most users and engineers, the standards may be too detailed for your needs.)

To review the standards, there is a National Institute of Standards and Technology (NIST) website with all PIV-related standards. Here are links to some of the most common standards:

• FIPS 201 specifies the issuance and management of PIV credentials.
• NIST Special Publication 800-73, “Interfaces for Personal Identity Verification” specifies the interface and data elements of PIV credentials.
• NIST Special Publication 800-76, “Biometric Data Specification for Personal Identity Verification” specifies the technical acquisition and formatting requirements for biometric data of PIV credentials.

How Can I Test a PIV Card?

The Card Conformance Tool (CCT) can remotely test PIV and Personal Identity Verification–Interoperable (PIV-I) on several common operating systems. The purpose of the CCT is to validate that commercially available PIV and PIV-I comply with relevant standards.