Understanding HSPD-12 ID Cards

Homeland Security Presidential Directive 12 (HSPD-12) announced by President Bush in August 2004 is a federal mandate for the standardization of credentials for all US Federal employees and contractors.  The goals of the directive include: increasing the security and efficiency of Government agencies, reducing identity fraud and terrorist threats, and protecting the privacy of workers and contractors across all agencies.

With respect to identity verification, the FIPS 201 (Federal Information Processing Standard) publication describes the standard for the PIV (Personal Identity Verification) of US Federal employees and contractors.  PIV is split into two parts; PIV-I describes the control objectives and security needs of HSPD-12, while PIV-II describes the technical interoperability requirements.

In summary, the HSPD-12 directive covers :

• Registration requirements for card holders, including identity proofing.

• Card issuance and maintenance requirements.

• Privacy requirements.

The system will employ the following security measures in use :

• Biometrics stored on the PIV card will be used to identify the person, and allow access to both facilities and information services. The minimum requirement is for a full set of fingerprints, of which two biometric fingerprints are to be stored on the card. Additional biometrics such as face recognition may be required by certain Federal Agencies, though these do not necessarily need to be stored on the card.
• A PIN number will be used in addition to biometrics.
• The card will use at least one Visual Security feature, such as Holograms, Watermarks, or Optically varying structures.
• The cardholder is identified with a CHUID (Cardholder Unique Identifier) which is secure data stored on the card to uniquely identify each individual.
• A very high level of encryption for the card data is required, including PKI (Public Key Infrastructure), which is the standard used for securing high levels of financial transactions.