PIV

PIV -- Personal Identity Verification

Personal Identity Verification (PIV) is the US federal standard for smart card-based employee identification, defined by FIPS 201 and the technical specification NIST SP 800-73. PIV cards are issued to federal employees and contractors, providing multi-factor authentication for physical access to government buildings and logical access to computer systems and networks.

Card Architecture

A PIV card is a JavaCard or equivalent smart card carrying multiple X.509 certificates, RSA or ECC key pairs, and optional biometric templates (fingerprint minutiae and facial image). The card contains four mandatory certificates: PIV Authentication (for system login), Digital Signature (for signing emails and documents), Key Management (for encrypting communications), and Card Authentication (for contactless physical access). The PIV applet is identified by a standardized AID and responds to a defined set of APDU commands.

Authentication Methods

PIV supports multiple authentication mechanisms at different assurance levels. The card authentication key (9E) enables contactless tap-in access via ISO 14443 without requiring a PIN. The PIV authentication key (9A) requires PIN entry for network login, providing two-factor security (something you have + something you know). The optional on-card fingerprint matching provides three-factor authentication. FIPS 140 Level 2 certified cryptographic modules on the card ensure key operations meet federal security requirements.

Ecosystem and Interoperability

PIV is closely related to the CAC (Common Access Card) used by the Department of Defense. The PIV-I (PIV-Interoperable) specification extends PIV-compatible credentials to state, local, and commercial organizations. Smart card middleware such as OpenSC and vendor-specific PKCS#11 modules enable PIV cards to work with standard operating system login, VPN clients, and web browsers. The emerging PIV-D initiative supports derived credentials on mobile devices, bridging traditional contact-based smart card authentication to modern mobile platforms.