HID Global's pivCLASS Government Solutions portfolio enables facilities to upgrade their existing physical access control system (PACS) to achieve FIPS 201 compliance. The pivCLASS contactless readers (R10 and R40) and their proximity-enabled versions deliver the "Controlled" assurance level defined in the National Institute of Standards and Technology (NIST) SP 800-116 guidelines when used with the pivCLASS Authentication Module (PAM) to perform a single-factor authentication check.
CHUID + VIS Authentication – The pivCLASS system tests the signature on the PIV Card Holder Unique IDentifier (CHUID) data object. The CHUID signature check ensures the card is authentic (came from a valid issuer) and has integrity (has not been altered). Because the CHUID is a “free read” and will be transmitted unencrypted to any reader, it could be possible for perpetrators to capture a PIV card's CHUID and create a counterfeit card. However, the required visual check (VIS) of the card secures against this threat by making it possible to identify cards that have been counterfeited or altered. *
CAK Authentication – The full duplex version of these pivCLASS readers work with the PAM to perform a PKI challenge-response test in addition to a signature check to validate the card authentication key (CAK). The challenge-response test ensures the public key in the card authentication certificate is bound to the private key on the card. This CAK authentication secures against cards that have been counterfeited, altered, copied or cloned. The half-duplex version of these readers supports the OSDP protocol to half duplex authentication modules. These pivCLASS readers are guaranteed to meet the stringent specifications for operation, reliability, and interoperability with other Genuine HID™ products.