What is PIV?
Personal Identity Verification (PIV) is the US federal government's standard for smart card credentials issued to federal employees and contractors. The standard is FIPS 201 (Federal Information Processing Standard 201), published by NIST. It was created in response to Homeland Security Presidential Directive 12 (HSPD-12), which called for a common, secure form of identification across federal agencies. A PIV card lets its holder enter federal buildings and sign in to federal computers and networks with the same credential.
What is on a PIV card
- Printed features: the holder's photo, name, agency and expiration date.
- A chip with both contact and contactless interfaces.
- Digital certificates and private keys for authentication, digital signatures and encryption, issued under a federal public key infrastructure (PKI).
- A card authentication credential for quick contactless use at door readers.
- Biometric data, such as fingerprint templates and a facial image, available for stronger identity checks.
- A PIN chosen by the holder, required before the private keys can be used for computer sign-in.
How PIV sign-in works
The user inserts the card into a smart card reader and enters the PIN. The PIN unlocks the private key stored on the chip, which answers a cryptographic challenge to prove the card is genuine. The computer validates the certificate chain, checks that the certificate is unexpired and not revoked, and maps it to the user's account. The private key never leaves the card. Because the user needs the card (something you have) and the PIN (something you know), PIV logon is multifactor authentication.
PIV compared with CAC and other cards
| Card | Who uses it | Notes |
|---|---|---|
| PIV | Federal civilian agency employees and contractors | Defined by FIPS 201 |
| CAC | US Department of Defense personnel | DoD's card, built to the same FIPS 201 standard |
| PIV-I | Non-federal organizations | PIV-Interoperable cards that federal systems can trust |
| Prox card | General building access | Contactless badge only, with no certificates or PIN |
Supporting PIV users
- Confirm the reader appears under Smart card readers in Device Manager and that the Windows Smart Card service is running.
- If certificates do not appear, reseat the card and check the reader driver and any required middleware.
- Too many incorrect PIN entries lock the card, and only an authorized issuer can unblock it. The help desk cannot treat it like a password reset.
- Expired or revoked certificates cause sign-in failures even when the card and PIN are correct.
- A card left in the reader is a risk. Windows can be configured through Group Policy to lock the workstation when the card is removed, which encourages users to take the card with them.
PIV on the CompTIA A+ exam
PIV is on the shared A+ acronym list. The authentication concepts behind it are mainly Core 2 material.
- If a question describes a federal employee badge with a chip, certificates and a PIN used for both door access and computer logon, think PIV.
- If the same description says military or DoD, think CAC.
- Card plus PIN is two factors; a card alone is a single factor.
- A smart card reader is the required hardware, and certificate problems are a common cause of failed sign-in.