PIV and CAC

PIV (Personal Identity Verification) is the US federal standard for employee and contractor ID cards, defined in FIPS 201 with the card interface in NIST SP 800-73. The Department of Defense's CAC (Common Access Card) is a close relative. The PIV applet has also become a general standard, so plenty of non-government smart cards and YubiKeys implement it too.

#What's on the card

A PIV card is a public-key card with several key "slots", each for a different job:

Slot	Key	Used for
9A	PIV Authentication	logging in to computers and networks (PIN required)
9C	Digital Signature	signing documents and email (PIN every time)
9D	Key Management	decrypting email and files
9E	Card Authentication	physical access: quick door checks, no PIN

It also carries signed data objects: identifiers, a facial image, fingerprint templates, and the certificates for each key.

PIV cards are dual-interface: there are gold contacts for a card reader and an antenna for contactless taps. Over contactless, the card only exposes a limited set of things (like the Card Authentication key) unless the reader sets up an encrypted session first.

#Reading a number vs checking a card

At a door, a PIV card can be used two very different ways:

• The old way: the reader pulls an identifier off the card and passes it to the controller, often over Wiegand. That's identification, and it throws away everything PIV is good at.
• The PKI way: the reader challenges the card to sign with its Card Authentication key, then checks the signature and the certificate chain. That's real authentication. US federal guidance has pushed hard toward this for physical access.

With USB NFC reader

PIV cards work with ordinary PC/SC readers. Tools like OpenSC's piv-tool and pkcs15-tool can list the certificates on your own card.

With Your phone

NXP TagInfo identifies a PIV card as an ISO 14443-4 smart card and lists the applications it advertises.