[xcbf] X9.84 Revision - Meeting Minutes

[Phil Griffin <phil.griffin@asn-1.com>]

X9.84 Biometric Information Management and Security
Review

The X9F4 working group consisting of Jeff S., Phil
Griffin, Ersin D., Keith S., Pud R. and Larry H.
reviewed the proposed revisions for X9.84.

A. The encrypted data inside the privacy block will now
include a copy of the header to link the header to the
biometric data, and the header will also be in clear text
in the privacy object to remain consistent with the
integrity object.

B. The privacy objects are now a sequence of headers
and privacy blocks.  Headers are a sequence of one or
more header, privacy blocks are a sequence of one or
more privacy block, and by definition the header list
is in same order as the privacy block list.

C. The group discussed HP/Atalla's comment on using
Tamper Resistant Security Modules with Larry H.
It was decided to add level 3 physical security
requirement to both Verification and Identification,
upgrade Enrollment to level 3 (disallowing level 2),
and add clarification text that a TRSM is mandatory
for key management per X9 standards.  Also, the
minimal key lengths for integrity and privacy
should be specified.  The key strength is largely
dependent on the biometric life cycle which ends
in termination.

D. The group discovered that the section on
termination does not actually state that the
biometric data should be deleted at the end of
its life cycle.  The group agreed to add
requirements that biometric data should be
terminated at the end of its life cycle.

E. The group reviewed the discussion proved by
International Biometric Group (IBG) on error
rates and agreed to accept IBG's offer to
revise the related sections.

F. The working group decided to revise the
X9.84 standard and distribute the newly revised
draft standard with "track changes" to the X9F4
working group for a 30-day review.  Once the
comments have been resolved, the revised standard
will be issued for X9 and X9F ballot.