Government smart card spec gets updated

The newest version of the Government Smart Card Interoperability Specification is critical to the General Services Administration's Smart Access Common ID contract. Although it provides some additional details that agencies have been clamoring for regarding the use of contactless cards and biometrics, the latest version is still lacking in some areas, experts say. The National Institute of Standards and Technology is developing the specification.

Version 2.1, released in July, includes several general improvements to the contact card interfaces and a new interface for contactless smart cards, which use radio signals to exchange data with a reader instead of requiring the user to swipe the card. The four companies on GSA's smart card contract are required to provide products and solutions that comply with the specification.

"The physical and logical access were the initial core applications, and the spec dealt with a contact card," said Mickey Femino, director of GSA's Center for Innovative Business Solutions. "A lot of agencies said the contact card is a little slow, and they would like to have contactless. This new version addresses that."

On the biometrics front, Version 2.1 supports the use of biometrics as part of agencies' authentication and credentialing efforts, but it doesn't mandate their use or detail the interoperability concerns associated with such tools, said Gordon Hannah, a senior manager at GSA contractor BearingPoint Inc.

"We also need to address how we protect the data both at rest and in transit," he said. "One other piece we may want to include in the spec is a way to authenticate the cards as government-issued."

Smart cards include a processor that can support an automatic challenge/response mechanism to verify their authenticity, but many agencies choose to supplement that check with a password and/or a biometric identifier, Hannah said. The NIST specification could add standards for agencies seeking assurance that a card from another agency is authentic.