ISO/IEC 39794-2:2023/Amd 1:2026

• Status: Published
• Publication Date: 03-Nov-2026
• ICS: 35.240.15 - Identification cards. Chip cards. Biometrics
• Technical Committee: ISO/IEC JTC 1/SC 37 - Biometrics
• Drafting Committee: ISO/IEC JTC 1/SC 37/WG 3 - Biometric data interchange formats
• Current Stage: 6060 - International Standard published
• Start Date: 04-Nov-2026
• Completion Date: 04-Nov-2026

• Amends: ISO/IEC 39794-2:2023 - Information technology — Extensible biometric data interchange formats — Part 2: Finger minutiae data
• Effective Date: 27-Jan-2024

ISO/IEC 39794-2:2023/Amd 1 is an amendment published by ISO and IEC for the finger minutiae data part of the extensible biometric data interchange formats series. It adds guidance for handling the on-card biometric comparison format and updates the default minutiae limits used for enrolment and verification. It is aimed at biometric system designers, smart card implementers, and anyone specifying or testing on-card fingerprint comparison.

What does ISO/IEC 39794-2:2023/Amd 1 specify?

ISO/IEC 39794-2:2023/Amd 1 specifies changes to ISO/IEC 39794-2:2023 for on-card biometric comparison using finger minutiae data. The amendment adds text to subclause 8.3.1 and 8.3.9.1 and introduces a new informative Annex E.

Annex	What it covers
E (informative)	Handling of the on-card biometric comparison format, including enrolment, comparison, retry counters, and security aspects

In practice, this amendment is the part of the document that tells implementers how the card-side comparison process should be handled when minutiae are sent to a card for verification.

What are the key requirements of ISO/IEC 39794-2:2023/Amd 1?

ISO/IEC 39794-2:2023/Amd 1 focuses on the minutiae counts, comparison behaviour, retry handling, and the security of sending probe data to the card. The main points matter because they affect whether a card accepts a user, how often a user can try again, and how resistant the system is to attack.

Minutiae counts and default values

Subclause 8.3.9.1 sets default values for the minimum number of minutiae required for enrolment and verification, and for the receivable maximum number of minutiae. Annex E explains that the minimum number is security sensitive and can affect false matches and false non-matches.

In practice, the system must enforce a minimum quality and quantity of minutiae before enrolment or verification can succeed. The signal processing subsystem also needs to limit how many minutiae are sent to the card so that the card can handle them.

Enrolment behaviour

Annex E says a person who does not meet the minimum required number of minutiae cannot be enrolled. It also says the number of finger presentations needed during enrolment depends on the enrolment system.

This means implementers must design enrolment policy around the application’s security policy and user experience, rather than assuming a fixed number of scans will always be enough.

Comparison conditions and decision threshold

Annex E describes biometric probe data as subject to translation, rotation, and distortion. It also says the decision threshold has to take the required FAR and FRR into account.

In practice, the matching system must tolerate normal finger placement variation, and the chosen threshold must balance false acceptances and false rejections for the application.

Retry counter for on-card verification

Annex E requires a retry counter for on-card comparison. It is decremented by negative verifications and restored by positive verification, and verification is blocked when the counter reaches zero.

For implementers, this is the control that limits repeated trials. The annex also says the initial value is recommended to lie between 5 and 15, and it can be reset if the system supports it.

Security of probe transmission

Annex E warns about replay attacks if probe data is accepted in plain text. It says a trusted path between the ICC and the interface device is often achieved by cryptographic means such as secure messaging according to ISO/IEC 7816-4.

This matters because the probe data can be reused by an attacker if it is intercepted. The annex also notes the risk of latent fingerprints on the card surface, but it does not prescribe specific countermeasures.

What terms does ISO/IEC 39794-2:2023/Amd 1 define?

• Biometric probe - the finger minutiae data presented to the card for comparison.
• Biometric reference - the stored biometric data used as the comparison target.
• False acceptance rate (FAR) - the rate of accepting an impostor, used when setting the decision threshold.
• False rejection rate (FRR) - the rate of rejecting a genuine user, also used when setting the decision threshold.
• Retry counter - the card-side counter that limits repeated verification attempts.
• Integrated circuit card (ICC) - the card involved in on-card biometric comparison.
• Secure messaging - a cryptographic method used to protect communication between the interface device and the ICC.
• Replay attack - an attack in which intercepted probe data is sent again to the ICC.

Who uses ISO/IEC 39794-2:2023/Amd 1?

ISO/IEC 39794-2:2023/Amd 1 is used by teams that build or evaluate fingerprint-on-card systems. That includes biometric algorithm developers, smart card and reader implementers, security architects, and interoperability test laboratories.

It is also relevant to application providers that set security policy, choose retry limits, and decide how enrolment and verification should behave in practice. Quality and procurement teams can use it to check that a product supports the expected on-card comparison behaviour and related security controls.

What changed in ISO/IEC 39794-2:2023/Amd 1 from the previous edition?

ISO/IEC 39794-2:2023/Amd 1 adds on-card biometric comparison guidance to ISO/IEC 39794-2:2023. The amendment introduces informative Annex E, adds a reference to Annex E in subclause 8.3.1, and sets default values in 8.3.9.1 for the minimum and receivable maximum number of minutiae for enrolment and verification. It also adds bibliography entries for a MINEX II evaluation plan and for ISO/IEC 7816-4.

Which standards are used with ISO/IEC 39794-2:2023/Amd 1?

• ISO/IEC 39794-2:2023 - the base finger minutiae data format that this amendment modifies.
• ISO/IEC 24787 - named in Annex E as the context for on-card biometric comparison.
• ISO/IEC 7816-4 - provides the RESET RETRY COUNTER command and secure messaging mentioned for card communication.

What does the ISO/IEC 39794-2:2023/Amd 1 document contain?

ISO/IEC 39794-2:2023/Amd 1 contains amendment text to subclause 8.3.1 and 8.3.9.1, plus a new informative Annex E. Annex E is organised into enrolment, comparison, and security topics, with guidance on minutiae counts, finger presentation counts, comparison scoring, retry counter handling, replay-attack risk, and trusted-path communication.

The document also updates the bibliography with a performance-related reference and ISO/IEC 7816-4. Overall, the amendment is a practical implementation guide for on-card fingerprint comparison within the finger minutiae data format.

International
Standard
ISO/IEC 39794-2
First edition
Information technology —
2023-09
Extensible biometric data
interchange formats —
AMENDMENT 1
2026-11
Part 2:
Finger minutiae data
AMENDMENT 1: Handling of the on-
card biometric comparison format
Reference number
ISO/IEC 39794-2:2023/Amd. 1:2026(en) © ISO/IEC 2026

ISO/IEC 39794-2:2023/Amd. 1:2026(en)
© ISO/IEC 2026
All rights reserved.
This ISO publication is protected by copyright and is owned by ISO and/or its licensors.
The content of this ISO publication is provided under licence, not sold. Use is subject to the applicable licence terms issued by ISO,
an ISO member body, or an authorized third-party distributor.
Except as required for implementation or expressly permitted by a separate licence, no part of this ISO publication may be
reproduced, distributed, modified, used, or made available in any form or by any means – electronic or mechanical, including
photocopying, scanning, recording, or posting on internal or external digital platforms.
Any use beyond the scope of the granted rights is prohibited and may result in legal action.
ISO copyright office
CP 401 • CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2026 – All rights reserved
ii
ISO/IEC 39794-2:2023/Amd. 1:2026(en)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical activity.
ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations,
governmental and non-governmental, in liaison with ISO and IEC, also take part in the work.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of document should be noted. This document was drafted in accordance with the editorial rules of the ISO/
IEC Directives, Part 2 (see www.iso.org/directives or www.iec.ch/members_experts/refdocs).
ISO and IEC draw attention to the possibility that the implementation of this document may involve the
use of (a) patent(s). ISO and IEC take no position concerning the evidence, validity or applicability of any
claimed patent rights in respect thereof. As of the date of publication of this document, ISO and IEC had not
received notice of (a) patent(s) which may be required to implement this document. However, implementers
are cautioned that this may not represent the latest information, which may be obtained from the patent
database available at www.iso.org/patents and https://patents.iec.ch. ISO and IEC shall not be held
responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO's adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT) see www.iso.org/iso/foreword.html.
In the IEC, see www.iec.ch/understanding-standards.
This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 37, Biometrics.
Any feedback or questions on this document should be directed to the user’s national standards
body. A complete listing of these bodies can be found at www.iso.org/members.html and
www.iec.ch/national-committees.

© ISO/IEC 2026 – All rights reserved
iii
ISO/IEC 39794-2:2023/Amd. 1:2026(en)
Information technology — Extensible biometric data
interchange formats —
Part 2:
Finger minutiae data
AMENDMENT 1: Handling of the on-card biometric comparison
format
Subclause 8.3.1
Add the following text:
Annex E gives information on using the on-card biometric comparison formats.

Subclause 8.3.9.1
Add the following text:
The default value for the minimum number of minutiae required for enrolment is 16 and for verification is
12. The default value for the receivable maximum number of minutiae for enrolment and verification is 60.

Add the following informative Annex E to ISO/IEC 39794-2.

© ISO/IEC 2026 – All rights reserved
ISO/IEC 39794-2:2023/Amd. 1:2026(en)
Annex E
(informative)
Handling of the on-card biometric comparison format
E.1 Enrolment
E.1.1
...