ISO/IEC 39794-2:2023/PRF Amd 1

• Status: Not Published
• ICS: 35.240.15 - Identification cards. Chip cards. Biometrics
• Technical Committee: ISO/IEC JTC 1/SC 37 - Biometrics
• Drafting Committee: ISO/IEC JTC 1/SC 37/WG 3 - Biometric data interchange formats
• Current Stage: 5020 - FDIS ballot initiated: 2 months. Proof sent to secretariat
• Start Date: 17-Sep-2026
• Completion Date: 26-Sep-2026

• Amends: ISO/IEC 39794-2:2023 - Information technology — Extensible biometric data interchange formats — Part 2: Finger minutiae data
• Effective Date: 27-Jan-2024

Overview

ISO/IEC 39794-2:2023/PRF Amd 1 is an amendment to the international standard for extensible biometric data interchange formats, specifically covering finger minutiae data. This amendment focuses on enhancing guidance for handling the on-card biometric comparison format. Created by ISO/IEC Joint Technical Committee JTC 1/SC 37 for biometrics, it provides practical information for implementers on best practices and security considerations related to storing, processing, and comparing biometric data directly on smart cards. The update helps ensure interoperability, consistent security levels, and reliable performance across biometric systems utilizing finger minutiae.

Key Topics

• Handling On-Card Biometric Comparison:
  The amendment addresses the format and process for on-card comparison, crucial for match-on-card fingerprint authentication.

• Minutiae Parameters:

  • Minimum and maximum number of minutiae for enrolment and verification are specified:
    • Default minimum: 16 for enrolment, 12 for verification
    • Receivable maximum: 60 for both
  • These thresholds impact system security and resistance to false matches.

• Enrolment and Verification:

  • System-dependent requirements for finger presentations during enrolment
  • Minimum required minutiae must meet security policy standards
  • Biometric probe data must meet default or policy-specific thresholds

• Comparison Process:

  • Probe data is subject to translation, rotation, and distortion considerations
  • The standard discusses handling False Acceptance Rate (FAR) and False Rejection Rate (FRR)

• Retry Counters:

  • To improve security, a retry counter limits the number of unsuccessful verifications (typically set between 5 and 15 attempts).
  • This counter helps prevent brute-force and replay attacks

• Security Considerations:

  • Highlights importance of securing communication between card and interface device, recommending cryptographic measures and secure messaging (referencing ISO/IEC 7816-4)
  • Discusses the potential vulnerability to replay attacks and the need for authentication of biometric data transfers
  • Notes the risk of latent fingerprints on card surfaces and acknowledges but does not prescribe mitigation measures

Applications

This standard amendment is highly relevant for industries and solutions relying on fingerprint biometrics with smart cards:

• Identity and Access Management:
  Organizations can securely assign and verify user identities using match-on-card biometric systems.

• National ID and e-Passport Programs:
  Governments and border agencies benefit from standardized biometric comparison mechanisms for identity verification.

• Banking and Payment Systems:
  Financial services can apply the guidance to enhance security in biometric card authentication workflows.

• Physical and Logical Access Control:
  Enterprises use these guidelines to manage employee authentication and secure facility entry points.

• Healthcare and Social Services:
  Secure patient or beneficiary identification using fingerprint data on smart health cards.

Related Standards

For robust implementation of on-card biometric comparison and secure minutiae handling, the following standards are directly related:

• ISO/IEC 39794-2: Information technology - Extensible biometric data interchange formats - Part 2: Finger minutiae data (the base standard)
• ISO/IEC 7816-4: Identification cards - Integrated circuit cards - Organization, security and commands for interchange
• ISO/IEC 24787: Addresses trusted paths for on-card biometric comparison
• NIST Interagency Report 7485 (MINEX II): Provides evaluation plans for fingerprint match-on-card algorithms

This amendment plays a crucial role in enabling secure, interoperable, and standardized biometric data exchange, enhancing both the security architecture and practical usability for smart card-based biometric verification systems.

International
Standard
ISO/IEC 39794-2
First edition
Information technology —
2023-09
Extensible biometric data
interchange formats —
AMENDMENT 1
Part 2:
Finger minutiae data
AMENDMENT 1: Handling of the on-
card biometric comparison format
PROOF/ÉPREUVE
Reference number
ISO/IEC 39794-2/Amd. 1:2026(en) © ISO/IEC 2026

ISO/IEC 39794-2/Amd. 1:2026(en)
© ISO/IEC 2026
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
PROOF/ÉPREUVE
© ISO/IEC 2026 – All rights reserved
ii
ISO/IEC 39794-2/Amd. 1:2026(en)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical activity.
ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations,
governmental and non-governmental, in liaison with ISO and IEC, also take part in the work.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of document should be noted. This document was drafted in accordance with the editorial rules of the ISO/
IEC Directives, Part 2 (see www.iso.org/directives or www.iec.ch/members_experts/refdocs).
ISO and IEC draw attention to the possibility that the implementation of this document may involve the
use of (a) patent(s). ISO and IEC take no position concerning the evidence, validity or applicability of any
claimed patent rights in respect thereof. As of the date of publication of this document, ISO and IEC had not
received notice of (a) patent(s) which may be required to implement this document. However, implementers
are cautioned that this may not represent the latest information, which may be obtained from the patent
database available at www.iso.org/patents and https://patents.iec.ch. ISO and IEC shall not be held
responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO's adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT) see www.iso.org/iso/foreword.html.
In the IEC, see www.iec.ch/understanding-standards.
This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 37, Biometrics.
Any feedback or questions on this document should be directed to the user’s national standards
body. A complete listing of these bodies can be found at www.iso.org/members.html and
www.iec.ch/national-committees.
PROOF/ÉPREUVE
© ISO/IEC 2026 – All rights reserved
iii
ISO/IEC 39794-2/Amd. 1:2026(en)
Information technology — Extensible biometric data
interchange formats —
Part 2:
Finger minutiae data
AMENDMENT 1: Handling of the on-card biometric comparison
format
Subclause 8.3.1
Add the following text:
Annex E gives information on using the on-card biometric comparison formats.

Subclause 8.3.9.1
Add the following text:
The default value for the minimum number of minutiae required for enrolment is 16 and for verification is
12. The default value for the receivable maximum number of minutiae for enrolment and verification is 60.

Add the following informative Annex E to ISO/IEC 39794-2.
PROOF/ÉPREUVE
© ISO/IEC 2026 – All rights reserved
ISO/IEC 39794-2/Amd. 1:2026(en)
Annex E
(informative)
Handling of the on-card biometric comparison format
E.1 Enrolment
E.1.1 Number of minutiae
The number of minutiae is a security sensitive parameter and depending on the security policy of the
application. Persons who
...

ISO/IEC 39794-2/:2023/PRF Amd. 1:2026(en)
ISO/IEC JTC 1/SC 37/WG 3
Secretariat: ANSI
Date: 2026-07-21xx
Information technology — Extensible biometric data interchange
formats — —
Part 2:
Finger minutiae data — AMD
AMENDMENT 1: Handling of the on-card biometric comparison format
PROOF
© ISO/IEC 2026
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication
may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying,
or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO
at the address below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: + 41 22 749 01 11
EmailE-mail: [e-mail]
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2026 – All rights reserved
ii
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are members
of ISO or IEC participate in the development of International Standards through technical committees
established by the respective organization to deal with particular fields of technical activity. ISO and IEC
technical committees collaborate in fields of mutual interest. Other international organizations, governmental
and non-governmental, in liaison with ISO and IEC, also take part in the work.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of
document should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC
Directives, Part 2 (see www.iso.org/directives or www.iec.ch/members_experts/refdocs).
ISO and IEC draw attention to the possibility that the implementation of this document may involve the use of
(a) patent(s). ISO and IEC take no position concerning the evidence, validity or applicability of any claimed
patent rights in respect thereof. As of the date of publication of this document, ISO and IEC had not received
notice of (a) patent(s) which may be required to implement this document. However, implementers are
cautioned that this may not represent the latest information, which may be obtained from the patent database
available at www.iso.org/patents and https://patents.iec.ch. ISO and IEC shall not be held responsible for
identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO's adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT) see www.iso.org/iso/foreword.html.
In the IEC, see www.iec.ch/understanding-standards.
This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 37, Biometrics.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html and www.iec.ch/national-
committees.
© ISO/IEC 2026 – All rights reserved
iii
Information Technology technology — Extensible biometric data
interchange formats — —
Part 2:
Finger minutiae data — Amendment
AMENDMENT 1: Handling of the on-card biometric comparison format

Subclause 8.3.1
Add the following text:
Annex E gives information on using the on-card biometric comparison formats.

Subclause 8.3.9.1
Add the following text:
The default value for the minimum number of minutiae required for enrolment is 16 and for verification is 12.
The default value for the receivable maximum number of minutiae for enrolment and verification is 60.

Add the following informative Annex E to ISO/IEC 39794-2.
© ISO/IEC 2026 – All rights reserved
Annex E
(informative)
Handling of the on-card biometric comparison format
E.1 Enrolment
E.1.1 Number of minutiae
The number of minutiae is a security sensitive parameter and depending on th
...