ISO/IEC 39794-2:2023/PRF Amd 1

• Status: Not Published
• ICS: 35.240.15 - Identification cards. Chip cards. Biometrics
• Technical Committee: ISO/IEC JTC 1/SC 37 - Biometrics
• Drafting Committee: ISO/IEC JTC 1/SC 37/WG 3 - Biometric data interchange formats
• Current Stage: 5020 - FDIS ballot initiated: 2 months. Proof sent to secretariat
• Start Date: 17-Sep-2026
• Completion Date: 10-Oct-2026

• Amends: ISO/IEC 39794-2:2023 - Information technology — Extensible biometric data interchange formats — Part 2: Finger minutiae data
• Effective Date: 27-Jan-2024

ISO/IEC 39794-2:2023/PRF Amd 1 is an ISO/IEC amendment to Information technology - Extensible biometric data interchange formats - Part 2: Finger minutiae data. It adds guidance for handling the on-card biometric comparison format, including enrolment and comparison behavior, retry counter handling, and security considerations for finger minutiae used with cards.

What does ISO/IEC 39794-2:2023/PRF Amd 1 specify?

ISO/IEC 39794-2:2023/PRF Amd 1 specifies changes to ISO/IEC 39794-2 for on-card biometric comparison using finger minutiae data. The amendment updates subclauses 8.3.1 and 8.3.9.1 and adds a new informative Annex E.

Part of the amendment	What it covers
Subclause 8.3.1	Adds a pointer to Annex E for use of on-card biometric comparison formats
Subclause 8.3.9.1	Adds default minutiae count values for enrolment, verification, and receivable maximum
Annex E	Informative guidance on enrolment, comparison, retry counter behavior, and security aspects

In practice, this amendment helps implementers align card-based fingerprint matching behavior with the data format rules in the main part of ISO/IEC 39794-2.

What are the key requirements of ISO/IEC 39794-2:2023/PRF Amd 1?

ISO/IEC 39794-2:2023/PRF Amd 1 focuses on how many minutiae to send, how to compare them, and how to control repeated attempts on a card. The most practical effect is that system designers must set policy values for enrolment, verification, and security rather than treating those choices as fixed.

Minutiae counts and default values

Subclause 8.3.9.1 adds default values for the minimum number of minutiae: 16 for enrolment and 12 for verification, with a receivable maximum of 60. In practice, this gives a baseline for interoperable implementations and means the signal processing side should not exceed what the card can receive.

Enrolment rules

Annex E states that the number of minutiae is security sensitive and depends on application policy. If a person does not meet the minimum number required for enrolment, the person cannot be enrolled. For implementers, that means enrolment logic must check whether the probe contains enough usable minutiae before continuing.

Comparison behavior

Annex E says biometric probe data may be affected by translation, rotation, and distortion. The comparison threshold must be chosen with the required FAR and FRR values in mind, and the comparison result is a similarity score. In practice, matching systems need tuning and test evidence, not just a yes/no decision.

Retry counter for on-card verification

Annex E requires a retry counter for on-card comparison. Negative verifications decrement the counter, positive verification resets it, and once it reaches zero the biometric verification method is blocked. The recommended initial value is between 5 and 15, so card issuers and application providers need a lockout policy and a reset process.

Security of probe transmission

Annex E warns that replay attacks are possible if probe data is intercepted and resent. It points to a trusted path between the interface device and the ICC, often using secure messaging according to ISO/IEC 7816-4. In practice, this means plain transmission of finger minutiae is not a safe design choice for on-card matching.

What terms does ISO/IEC 39794-2:2023/PRF Amd 1 use?

ISO/IEC 39794-2:2023/PRF Amd 1 uses a small set of operational terms that matter for implementation.

• On-card biometric comparison format - a mode where the card performs the biometric match itself.
• Finger minutiae data - the fingerprint feature data used for comparison and enrolment.
• Biometric probe data - the incoming fingerprint data presented to the card or matcher.
• Biometric reference - the stored comparison data used as the match target.
• Retry counter - the attempt counter that limits repeated negative verification tries.
• ICC - integrated circuit card, the card that performs or receives the biometric operation.
• Trusted path - a protected communication path between the interface device and the ICC.

Who uses ISO/IEC 39794-2:2023/PRF Amd 1?

ISO/IEC 39794-2:2023/PRF Amd 1 is used by biometric system designers, smart card application developers, card issuers, and security architects. It is also relevant to test laboratories and interoperability teams that need to verify matching behavior, default values, retry handling, and protected transmission of probe data. Quality managers and buyers use it to check whether a card-based fingerprint solution supports on-card comparison in a way that fits their security policy.

What changed in ISO/IEC 39794-2:2023/PRF Amd 1 from the previous edition?

ISO/IEC 39794-2:2023/PRF Amd 1 adds handling for the on-card biometric comparison format. It introduces default minutiae count values, adds Annex E with enrolment, comparison, retry counter, and security guidance, and links that annex from subclause 8.3.1.

Which standards are used with ISO/IEC 39794-2:2023/PRF Amd 1?

ISO/IEC 7816-4 is cited for secure messaging and the RESET RETRY COUNTER command used with the retry counter behavior. ISO/IEC 24787 is named in the security discussion for on-card biometric comparison. ISO/IEC 39794-2 is the base part that this amendment updates.

What does the ISO/IEC 39794-2:2023/PRF Amd 1 document contain?

The amendment contains targeted textual additions rather than a full rewrite. It changes subclause 8.3.1, updates subclause 8.3.9.1 with default minutiae values, and adds informative Annex E. Annex E is organized into enrolment, comparison, and security aspects, and it also includes a retry counter discussion and bibliography entries for a fingerprint match-on-card evaluation plan and ISO/IEC 7816-4.

International
Standard
ISO/IEC 39794-2
First edition
Information technology —
2023-09
Extensible biometric data
interchange formats —
AMENDMENT 1
Part 2:
Finger minutiae data
AMENDMENT 1: Handling of the on-
card biometric comparison format
PROOF/ÉPREUVE
Reference number
ISO/IEC 39794-2/Amd. 1:2026(en) © ISO/IEC 2026

ISO/IEC 39794-2/Amd. 1:2026(en)
© ISO/IEC 2026
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
PROOF/ÉPREUVE
© ISO/IEC 2026 – All rights reserved
ii
ISO/IEC 39794-2/Amd. 1:2026(en)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical activity.
ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations,
governmental and non-governmental, in liaison with ISO and IEC, also take part in the work.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of document should be noted. This document was drafted in accordance with the editorial rules of the ISO/
IEC Directives, Part 2 (see www.iso.org/directives or www.iec.ch/members_experts/refdocs).
ISO and IEC draw attention to the possibility that the implementation of this document may involve the
use of (a) patent(s). ISO and IEC take no position concerning the evidence, validity or applicability of any
claimed patent rights in respect thereof. As of the date of publication of this document, ISO and IEC had not
received notice of (a) patent(s) which may be required to implement this document. However, implementers
are cautioned that this may not represent the latest information, which may be obtained from the patent
database available at www.iso.org/patents and https://patents.iec.ch. ISO and IEC shall not be held
responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO's adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT) see www.iso.org/iso/foreword.html.
In the IEC, see www.iec.ch/understanding-standards.
This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 37, Biometrics.
Any feedback or questions on this document should be directed to the user’s national standards
body. A complete listing of these bodies can be found at www.iso.org/members.html and
www.iec.ch/national-committees.
PROOF/ÉPREUVE
© ISO/IEC 2026 – All rights reserved
iii
ISO/IEC 39794-2/Amd. 1:2026(en)
Information technology — Extensible biometric data
interchange formats —
Part 2:
Finger minutiae data
AMENDMENT 1: Handling of the on-card biometric comparison
format
Subclause 8.3.1
Add the following text:
Annex E gives information on using the on-card biometric comparison formats.

Subclause 8.3.9.1
Add the following text:
The default value for the minimum number of minutiae required for enrolment is 16 and for verification is
12. The default value for the receivable maximum number of minutiae for enrolment and verification is 60.

Add the following informative Annex E to ISO/IEC 39794-2.
PROOF/ÉPREUVE
© ISO/IEC 2026 – All rights reserved
ISO/IEC 39794-2/Amd. 1:2026(en)
Annex E
(informative)
Handling of the on-card biometric comparison format
E.1 Enrolment
E.1.1 Number of minutiae
The number of minutiae is a security sensitive parameter and depending on the security policy of the
application. Persons who
...

ISO/IEC 39794-2/:2023/PRF Amd. 1:2026(en)
ISO/IEC JTC 1/SC 37/WG 3
Secretariat: ANSI
Date: 2026-07-21xx
Information technology — Extensible biometric data interchange
formats — —
Part 2:
Finger minutiae data — AMD
AMENDMENT 1: Handling of the on-card biometric comparison format
PROOF
© ISO/IEC 2026
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication
may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying,
or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO
at the address below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: + 41 22 749 01 11
EmailE-mail: [e-mail]
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2026 – All rights reserved
ii
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are members
of ISO or IEC participate in the development of International Standards through technical committees
established by the respective organization to deal with particular fields of technical activity. ISO and IEC
technical committees collaborate in fields of mutual interest. Other international organizations, governmental
and non-governmental, in liaison with ISO and IEC, also take part in the work.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of
document should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC
Directives, Part 2 (see www.iso.org/directives or www.iec.ch/members_experts/refdocs).
ISO and IEC draw attention to the possibility that the implementation of this document may involve the use of
(a) patent(s). ISO and IEC take no position concerning the evidence, validity or applicability of any claimed
patent rights in respect thereof. As of the date of publication of this document, ISO and IEC had not received
notice of (a) patent(s) which may be required to implement this document. However, implementers are
cautioned that this may not represent the latest information, which may be obtained from the patent database
available at www.iso.org/patents and https://patents.iec.ch. ISO and IEC shall not be held responsible for
identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO's adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT) see www.iso.org/iso/foreword.html.
In the IEC, see www.iec.ch/understanding-standards.
This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 37, Biometrics.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html and www.iec.ch/national-
committees.
© ISO/IEC 2026 – All rights reserved
iii
Information Technology technology — Extensible biometric data
interchange formats — —
Part 2:
Finger minutiae data — Amendment
AMENDMENT 1: Handling of the on-card biometric comparison format

Subclause 8.3.1
Add the following text:
Annex E gives information on using the on-card biometric comparison formats.

Subclause 8.3.9.1
Add the following text:
The default value for the minimum number of minutiae required for enrolment is 16 and for verification is 12.
The default value for the receivable maximum number of minutiae for enrolment and verification is 60.

Add the following informative Annex E to ISO/IEC 39794-2.
© ISO/IEC 2026 – All rights reserved
Annex E
(informative)
Handling of the on-card biometric comparison format
E.1 Enrolment
E.1.1 Number of minutiae
The number of minutiae is a security sensitive parameter and depending on th
...