May 15, 2008 

NSTC Subcommittee on Biometrics and Identity Management Standards and Conformity Assessment Working Group Approved Disposition of Comments Template for Public Review of Registry (February 8, 2008 -March 10, 2008) 

# SOURC 

E 

TYP 

E 

PAG 

E 

PAR 

A 

LINE COMMENT RATIONALE 

1. DoD Edit 0 Recommend expanding all acronyms on first 

use. 

Although there is a listing of acronyms, most acronyms found within the document are not expanded thus requiring the reader to constantly refer to the listing of acronyms. 

2. DoD Edit 0 Recommend having two spaces separate 

sentences, the paragraph marking with the title, and between a colon and the text following a colon 

Format. 

3. DoD Edit 2 2 1 Recommend changing “USG wide” to read 

“USG-wide”. 

Consistency and grammar. The other instance in this document, which is correct, for the use of thterm was “USG-wide.” 

4. DoD Edit 2 2 11 Recommend deleting the comma at the end of 

the first bullet. 

Grammar. 

5. DoD Edit 2 2 12 Recommend deleting the “, and” at the end of 

the second bullet. 

Grammar. 

6. DoD Edit 2 2 11 Recommend deleting the period at the end of 

the third bullet. 

Grammar. 

7. DoD Edit 3 2 21 Recommend deleting the comma at the end of 

the first bullet. 

Grammar. 

8. DoD Edit 3 2 22 Recommend deleting the comma at the end of 

the second bullet. 

Grammar. 

9. DoD Edit 3 2 23 Recommend deleting the comma at the end of 

the third bullet. 

Grammar. 

10. DoD Edit 3 2 25 Recommend deleting the “, and” at the end of 

the fifth bullet. 

Grammar. 

11. DoD Edit 3 2 26 Recommend deleting the period at the end of 

the third bullet. 

Grammar. 

12. DoD Edit 3 3 5 Recommend deleting the semi-colon at the 

end of the first bullet. 

Grammar. 

13. DoD Edit 3 3 10 Recommend deleting the semi-colon at the 

end of the second bullet. 

Grammar. 

06/05/2008 19 
May 15, 2008 

NSTC Subcommittee on Biometrics and Identity Management Standards and Conformity Assessment Working Group Approved Disposition of Comments Template for Public Review of Registry (February 8, 2008 -March 10, 2008) 

# SOURC 

E 

TYP 

E 

PAG 

E 

PAR 

A 

LINE COMMENT RATIONALE 

14. DoD Edit 3 3 13 Recommend deleting the period at the end of 

the third bullet. 

Grammar. 

15. DoD Edit 3 4 all Recommend putting all terms and definitions in 

alphabetical order. 

Ease of use. Entries not in any specific order. 

16. DoD Edit 3 4, base 

standar d 

3 Recommend deleting the extra spaces 

between the words “standardized” and “profile”. 

Format. 

17. DoD Edit 3 4, 

biometri c profile 

1 Recommend changing the word “effect” to 

read “affect”. 

Grammar. 

18. DoD Edit 4 4, 

certificat ion 

1 Recommend adding a period to the end of the 

sentence and capitalizing “third”. 

Grammar and consistency in format. 

19. DoD Edit 4 4, 

conform ance testing 

1 Recommend capitalizing “process”. Grammar and consistency in 

format. 

20. DoD Edit 4 4, 

conform ance testing 

2 Recommend adding a period to the end of the 

sentence. 

Grammar and consistency in format. 

21. DoD Edit 4 4, 

sample 

1 Recommend capitalizing “raw”. Grammar and consistency in 

format. 

22. DoD Edit 4 4, 

sample 

3 Recommend adding a period to the end of the 

sentence. 

Grammar and consistency in format. 

23. DoD Edit 4 4, 

templat e 

1 Recommend capitalizing “encoded”. Grammar and consistency in 

format. 

24. DoD Edit 4 4, 

templat e 

2 Recommend adding a period to the end of the 

sentence. 

Grammar and consistency in format. 

06/05/2008 19 
May 15, 2008 

NSTC Subcommittee on Biometrics and Identity Management Standards and Conformity Assessment Working Group Approved Disposition of Comments Template for Public Review of Registry (February 8, 2008 -March 10, 2008) 

# SOURC 

E 

TYP 

E 

PAG 

E 

PAR 

A 

LINE COMMENT RATIONALE 

25. DoD Edit 4 4, 

sample quality 

1 Recommend capitalizing “properties”. Grammar and consistency in 

format. 

26. DoD Tech 

nical 

4 4, signal 1 Recommend using another term, not signal, to 

convey these ideas. 

Signal is a term associated with the transmission of data or a cueThe use in this context may be confusing to readers. 

27. DoD Edit 4 4, signal 1 Recommend adding a period to the end of the 

sentence and capitalizing “one”. 

Grammar and consistency in format. 

28. DoD Edit 4 4, image 1 Recommend capitalizing “two”. Grammar and consistency in 

format. 

29. DoD Edit 4 4, 

propriet ary image 

1 Recommend capitalizing “image”. Grammar and consistency in 

format. 

30. DoD Edit 4 4, 

propriet ary image 

2 Recommend adding a period to the end of the 

sentence. 

Grammar and consistency in format. 

31. DoD Edit 4 4, 

propriet ary signal 

1 Recommend capitalizing “signal”. Grammar and consistency in 

format. 

32. DoD Edit 4 4, 

propriet ary signal 

2 Recommend adding a period to the end of the 

sentence. 

Grammar and consistency in format. 

33. DoD Edit 4 4, basic 

interope rability 

1 Recommend capitalizing “ability”. Grammar and consistency in 

format. 

34. DoD Edit 4 4, basic 

interope rability 

3 Recommend adding a period to the end of the 

sentence. 

Grammar and consistency in format. 

35. DoD Edit 4 4, 

interope rable 

1 Recommend capitalizing “performance”. Grammar and consistency in 

format. 

06/05/2008 19 
May 15, 2008 

NSTC Subcommittee on Biometrics and Identity Management Standards and Conformity Assessment Working Group Approved Disposition of Comments Template for Public Review of Registry (February 8, 2008 -March 10, 2008) 

# SOURC 

E 

TYP 

E 

PAG 

E 

PAR 

A 

LINE COMMENT RATIONALE 

perform ance 

36. DoD Edit 4 4, 

interope rable perform ance 

2 Recommend adding a period to the end of the 

sentence. 

Grammar and consistency in format. 

37. DoD Edit 4 4, native 

perform ance 

1 Recommend capitalizing “performance”. Grammar and consistency in 

format. 

38. DoD Edit 4 4, native 

perform ance 

2 Recommend adding a period to the end of the 

sentence. 

Grammar and consistency in format. 

39. DoD Edit 4 4, 

perform ance interope rability 

1 Recommend adding a period to the end of the 

sentence and capitalizing “measure”. 

Grammar and consistency in format. 

40. DoD Edit 4 4, 

scenario test 

1 Recommend capitalizing “the”. Grammar and consistency in 

format. 

41. DoD Edit 7 7 3 Recommend deleting the comma at the end of 

the first bullet. 

Grammar and format consistency. 

42. DOD Edit 7 7 4 Recommend deleting the comma at the end of 

the second bullet. 

Grammar and format consistency. 

43. DOD Edit 7 7 5 Recommend deleting the period at the end of 

the third bullet. 

Grammar and format consistency. 

44. DOD Edit 7 7 9 Recommend deleting the comma at the end of 

the first bullet. 

Grammar and format consistency. 

45. DOD Edit 7 7 10 Recommend deleting the comma at the end of 

the second bullet. 

Grammar and format consistency. 

46. DOD Edit 7 7 11 Recommend deleting the comma at the end of 

the third bullet. 

Grammar and format consistency. 

47. DOD Edit 7 7 12 Recommend deleting the comma at the end of 

the fourth bullet. 

Grammar and format consistency. 

48. DOD Edit 7 7 13 Recommend deleting “and ,” at the end of the Grammar and format 

06/05/2008 19 
May 15, 2008 

NSTC Subcommittee on Biometrics and Identity Management Standards and Conformity Assessment Working Group Approved Disposition of Comments Template for Public Review of Registry (February 8, 2008 -March 10, 2008) 

# SOURC 

E 

TYP 

E 

PAG 

E 

PAR 

A 

LINE COMMENT RATIONALE 

fifth bullet. consistency. 

49. DOD Edit 7 7 14 Recommend deleting the period at the end of 

the sixth bullet. 

Grammar and format consistency. 

50. DOD Edit 7 7 18 Recommend deleting the comma at the end of 

the first bullet. 

Grammar and format consistency. 

51. DOD Edit 7 7 19 Recommend deleting the comma at the end of 

the second bullet. 

Grammar and format consistency. 

52. DOD Edit 7 7 20 Recommend deleting the period at the end of 

the third bullet. 

Grammar and format consistency. 

53. DOD Edit 7 7 23 Recommend moving the period from within the 

parenthesis following the word “record” to outside the parenthesis. 

Grammar. 

54. DOD Edit 7 7 29 Recommend changing “minutia” to read 

“minutiae”. 

Grammar. The word should be plural not singular. 

55. DOD Edit 8 T1 Row 2, 

notes column 

Recommend changing the semi-colon at the end of note 5 to a period. 

Grammar and format consistency. 

56. DOD Edit 9 T1 Row 4, 

notes column 

Recommend adding a period to the end of 

notes one and three. 

Grammar and format consistency. 

57. DOD Edit 11 T1 Row 12, 

notes column 

Recommend adding a period to the end of note 4. 

Grammar and format consistency. 

58. DOD Edit 11 8 11 Recommend deleting the comma at the end of 

the first bullet. 

Grammar and format consistency. 

59. DOD Edit 11 8 13 Recommend deleting the comma at the end of 

the second bullet. 

Grammar and format consistency. 

60. DOD Edit 11 8 16 Recommend deleting “and ,” at the end of the 

third bullet. 

Grammar and format consistency. 

61. DOD Edit 11 8 21 Recommend deleting the period at the end of 

the fourth bullet. 

Grammar and format consistency. 

62. DOD Edit 12 8, 

Biometri c Profiles 

12 Recommend changing “DOD” to read “DoD”. Consistency with paragraph 5, 

acronyms. 

06/05/2008 19 
May 15, 2008 

NSTC Subcommittee on Biometrics and Identity Management Standards and Conformity Assessment Working Group Approved Disposition of Comments Template for Public Review of Registry (February 8, 2008 -March 10, 2008) 

# SOURC 

E 

TYP 

E 

PAG 

E 

PAR 

A 

LINE COMMENT RATIONALE 

63. DOD Edit 12 T2 Row 5, 

notes column 

Recommend deleting the carriage return after the word with on line 4. 

Format. 

64. DoD Edit 3 4. 2nd 

bullet 

Omit extra spaces between Standardized and profile. 

typo 

65. DoD Tech 

nical 

7 2 Recommend that the statement " The biometric 

standards listed in table 1 do not apply to data of any modality that: (etc.) be changed to: "Conformance to the biometric standards listed in table 1 is not required for the data of any modality that: (etc.) 

As currently written the statemenexcludes the use of the standardfor the conditions enumerated bthe bullets. This is not desirable. We would like to suggest that the standards are observed whenever practicable.- - therefore the language should bmore inclusive. 

66. DoD Tech 

nical 

8 Table 

row # 2 

3 Recommend omitting the sentence: A 

compressed version may be generated but only if the parent image is retained without compression. 

What is the purpose of data compression if you are forcing thretention of the uncompressed parent image? Isn't the lossless compressed image good enough? The sentence is also ambiguous in that it mentions compression without specifiying whether the compression is lossy or lossless. 

67. DoD Tech 

nical 

8 Table 

row # 3 

3 These statements appear to derive image 

quality measures based upon data compression ratio. Is this the intention and is there precedent for the 15:1 and 10:1 thresholds? I wasn't aware that compression 

ratio was considered a valid measure of image quality. 

JPEG and WSQ compression algorithms don't allow you to specify the compression ratio up front. What you are creating here is a situation where a compliant raw image collected at sufficienresolution is compressed and based upon nothing else but the 

06/05/2008 19 
May 15, 2008 

NSTC Subcommittee on Biometrics and Identity Management Standards and Conformity Assessment Working Group Approved Disposition of Comments Template for Public Review of Registry (February 8, 2008 -March 10, 2008) 

# SOURC 

E 

TYP 

E 

PAG 

E 

PAR 

A 

LINE COMMENT RATIONALE 

Omit: "When images are captured at 197 pixels/cm and compressed using WSQ the compression ratio shall not exceed 15:1" And "When images are captured at 394 pixels/cm and compressed using JPEG 2000 the compression ratio shall not exceed 10:1" 

information theory aspects of the image and the coding method, the compressed image might need to be thrown out if compression worked too well. What can the technician do? If he runs the compression algorithm again he'll get the same result. Either trust the compression algorithms or don't but avoid constraints that you have no means of satisfying. This problem is solved if an image quality quantifier is used as opposed to suppositions based upon compression ratio. 

68. DoD Tech 

nical 

11 Table 

row # 12 

13 Omit "If lossy compression is applied to iris 

images the compression ratio shall not exceed 6:1 " Or specify "WSQ" in place of "lossy compression" Also: suggest that a minimum resolution in pixels /cm be specified. 

Same rationale as in #5 above. If a lossy compression algorithm is used, you will not be able to specify the compression ratio anyou may have to throw out images where compression worked too well. 

69. DoD Gen 

eral 

7 "Consistent Collection and Use of Metadata" 

and the column 2 text are ambiguous. Metadata can be described three different ways: 1) Defense Network Metadata - analogous to URL Tags that tell systems what data is there (e.g., biometrics data) 2) System Level Data - Who owns the data, how 

NSTC Policy document must reconcile the ambiguities surrounding the term Metadata. 

06/05/2008 19 
May 15, 2008 

NSTC Subcommittee on Biometrics and Identity Management Standards and Conformity Assessment Working Group Approved Disposition of Comments Template for Public Review of Registry (February 8, 2008 -March 10, 2008) 

# SOURC 

E 

TYP 

E 

PAG 

E 

PAR 

A 

LINE COMMENT RATIONALE 

large the file is, security levels, etc. 3) Data Level Metadata - such as the Type-14 Header data that tells you which finger an image is for, the pattern type, the vertical and horizontal line length, etc. 

70. DoD Edit 4 2 Definition of Basic interoperability - the word "a" 

is inadvertently duplicated. 

Delete duplication. 

71. DoD Tech 

nical 

5 Acronyms and Abbreviations has one entry for 

EBTS - there should be two entries or two subentries: One for the FBI and one for the DoD. 

Add/modify references to reflect both FBI and DoD EBTS. 

72. DoD Tech 

nical 

Table 1 Clarification: Table 1: The use of 197 pixels/cm 

and 394 pixels/cm are awkward - ANSI/NIST ITL-1 2007 (and its predecessors) used 19.7 ppmm and 39.37 ppmm - why change now? 

Recommend Registry use the same terminology found in the standards themselves. 

73. DoD Tech 

nical

 Table 1 Row 1 

Note 3 

Specifies a compression ratio of no more that 10:1 for Type 14 images. In the FBI-EBTS V8.001 Section 3.9.2 we see that Type-4 and Type-14 images are to be compressed at 15:1 nominally; there is no mention of 1,000 ppi or Type-14 with JPEG 2000. 

Will FBI specify 10:1 for these 1,000ppi images as opposed to 15:1? 

06/05/2008 19 
May 15, 2008 

NSTC Subcommittee on Biometrics and Identity Management Standards and Conformity Assessment Working Group Approved Disposition of Comments Template for Public Review of Registry (February 8, 2008 -March 10, 2008) 

# SOURC 

E 

TYP 

E 

PAG 

E 

PAR 

A 

LINE COMMENT RATIONALE 

74. DoD Tech 

nical 

8 Table 1 Row 2 References PNG compression - it is mentioned in 

FBI-EBTS 8.001 Table 3-2 but not assigned to any biometric record type. 

Need clarification as to what the PNG compression is to be used fohere under "Latent Fingerprints". 

75. DoD Tech 

nical 

9 Table 1 Row 4 In the Notes column - 4th entry. "If ANSI/NIST ITL-1 

2007 Type-9 is used, vendor minutiae blocks [fields 13-125] shall not be used. 

The ANSI/NIST ITL-1 2007 Table 14 also has a proprietary entry (for Identix Features) in Fields 151-175 and that should also be included in Table 1. 

76. DoD Tech 

nical 

9 Table 1 Row 6 In the Notes column - 2nd entry appears to be 

sort of in conflict with the recommended standards column entry that points to the Type9 Fields 1-4 and 126-150. 

ANSI/NIST ITL-1 2007 Type-9 Fields 126-150 are the INCITS 378:2004 fields. The note says INCITS 378:2004 can be used in addition to the recommended standard - this seems like a broken circular logic track. 

77. DoD Tech 

nical 

12 Table 2 Row 3 This Registry of Biometric Transmission Profiles 

says that DoD EBTS V1.2 is for "Applications exchanging data with the DoD ABIS" - is it also true for other DoD exchanges as someday the data might migrate to the DoD ABIS? 

78. DoD Tech 

nical 

12 Table 2 Row 4 Listed standard, IDENT eXchange Messaging 

(IXM), is not in the Section 13 Reference list. 

Recommend it be added. The same issue is there for Table 4's row 1, INCITS 358:2004. 

79. DoD Tech 

nical 

The NTSC Registry is missing a standard for transcoding 1,000 ppi JPEG 2000 fingerprint images to 500 ppi WSQ images. 

Does such a standard or transcoding approach exist? 

80. FBI/CJIS Tech 

nical 

Secti on 7 & 8 

The text should be revised so that Section 8 has precedence over Section 7, or the intended purposes of Section 7 should be clearly delineated in cases handled in Section 8. 

As written, the dictates of section 7 (Biometric data collection, storage, and exchange standards) and section 8 (Biometric profiles) are unclear ocontradictory. Section 8 should take precedence over section 7. 

06/05/2008 19 
May 15, 2008 

NSTC Subcommittee on Biometrics and Identity Management Standards and Conformity Assessment Working Group Approved Disposition of Comments Template for Public Review of Registry (February 8, 2008 -March 10, 2008) 

# SOURC 

E 

TYP 

E 

PAG 

E 

PAR 

A 

LINE COMMENT RATIONALE 

(additional info on FBI Comments

81. FBI/CJIS Tech 

nical 

Tabl e 1 

Row 6 Table 1, Row 6, Recommended standards 

column should read 

• ANSI/NIST-ITL 1-2007, Type 9, Fields 1-4 

and 13-23 

Instead of 

• ANSI/NIST-ITL 1-2007, Type 9, Fields 1-4 

and 126-150 

The Recommended standards in Table 1, row #6 are not appropriate for latent fingerprintsand conflict with EBTS. (additionainfo on FBI Comments) 

82. FBI/CJIS Tech 

nical 

Tabl e 1 

Row 4 Table 1, Row 4, Recommended standards 

column should include the FBI EBTS fields, reading 

• INCITS 378:2004 

or ANSI/NIST-ITL 1-2007 Type 9, Fields 1-4 and 126-150 or ANSI/NIST-ITL 1-2007, Type 9, Fields 1-4 and 13-23 

Instead of 

• INCITS 378:2004 

or ANSI/NIST-ITL 1-2007 Type 9, Fields 1-4 and 126-150 

The wording in Table 1, row #4 contradicts EBTS. (additional info on FBI Comments) 

Table 1, Row 4, Notes column should delete the line reading “If ANSI/NIST-ITL 1-2007 Type 9 is used, vendor minutiae blocks [fields 13-125] shall not be used.” 

83. CSC Gen 

eral 

Consideration should be given to making some statement as to how Government implementers should maintain awareness of standards currently under development that may impact 

The document is well organized and helpful to Government implementers. It is restricted to currently published documents a

06/05/2008 19 
May 15, 2008 

NSTC Subcommittee on Biometrics and Identity Management Standards and Conformity Assessment Working Group Approved Disposition of Comments Template for Public Review of Registry (February 8, 2008 -March 10, 2008) 

# SOURC 

E 

TYP 

E 

PAG 

E 

PAR 

A 

LINE COMMENT RATIONALE 

or influence their decision-making. acknowledged on the Scope 

statement: “Only standards finalized and approved by a standards developing organization are eligible...” 

84. CSC Tech 

nical 

Secti on 7 

2 It seems unnecessary and unwarranted to 

preclude the use of other modalities with published data interchange format standards from this Registry. What is the motivation for or necessity of excluding whole categories of biometric technology that may serve a suitable purpose for some specific Government applications? Why would a Type 99 record be preferred over the published standard? 

includes fingerprint, palmprint, face and iris images only, clearly by intent to bound the modalities used by USG for data collection and exchange. The last paragraph cites ANSI/NIST-ITL 1-2007, Type 99 as the only acceptable record type for othemodalities. 

06/05/2008 19 
May 15, 2008 

NSTC Subcommittee on Biometrics and Identity Management Standards and Conformity Assessment Working Group Approved Disposition of Comments Template for Public Review of Registry (February 8, 2008 -March 10, 2008) 

# SOURC 

E 

TYP 

E 

PAG 

E 

PAR 

A 

LINE COMMENT RATIONALE 

85. CSC Tech 

nical 

Secti on 7 

3 Please clarify the relationship between the 

exclusions in paragraph 3 and the content of paragraphs 1 and 2. For example, does a "closed system” allows for a system design within an agency that includes multiple sites sharing a common biometric modality (not on the list)? It is unclear what "closed" would or would not allow. 

Paragraph 3 lists some exclusions related to Table 1, but it unclear these exclusions apply to the list oaccepted modalities. Particularlthe reference to “closed systems

86. CSC Tech 

nical 

Secti on 7 

Table 1, entry 12 

What is not addressed by Table 1 is the topic of “compact data formats” for iris data when stored on tokens (e.g. RT smart cards). The standards for two forms of polar image data are in the referenced standard, and one of these forms is cited in the RTIC specification. Shouldn’t there be another table entry for iris data in the “compact form”? 

Table 1, entry 12 addresses iris data standards, and calls for storage of rectilinear images as a minimum, and polar images only in addition to the rectilinear. For off-line storage this position is fully supported. 

87. CSC Tech Secti 2 Section 9, Paragraph 2: wording is too “The TWIC Reader Hardware and 

06/05/2008 19 
May 15, 2008 

NSTC Subcommittee on Biometrics and Identity Management Standards and Conformity Assessment Working Group Approved Disposition of Comments Template for Public Review of Registry (February 8, 2008 -March 10, 2008) 

# SOURC 

E 

TYP 

E 

PAG 

E 

PAR 

A 

LINE COMMENT RATIONALE 

nical on 9 restrictive. Do not imply both logical and 

physical access needs. 

Card Application Specification leverages FIPS 201. For all transportation workers requiring unescorted physical and and/or logical access to national facilities,...” 

88. CSC Gen 

eral 

Tabl e 11 

Item 3 2. Table 11 item 3. Reference to”INCITS 

423.2:2007” is incorrect. 

This conformance standard is NOyet published, and should not be included in this Registry (under thcurrent rules of only listing published standards.) Or if the rule is relaxed, then refer to “INCITS 423.2-200x” 

89. CSC Gen 

eral 

Secti on 13 

Entry 12 Either delete the reference or change to 

“INCITS 423.2-200x” 

this standard has yet to be published 

90. CSC Edit Secti 

on 13 

Entry 19 Typo Should be ” — Part 4 2: Finger 

image data.” 

91. CSC Edit Secti 

on 13 

Entry 34 Update version number to v1.5 – update the 

URL and dates. 

Obsolete version 

92. Fujitsu Tech 

nical

 Consider adding biometric data interchange 

formats (ISO/IEC 19794-9:2007) into the proposed draft on the Registry of USG Recommended Biometrics Standards; and providing some reference to Vascular Authentication in the Registry 

Vascular Authentication was already commercialized in 1997 and the data interchange formafor this technology have been established as international standards (ISO/IEC 19794-9:2007, Information technology-Biometric data interchange formats-part 9Vascular image data). Additionally Vascular Authentication has already been widely used in various 

06/05/2008 19 
May 15, 2008 

NSTC Subcommittee on Biometrics and Identity Management Standards and Conformity Assessment Working Group Approved Disposition of Comments Template for Public Review of Registry (February 8, 2008 -March 10, 2008) 

# SOURC 

E 

TYP 

E 

PAG 

E 

PAR 

A 

LINE COMMENT RATIONALE 

applications around the world. (See Fujitsu input for further details) 

93. Judith 

Markowitz 

Gen eral 

Standards for voice are under development Data Exchange format standard

Developer’s standard, and process control standard are all under development. (See Markowitz input for further details

94. IBIA Tech 

nical 

Tabl e 1 

Item 5 Recommend that you modify the sentence to 

read as follows: “INCITS 378:2004 shall not be used for match-on-card but may be used for other applications.” 

Given that the topic of this item i“Storage Inside Personal Identity Credentials”, it would seem appropriate to add a sentence after the above statement that makes it clear that it is acceptable to store INCITS 378:2004 templates inside personal identity credentials for applications other than matchon-card. 

95. Lockheed 

Martin 

Tech nical 

Tabl e 1 (Pag e 7) 

Row 1 (and repeate d in row 3 – page 8) 

Recommend revisit the 10:1 factor and consider reusing the FBI's recommended 1000ppi compression ratio. 

The 10:1 factor is inconsistent with the FBI's "Profile for 1000ppi Fingerprint Compression, Version 1.1" (http://www.fbibiospecs.org/fbibometric/docs/J2K1000.pdf), whicspecifies JPEG2000 parameters "designed for a 0.55 bpp bitrate (i.e., 14.55:1 compression ratio)" (section 8.3.1). 

96. Lockheed 

Martin 

Tech nical 

Tabl e 1 (pa ge 9) 

Row 4 Recommend separate the storage and 

exchange domains into separate rows, such that storage applications can include both standard and vendor-proprietary components and exchange applications can only include standard components. 

The notes in Table 1, Row 4 (page 9) are unclear and seem to contradict the requirement preceding Table 1 that "data records or sets of data records shall not be wrapped in a proprietary wrapper that requires a specific provider's software to 

06/05/2008 19 
May 15, 2008 

NSTC Subcommittee on Biometrics and Identity Management Standards and Conformity Assessment Working Group Approved Disposition of Comments Template for Public Review of Registry (February 8, 2008 -March 10, 2008) 

# SOURC 

E 

TYP 

E 

PAG 

E 

PAR 

A 

LINE COMMENT RATIONALE 

decode or encode." The notes prohibit the use of vendorproprietary minutiae blocks (Type9 fields 13-125) but then state standardized minutiae records arnot recommended for identification purposes. In most cases, the minutiae records storeby a system are the same ones used for identification or verification purposes. 

97. Crossmatc 

h 

Tech nical 

Tabl e 1 

Item 4 recommends that the use of extended data for 

378 is encouraged in order that performance for identification data can be improved, while at the same time allowing for interoperability when the performance constraints for verification data are supported. 

The use of vendor defined extended data should be encouraged, with a minor caveat. As described later in this table entry, the use of 378 alone not recommended due to performance benefits of proprietary data in identification. Therefore, Cross Match recommends that the use of extended data for 378 is encouraged in order that performance for identification data can be improved, while at the same time allowing for interoperability when the performance constraints for verification data are supported. 

98. Crossmatc 

h 

Tech nical 

Tabl e 4 

Item 1 

Work should be started on a better application interface standard in the US and International standards working groups. 

There is a natural desire to adopt BioAPI as an application interfacthat abstracts applications from the specifics of a particular vendor or even from the specificof a given modality. 

06/05/2008 19 
May 15, 2008 

NSTC Subcommittee on Biometrics and Identity Management Standards and Conformity Assessment Working Group Approved Disposition of Comments Template for Public Review of Registry (February 8, 2008 -March 10, 2008) 

# SOURC 

E 

TYP 

E 

PAG 

E 

PAR 

A 

LINE COMMENT RATIONALE 

However, the use of BioAPI for all USG applications that require Pluand Play capability should not be recommended. BioAPI is a set of "C" level interfaces to some middleware between an application and a vendor supplied biometric service provider. This middleware is only available from one vendor, and not FIPS certified. It represents a potential for many biometric and security "man in the middle" attacks. This weakness is exacerbated by capabilities in the middleware such as BIP. Furthermore, the complexity provided by BioAPI is more costly than the value it provides. Applications and Biometric Service Providers must maintain side agreements about cryptographic secret exchange and key management, the use oraw data, graphical user interfacconventions, and even an agreement over the use of the location of the biometric database that maintains reference biometrics used for identification. These side agreements would work to establish a sort of contract between a particular BSP vendor and government application, anthis contract would serve as an artificial barrier to free and fair 

06/05/2008 19 
May 15, 2008 

NSTC Subcommittee on Biometrics and Identity Management Standards and Conformity Assessment Working Group Approved Disposition of Comments Template for Public Review of Registry (February 8, 2008 -March 10, 2008) 

# SOURC 

E 

TYP 

E 

PAG 

E 

PAR 

A 

LINE COMMENT RATIONALE 

market competition. It is also not usable (as is) by most USG applications, as these applications would want to be written in Java or .Net. 

99. IDTP Tech 

nical 

There appears to be an oversight in the registry regarding the proper approach to producing a 500 ppi WSQ finger print (or palm print image) from an originally scanned 1000 ppi JPEG 2K compressed image. MITRE profile should be referenced for these cases. 

MTR 04B0000022 (Mitre Technical Report), Margaret Lepley, Profile for 1000ppi Fingerprint compression, Version 1.1 April 2004. Available at: http://www.mitre.org/work/tech papers/tech papers 04/lepley fingerrpint/lepley fingerprint.pdf 

100. NIST Edit 14 Table 4 

Row 3 

Remove the BIAS row. The INCITS 442 standard is not yet 

approved. 

Attachment: Replacement rows 

# Validity 

period 

Biometric data 

Domain of applicability 

Recommended standards 

Notes 

4 October 

2007 – current 

Fingerprint minutiae, not latent 

Storage and exchange outside and 

INCITS 378:2004 or 

OPTION 2: Verification applications (e.g. access control) shall not use thdata” fields of INCITS 378:2004 clause 6.6. 

06/05/2008 19 
May 15, 2008 

NSTC Subcommittee on Biometrics and Identity Management Standards and Conformity Assessment Working Group Approved Disposition of Comments Template for Public Review of Registry (February 8, 2008 -March 10, 2008) 

# SOURC 

E 

TYP 

E 

PAG 

E 

PAR 

A 

LINE COMMENT RATIONALE 

# Validity 

period 

Biometric data 

Domain of applicability 

Recommended standards 

Notes 

minutiae For minutiae encoded in latent images, see row 7. 

unrelated to personal identity credentials 

ANSI/NIST-ITL 1-2007 Type 9, Fields 1-4 and 13-30 or ANSI/NIST-ITL 1-2007 Type 9, Fields 1-4 and 126-150 

Better accuracy will be obtained if, within the target application, it is postandardized image records, per row 1 of this Table. Identification applications shall use the INCITS 378:2004 standard. This mtemplate data in the “vendor-defined extended data” fields of INCITS 3

template data is non-interoperable but some implementations have beaccuracy over standardized data alone [MINEX04]. It is usually usable omatched by the products of a single supplier. Reliance on such proprielock-in. In order to mitigate this risk, the parent images shall be retainedstandardized image records should be exchanged, per row 1 of this Taballowance of proprietary data, the standardized minutiae data required INCITS 378:2004 should be produced by MINEX compliant template genAdd MINEX to acronym table, and include REF in Section 13. Other standards or standardized records, including those enumerated bsubstitute for the required standard; they may be used only in addition: If ANSI/NIST-ITL 1-2007 Type 9 is used, vendor blocks (i.e. fields 31 - 125 an

5a October 

2007 – current 

Fingerprint minutiae 

Storage and transmission for personal identity credentials for match-oncard 

ISO/IEC 19794-2:2005, clause 8 compact card format with clause 9 format types 0001, 0003, 0005. 

ISO/IEC 19794-2:2005 (compact card format) shall be stored on the carISO/IEC 19794-2:2005 (compact card format) shall be sent to the card foreference template on the card. In both cases the minutiae may be prepared from parent INCITS 378:20For match-on-card, neither INCITS 378:2004 nor ISO/IEC 19794-2:2005 clastored on the card. For match-on-card, neither INCITS 378:2004 nor ISO/IEC 19794-2:2005 clasent to the card. Regarding ISO/IEC 19794-2:2005 card formats, the absence of a headethe sort-ordering of minutiae mean that such records shall not be used f

5b October 

2007 – current 

Fingerprint minutiae 

Storage and transmission inside personal 

INCITS 378:2004 In match-off-card applications, none of the ISO/IEC 19794-2:2005 forma

both the reference and verification templates. 

06/05/2008 19 
May 15, 2008 

NSTC Subcommittee on Biometrics and Identity Management Standards and Conformity Assessment Working Group Approved Disposition of Comments Template for Public Review of Registry (February 8, 2008 -March 10, 2008) 

# SOURC 

E 

TYP 

E 

PAG 

E 

PAR 

A 

LINE COMMENT RATIONALE 

# Validity 

period 

Biometric data 

Domain of applicability 

Recommended standards 

Notes 

identity credentials for match-offcard 

06/05/2008 

19