Homeland Security Presidential Directive 12 stipulates that most federal employees and contractors will use approved Personal Identification Verification (PIV) cards by this autumn.
The PIV cards will be necessary to "authenticate" users' identities when seeking entrance to federal buildings.
Nist published a standard for the new credentials in 2006 which specifies that the cards store a digital representation of key features, or "minutiae", of the bearer's fingerprints for biometric identification.
Under the current standard, a user seeking to enter a biometrically controlled access point would insert the PIV card into a slot and place their fingers on a scanner.
Authentication proceeds in two steps: the cardholder enters a Pin to allow the fingerprint minutiae to be read from the card, and the card reader matches the stored minutiae against the newly scanned image of the cardholder's fingerprints.
In recent tests, Nist researchers assessed the accuracy and security of two variations on this model which, if accepted for government use, would offer improved features.
The first allows the biometric data on the card to travel across a secure wireless interface to eliminate the need to insert the card into a reader.
The second uses an alternative authentication technique called 'match-on-card' in which biometric data from the fingerprint scanner is sent to the PIV card for matching by a processor chip embedded in the card.
The stored minutiae data never leaves the card. The advantage of this, according to computer scientist Patrick Grother, is that if a card is "lost and then found in the street, the fingerprint template cannot be copied".
The Nist tests addressed two outstanding questions associated with match-on-cards.
The first was whether the cards' electronic 'keys' can keep the wireless data transmissions between the fingerprint reader and the cards secure, and execute the match operation in 2.5 seconds.
The second question was whether the match-on-card operation will produce as few false acceptance and false rejection decisions as traditional match-off-card schemes where more computational power is available.
The researchers found that 10 cards with a standard 128-byte key and seven cards that use a more secure 256-byte key passed the security and timing test using wireless.
On the accuracy side, one team met the criteria set by Nist and two others missed narrowly. The computer scientists plan a new round of tests to allow wider participation.