What is the difference between a PIV and a CAC card?

A CAC (Common Access Card) is the standard smart card issued by the United States Department of Defense (DoD) to military personnel and contractors. A PIV (Personal Identity Verification) card is the equivalent standard used by all other non-DoD federal civilian agencies.

What information is stored on a smart card?

A smart card stores cryptographic keys (public and private key pairs) and digital certificates used for authentication, digital signatures, and encryption. It may also store a facial photograph, a fingerprint biometric template, and basic employee identifying information.

How does a smart card work?

When inserted into a reader, the smart card's microchip receives power and communicates with the computer. To use the private keys locked inside the chip, the user must enter a PIN. The chip then performs cryptographic operations internally without ever exposing the private key to the computer.

What is a PIV card used for?

A PIV card is used for secure multi-factor authentication to log into federal computer systems and networks. It is also used as a physical access badge to open doors to secure government buildings, and to digitally sign or encrypt emails.

Can a smart card be hacked?

Smart cards are extremely difficult to hack remotely because the private keys cannot be extracted over a network. An attacker would need to physically steal the card and know the user's secret PIN to impersonate them, which triggers anti-tamper lockouts after too many failed guesses.

What is the difference between a smart card and a proximity card?

A proximity card (like an RFID badge) simply broadcasts an unencrypted serial number to open a door and is easily cloned. A smart card contains a microchip that performs complex two-way cryptographic challenges, making it practically impossible to clone.

What Is a Smart Card? PIV, CAC, and OpenPGP Cards Explained

Introduction

If you have ever worked for a government agency or a major defense contractor, you are likely familiar with the daily ritual of inserting a plastic ID badge into a keyboard reader before you can log into your computer. This badge is not just a piece of plastic with a photo printed on it; it is a highly sophisticated cryptographic device known as a smart card.

Before the widespread adoption of modern hardware security tokens like the YubiKey, smart cards were the only way to achieve true, enterprise-scale, phishing-resistant multi-factor authentication. Developed primarily to meet strict government security mandates, these cards revolutionized how large organizations handle digital identities. They successfully merged physical building security with logical computer security into a single, unified credential. Understanding what is a smart card and how variants like the PIV, CAC, and OpenPGP card function provides critical insight into the foundation of high-assurance digital security.

What Is a Smart Card?

At its core, a smart card is a physical, credit-card-sized token embedded with a secure microchip. This microchip is essentially a tiny, highly specialized computer. It has its own processor, memory, and operating system, all dedicated to securely storing cryptographic keys and performing cryptographic operations.

The defining feature of a smart card is its impenetrable boundary. When a public/private key pair is generated for a user, the private key is generated directly inside the smart card’s secure chip. The private key is permanently locked inside that chip; it is mathematically and physically designed so that the private key can never be exported, copied, or read by the computer the card is plugged into.

Because the private key never leaves the card, a remote attacker cannot steal it, even if your computer is completely infected with malware. To authenticate, you must physically possess the card and know the PIN that unlocks the chip. This provides highly robust, two-factor authentication (something you have, and something you know).

In the United States, smart cards are most commonly encountered in the federal government in two primary forms: the CAC and the PIV. While they serve the same fundamental purpose, they are issued by different authorities under different standards.

How a Smart Card Works

A smart card relies on Public Key Infrastructure (PKI). Here is how a smart card authenticates a user in plain English:

Insertion: You insert the smart card into a smart card reader (which can be built into a laptop, keyboard, or attached via USB). The reader provides electrical power to the card’s microchip, waking it up.
The PIN Prompt: The computer prompts you to enter a Personal Identification Number (PIN). The computer sends this PIN to the smart card.
Internal Verification: The smart card’s chip internally verifies the PIN against its securely stored records. If the PIN is incorrect too many times (usually three), the chip permanently locks itself to prevent brute force attacks. If the PIN is correct, the chip unlocks access to the private key stored inside it.
The Challenge: The computer (or the remote server you are trying to log into) sends a cryptographic “challenge”—a random string of data—to the smart card.
The Signature: The smart card’s processor uses the unlocked private key to digitally sign the challenge. This cryptographic math happens entirely inside the plastic card.
Access Granted: The smart card sends the digital signature back to the computer. The server uses your public certificate to verify the signature. Because only the physical card possesses the matching private key, the server knows you are legitimately present and grants access.

A smart card receives a cryptographic challenge, processes it internally using a locked private key, and returns a verified signature to grant access.

Watch this explanation of how PIV cards differ from standard access badges and how they utilize cryptography for security.

Smart Card vs Standard Proximity Card

It is easy to confuse a smart card with a standard office building access badge, as they often look identical. However, the underlying technology and security levels are vastly different.

Feature	Smart Card (PIV / CAC)	Standard Proximity Card (RFID)
Technology	Embedded secure microchip performing PKI cryptography.	Simple antenna and chip broadcasting a static number.
Security Level	Extremely high. Immune to remote cloning or copying.	Very low. Easily cloned by someone standing nearby with an RFID reader.
Authentication Type	Two-way cryptographic challenge and response.	One-way broadcast of an unencrypted serial number.
Use Case	Logging into computer networks (logical access) AND opening secure doors (physical access).	Opening basic office doors and parking gates (physical access only).
Cost to Deploy	High. Requires PKI infrastructure, card readers, and a dedicated issuance authority.	Low. Cheap cards and simple readers.

If you only need to wave a badge near a door reader to get into an office building, you are likely using a proximity card. If you must insert the badge into a reader and type a PIN to log into your workstation, you are using a smart card. Modern government PIV cards actually contain both technologies: a contact chip for secure computer logins and a contactless antenna for opening doors, though the physical access portion is increasingly being upgraded to use the secure cryptography rather than a simple serial number.

Real-World Use Cases

Smart cards are the backbone of identity management in highly regulated and security-conscious environments.

The Common Access Card (CAC) is the standard identification for active-duty United States military personnel, reserve personnel, civilian employees, and eligible contractors. Issued by the Department of Defense (DoD), the CAC is mandatory for logging into DoD computers, accessing military networks, and entering secure military installations. It also contains certificates used to digitally sign military emails, ensuring that orders and communications are authentically from the sender and have not been tampered with.

The Personal Identity Verification (PIV) card is the civilian equivalent of the CAC. Following Homeland Security Presidential Directive 12 (HSPD-12), the US government mandated a common, interoperable security standard for all federal executive branch agencies. Whether you work for the FBI, the Department of Energy, or the EPA, you are issued a PIV card. A PIV card issued by one agency can theoretically be cryptographically verified by another agency, creating a unified web of trust across the federal government.

In the developer and open-source community, the OpenPGP Smart Card is widely used. Unlike government cards issued by a central authority, an OpenPGP card is purchased blank by an individual. The user generates their own PGP keys and loads them onto the card (or generates them directly on the card). Developers use these cards to securely sign software commits (proving they wrote the code) and to decrypt secure communications, ensuring their master PGP keys are never exposed to malware on their laptops.

Common Mistakes to Avoid

The most common security failure involving smart cards is a human one: users leaving the card inserted in their computer when they walk away from their desk. If a user authenticates with their PIN and then leaves the card in the reader while grabbing a coffee, anyone walking by has full, authenticated access to that computer. Organizations must enforce strict policies (and configure computer operating systems) to automatically lock the workstation the moment the smart card is removed from the reader.

Another mistake is failing to have a robust lifecycle management process for the cards. A smart card is only as secure as the identity proofing process used to issue it. If an organization issues a highly secure smart card without properly verifying the employee’s background and identity documents (like a passport), the cryptography is useless because the card was given to an imposter. Furthermore, organizations must have immediate revocation procedures to invalidate a card’s certificates the moment an employee is terminated or a card is reported lost.

Finally, relying exclusively on smart cards can become a bottleneck as the workforce shifts to mobile devices. Most smartphones and tablets do not have smart card readers. Organizations that rigidly enforce smart card logins often struggle to support mobile workers. To solve this, organizations must implement “Derived Credentials,” where the security of the smart card is used to securely provision a secondary cryptographic token directly onto a mobile device’s secure enclave.

Getting Started

Implementing a smart card infrastructure—complete with a Certificate Authority (CA) and card issuance stations—is a massive undertaking typically reserved for large enterprises and government agencies.

For large organizations looking to adopt smart card security, the first step is reviewing the NIST FIPS 201 standard, which outlines the architecture for a compliant PIV system. Organizations must set up an internal Public Key Infrastructure (PKI) to generate and manage the digital certificates that will be loaded onto the employee cards. They must also procure compatible card readers for all workstations and integrate the certificate verification process with their domain controllers (such as Microsoft Active Directory).

For individuals or small teams looking for smart card-level security without the enterprise overhead, modern hardware security tokens like the YubiKey are the recommended alternative. Many hardware tokens actually contain a smart card applet (like the OpenPGP or PIV applet) embedded within them, allowing you to get the exact same cryptographic benefits of a smart card in a small USB device.

By combining physical possession with a secret PIN, smart cards ensure that digital identities cannot be stolen over the internet. For more information on how attackers try to guess passwords and why these tokens are necessary, read our guide on how brute force attacks work, or explore what is a zero-day exploit to understand how advanced threats can bypass traditional software defenses.