IMPORTANT I

No.-t.,\ '-:K-l L020/44/20 12-U!O/\1 (Au th-t)

Govcrn rneu t of IndiaMinistrv of Electronics & IT

Unique ldcntificauon Authority of India(Aurhenucauon Division)

Tower I, 9tt1 Floor, Jeevan Bharati Building,Connaught circus, ~E\\' Dethi-llOOO 1

Dated: 25.01.2017

Ail AGAs, .-\Sf\:::;

Sub: Upgradation of existing biametric public devices to Registered Devices

Dear Partners,

UDAl is cornrrn u.ed towards providing the highest qualitv or services in

an efficient and secure manner. To enhance the security level. LJIOAl has taken

several securi u measures co ensure security of tra.n sa ct.ion s and end La end

rraceabi il~ during the authentication process. To make it more robust and

secure, LIDAl along with biomctric device vendors and STQC is working on the

concept or Registered Devices.

2 The key features of Registered Devices arc:

<:1. De 'ice iccntifica tion - E\"(~t\ dcvic ..: wi ll h~-1\"C a unique identifier allowing

u accab ilitv , analyt.ics and fraud management.

b. Eliminating advanced replay attacks - Biorne tric data is signed wit.hm [he

device u sirig the provider key to ensure it is indeed captured live.

providers. This device driver (exposed via an SOK/Service) encapsulates

rhc biornetr ic capture, am' user experience while capture [such as

preview), and signing and encryption of biometrics all within it. The

Device Driver mUSL form Lh,~encrypted PID block before returning to the

hOSL application.

d. There are two levels of Registered l..)cvlccs named as Level 0 (sofl\varc

level upgrade is possible lor existing public dcvrccs) and Level

(hardware and software level changes are rcquired).The detailed

specifications for Registered Devices arc available at the link be low:

;;LlPS: / iuiclai.gov.in:'images.· resource .'aCHi:1aar regisLered_devic:es_l.0 (I

q i 1:2() I 6. pel 1"

J. It. is expected that device vendor SDI('s would be certified as either Level ()

0:' Levell by 31~llvlarch 2017. Please l'(nlaC\. vuur biorncuic device vendor 10:

their schedule to support registered devices. Register device authentication

backerid capability will be live by 31 st March 2017.

4. PI decision has been taken by UIDf\[ rhat use of public devices will be

d iscon tin ued and only Registered Device s will be allowed to perform Aadhaar

based authentication. Therefore. vo u need to ensure that all biornctr ic devices

deployed for Aadnaar enabled services are upgraded LO Level 0 ! Level,l Registered Device by iSl June 2017 arid all future procurement. or biornetric

dcviccs shall from now on be as per Level 0 / Level 1 Registered Device

specifications. Authentication applications will also require modification to

support the registered device SDK (Level 0 ! Level l). L!IDAI Authentication API

2.0 will be upgraded to only support registered device authentication. This will

promote a direct upgrade from the current applications with public devices

using I\P[ \.6 LO a.ppl icat.iorrs with registered devices using API 2.0. Accordingly,

the tirnclincs for the support for Autheruication API \.6 will be extended from

31st March 2017 to 1:;[ June 2017. Please note that there wil] be no extension of

this timelirie and use of public devices after 1st June 2017 shall result in failed

authentication transactions for which the responsibility shall be yours.

o . You may also immediately' ask your device vendor to ensure upgrade of

existing biornetric devices to Registered Devices and provide all the required

support and details for the upgrade.

6. All ASAs also need to ensure that they are able to support Auth API 2.0

which SUPP0rLS Registered Devices and accordingly need to prepare: thoir

svstcm on top pr iority.

7. Your application development team also needs [0 be sensitized as

changes will be required in the application and backend server to make it

compatible with Registered Device- and Authentication API 2.0 and would need

to be tested thoroughly. Therefore. it is suggested that your technical tea rn

sh o u ld be ready and gel in touch with YOU: biornctr ic device supplier/vendor

for upgrada tion to the latest Registered Devices spccifica lions.

8. UIDAI is committed [0 ensuring that all necessary applicarion s are

upgraded on Lime and there is smooth transition to Registered Devices. UID Al

has already initialed workshops wilt, all stakeholders including device

providers and will continuously support entire ecosystem during this

transition. In case you have any query on Registered Devices, you may kind lv

gel in touch with LJIDAI team:

Sh r i Ya s h wa n l Kumar, ADC \·dsh\q,nl. kur:-:d!-':iuidCl i.nel. i~l

Shri An up Kumar, ADG anup.kumar:iiuid2i.neLil1

Technical Contact Person:

Shri Rakesh Prasad rakeshpn:lsadl] uidai.ne.t. in

Shri Sanjith Sundaram sanii[h:sLlndaram:Z,uidai.nL~l.in

9. This iss ucs with the approval of CEO, UIDAI.

',".( \ ---: ...1 \~... "', ( -c.; - '2·......r·-- ..~'.

......--/ '2. ,;~ '.:.\,(Ajai Chandra]

ADG (Auth)Copy for information W:

1. DG, STQC2. Sh. An u p Kumar, ADC UIDAI3. Sh Pramod Varma, Chief Technology Architect, UIDAI4. Sh. Vivek Raghavan, Chief Product Manager, UIDAIo. All device vendors having STQC certified biome tric devices

!('--:,',-

•. -."1