Canada adds PAD, PKC sections to national biometric authentication standard

Canada has updated its national standard for biometric authentication with a new and expanded edition. The national standards body seeks to ensure organizations increasingly adopting the technology and integrating it with digital identity consider the accuracy, but also end-user protection and fraud resistance.

CAN/DGSI 120:2026, “Use of biometrics for authentication” sets minimum requirements and provides guidance for responsible implementations, from privacy and security to consent and transparency.

Normative standards are drawn from CAN/DGSI 103-1, “Digital Trust and Identity – Part 1: Fundamentals” and the ISO/IEC 24760 identity management framework. The former builds on Canada’s code of practice for digital identity, based on the Pan-Canadian Trust Framework (PCTF), which was approved by DGSI last year.

The second edition of the standard from the Digital Governance Standards Institute (DGSI) nearly doubles the publication’s length, from 13 to 25 pages, compared to the first edition published in 2024.

DGSI called for feedback on the standard at the beginning of 2026.

The second edition of the standard adds guidance on combining biometrics with public key cryptography (PKC) and secure device possession. The guidance also sets requirements for biometric performance metrics like false acceptance and false rejection, as well as presentation attack detection (PAD). It addresses protections for the integrity of the sensor or system capturing the biometric against threats like injection attacks, manipulation and compromised devices. These four issues each get a chapter, along with “Identity Verification and Enrollment Practices.”

A section on “Strong Authentication Using Biometric Binding” specifies that organizations must implement non-exportable private keys, local-only encrypted biometric template storage, passwordless authentication and audit traceability. Minimums should be defined for familiar metrics like FAR, FRR, failure to enroll (FTE) rate and failure to acquire (FTA) rate, where applicable, along with operating thresholds.

Four annexes follow the main chapters in the 2026 edition. They cover “credential authentication in detail,” “functional uses of biometrics,” “threats related to biometric systems,” which covers a range of risks including injection attacks, and “related biometric standards and frameworks.”

The result is a more comprehensive document that brings organizations implementing biometric authentication much closer, if not completely up to speed, with the practical realities of the digital identity landscape and cyberthreat environment.

Article Topics

biometric authentication  |  CAN/DGSI 120  |  Canada  |  Digital Governance Standards Institute (DGSI)  |  presentation attack detection  |  public key cryptography  |  standards