Subject: [Ietf-krb-wg] Kerberos and Biometric Templates

From: John.Corkish <[email-masked]>
Date: Wed, 9 Jul 2008 09:31:52 +0100

Hello to all,

I have been a member of the mailing list for quite a while and I enjoy reading the issues posted.  This is my first post to the mailing list, and I'm a little concerned in that I hope I can clearly define my issue.  I am currently working on an Msc Project based on Iris biometrics and the development of a bio-login (replacement for Microsoft's MSGINA.dll), and I am hoping to incorporate Kerberos as the security mechanism.

I suppose my first question is based on a concern that arose for me yesterday while considering the standard kerberos credential, ("[email-masked]"), instead of using a user name I would beusing a biometric template, i.e "01010100100101001001000100001001001" which is will differ on each occasion; a hamming code distance is used to determine a positive accept or a false reject.  I had not considered this
 initially as I was new to Kerberos. I suppose my first question is based on setting up the client credentials in the Kerberos key distribution center. I am now thinking that it may not be possible to use a binary template as the user ID and password instead of the standard "[email-masked]".  Would it be possible to use a binary template with Kerberos?

Thanks and regards,
John.
This email, its content and any files transmitted with it are intended solely for the addressee(s) and may be legally privileged and/or confidential. Access by any other party is unauthorised without the express written permission of the sender. If you have received this email in error you may not copy or use the contents, attachments or information in any way. Please destroy it and contact the sender via e-mail return. Internet communications are not secure unless protected using strong cryptography. This email has been prepared using information believed by the author to be reliable and accurate, and LIT make no warranty as to its accuracy or completeness. In particular the author does not accept responsibility for changes made to this email after it was sent. Any opinions expressed in this document are those of the author and do not necessarily reflect the opinions of LIT, or its affiliates.

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Martin Rex <[email-masked]>
Date: Fri, 11 Jul 2008 17:44:25 +0200 (MEST)

John.Corkish wrote:
> 
> I have been a member of the mailing list for quite a while and I enjoy
> reading the issues posted.  This is my first post to the mailing list,
> and I'm a little concerned in that I hope I can clearly define my issue.
> I am currently working on an Msc Project based on Iris biometrics and
> the development of a bio-login (replacement for Microsoft's MSGINA.dll),
> and I am hoping to incorporate Kerberos as the security mechanism.
> 
> I suppose my first question is based on a concern that arose for me
> yesterday while considering the standard kerberos credential,
> ("[email-masked]"), instead of using a user name I would
> be using a biometric template, i.e "01010100100101001001000100001001001"
> which is will differ on each occasion; a hamming code distance is used
> to determine a positive accept or a false reject.  I had not considered
> this initially as I was new to Kerberos. I suppose my first question
> is based on setting up the client credentials in the Kerberos key
> distribution center. I am now thinking that it may not be possible
> to use a binary template as the user ID and password instead of the
> standard "[email-masked]".  Would it be possible to use
> a binary template with Kerberos?

This sound like:  watch me (my Iris or whatever) and if what you see
resembles any of the users known to the system, then please let me
in as that user.

In essence, this would be similar to removing the username prompt
on the current logon screen (leaving only the password field) and
asking the system to search for a user account to which this
password matches and then perform a login under whichever name
had a match.

In a secure authentication environment, the user asking for login
is supposed to assert his identity along with a proof of the identity.

Not having to assert an identity seems like a very bad idea an creates
a number of problems.  One of the most serious problems is that
a system can no longer deny "repeated logon attempts" (i.e. lockout
counter), if the logon procedure does NOT require assertion of an
explicit identity.

-Martin