Subject: [Ietf-krb-wg] (no subject)

From: John.Corkish <[email-masked]>
Date: Thu, 28 Aug 2008 14:56:33 +0100

Hello to all,

I have been a member of the mailing list for quite a while and I enjoy reading the issues posted.  This is my first post to the mailing list, and I'm a little concerned in that I hope I can clearly define my issue.  I am currently working on an Msc Project based on Iris biometrics and the development of a bio-login (replacement for Microsoft's MSGINA.dll), and I am hoping to incorporate Kerberos as the security mechanism.

I suppose my first question is based on a concern that arose for me yesterday while considering the standard kerberos credential, ("[email-masked]"), instead of using a user name I would beusing a biometric template, i.e "01010100100101001001000100001001001" which is will differ on each occasion; a hamming code distance is used to determine a positive accept or a false reject.  I had not considered this
 initially as I was new to Kerberos. I suppose my first question is based on setting up the client credentials in the Kerberos key distribution center. I am now thinking that it may not be possible to use a binary template as the user ID and password instead of the standard "[email-masked]".  Would it be possible to use a binary template with Kerberos?

Thanks and regards,
John.
This email, its content and any files transmitted with it are intended solely for the addressee(s) and may be legally privileged and/or confidential. Access by any other party is unauthorised without the express written permission of the sender. If you have received this email in error you may not copy or use the contents, attachments or information in any way. Please destroy it and contact the sender via e-mail return. Internet communications are not secure unless protected using strong cryptography. This email has been prepared using information believed by the author to be reliable and accurate, and LIT make no warranty as to its accuracy or completeness. In particular the author does not accept responsibility for changes made to this email after it was sent. Any opinions expressed in this document are those of the author and do not necessarily reflect the opinions of LIT, or its affiliates.

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Ken Raeburn <[email-masked]>
Date: Thu, 28 Aug 2008 12:07:17 -0400

On Aug 28, 2008, at 09:56, John.Corkish wrote:

> Hello to all,
>
> I have been a member of the mailing list for quite a while and I  
> enjoy reading the issues posted.  This is my first post to the  
> mailing list, and I'm a little concerned in that I hope I can  
> clearly define my issue.  I am currently working on an Msc Project  
> based on Iris biometrics and the development of a bio-login  
> (replacement for Microsoft's MSGINA.dll), and I am hoping to  
> incorporate Kerberos as the security mechanism.

Good... I know the idea's come up before, I don't recall if anyone has  
actually implemented it.

> I suppose my first question is based on a concern that arose for me  
> yesterday while considering the standard kerberos credential, ("[email-masked] 
> "), instead of using a user name I would beusing a biometric  
> template, i.e "01010100100101001001000100001001001" which is will  
> differ on each occasion; a hamming code distance is used to  
> determine a positive accept or a false reject.  I had not considered  
> this
> initially as I was new to Kerberos. I suppose my first question is  
> based on setting up the client credentials in the Kerberos key  
> distribution center. I am now thinking that it may not be possible  
> to use a binary template as the user ID and password instead of the  
> standard "[email-masked]".  Would it be possible to use  
> a binary template with Kerberos?

I don't know that there's any single standard for naming (around here,  
at MIT, it's whatever username you pick).  But that aside, it seems to  
me the biometric data you get would be what proves the user's identity  
to Kerberos, not the name of the user.  Initial authentication via  
certificates works a bit like that too -- the client machine sends in  
this blob of data, the KDC examines it and (in the success case)  
determines a proven identity either from data encapsulated in the  
certificate or by some mapping looked up somewhere.  It sounds like  
the biometric data doesn't necessarily include a fixed, unique  
portion, so probably you'd want to go with the mapping; it doesn't  
need to be firstname.surname, though, it could be some randomly  
generated identifier, or whatever biometric values were produced when  
the person first registered for their account.

Depending on the environment in which it's to be used, you may want  
the Kerberos principal name to be human-readable, e.g., seeing  
John.Smith@REALM in a log is more meaningful than  
010100110100101000101110101010@REALM.  Then again, depending on the  
environment, maybe you don't want it. :-)

Actually... hm.  Okay, thinking about it a little more, I suppose with  
the client name aliases supported in the referrals draft (not yet  
standardized, and needing a bit more work), you could treat one binary  
blob as a potential alias for another binary blob, sort of a biometric- 
authentication version of spelling correction ("John.Smiht" -> oh,  
that must be "John.Smith").  That hadn't occurred to me, maybe it's  
actually doable.  But I think I'd still tend to view it more as  
authentication data than identity.

Another issue to deal with, though, if you're eliminating passwords  
from the initial authentication exchange, is that that exchange still  
has to not just prove the identity of the user, it also needs to  
result in some encryption key (or other secret data from which an  
encryption key could be generated) being securely shared between the  
user and KDC, and it needs to be resistant to someone simply sniffing  
packets off the wire and extracting data to send later.  If the  
biometric data protocol you're working with doesn't provide any of  
that -- if it's just "send this blob of data and you get thumbs-up or  
thumbs-down depending how close it matches" -- then perhaps you should  
look at combining it with some other scheme, like a password (which  
would still be the only cryptographic protection, and so would need to  
be strong), or one of the schemes for securing a KDC exchange using  
the public key of the KDC (which must then be known to or at least  
verifiable by all clients), like the TLS or preauth-framework drafts,  
or other mechanisms.

If you use just the biometric data as the authenticator, of course,  
you have to keep it very well hidden, or the user's account is forever  
compromised, unless they get their irises/fingerprints/whatever  
changed.  If the biometric data is visible to someone eavesdropping on  
the network, the eavesdropper could just retransmit it and "prove"  
that they're John Smith, and without any passwords to change, it's all  
over.

> This email, its content and any files transmitted with it are  
> intended solely for the addressee(s) and may be legally privileged  
> and/or confidential. Access by any other party is unauthorised  
> without the express written permission of the sender. If you have  
> received this email in error you may not copy or use the contents,  
> attachments or information in any way. Please destroy it and contact  
> the sender via e-mail return.

If you can possibly avoid it, please don't send messages with these  
sorts of notices to public, publicly-archived mailing lists.

Ken