Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

From: "Raymond Brown" <[email-masked]>
Date: Tue, 08 Sep 2009 15:44:03 +0100

Thank you Ted.

You make some very interesting points. I think it is accepted that the principles behind Kerberos are for each service invoked the user is required to prove his/her identity and servers prove their identity to clients. Neither the client nor service is trusted. 

In proposing the use of biometrics in Kerberos the approach should be that there are going to be varying levels of security for different customers. Some may want a US Marine with M16 standing over each user but scaling that right down we can start from a position where you are introducing an option to compliment or in cases replace passwords. If we look at the wide availability of Fingerprint Readers connected to workstations and the call for Single Sign On (SS0) network services it is only a matter of time before confidence in biometrics will see it being used more in single and in multi-modal user authentication.

Finger Vein Authentication Technology (FVAT), the use of vein patterns in fingers, is already grabbing market from traditional fingerprint readers and to date cannot be faked and provides a indication of liveness. Discussions on fake fingers, lifted prints, captured irises, etc., have had biometric developers working hard and with good results. There are strides being made to secure biometrics and I have a different view to that offered by Bruce Schnieder. No guarantees can be made that any person logging onto a remote workstation, using many other methods of authentication, is not doing so under coercion. The danger in using biometrics is believing that it offers a level of security that it cannot deliver and then applying it to a situation where it will fail. 

I concur that the Kerberos design principles does not engender trust in the client but I believe that biometrics are compatible once that trust is extended to adding user identification to the client.  Surely we are talking about a step up from passwords. Treating biometrics like passwords has it's advantages and disadvantages but essentially there are more similarities than differences when you reduce them down to a function. There will be limitations to the use of biometrics with Kerberos and those are largely based on trust, which inherent in the design, is a mutual authentication issue - client/server trust. I'm of the opinion that Kerberos has the potential to make biometrics work and work well. Perhaps we are approaching the problem from the wrong perspective and should be considering how the Kerberos principle can enhance biometrics.  

Regards
Ray

-----Original Message-----
From: Theodore Tso <[email-masked]>
To: Raymond Brown <[email-masked]>
Date: Tue, 8 Sep 2009 07:59:27 -0400
Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

On Tue, Sep 08, 2009 at 09:26:41AM +0100, Raymond Brown wrote:
> What do you see as being the main reasons why biometric data has not
> been used in authentication in Kerberos to date?
>
> Techniques have been developed to produce keys from noisy and
> unrealiable biometric data using cryptography. Stored and
> transmitted biometric data is hardened to be capture resistant,
> cancelable and revocable. Assuming it is feasible to use biometric
> data in Kerberos authentication, where do you see it being utilised?
> Would it be used for generating keys? Could it be combined with a
> password to be more secure?

Note that one of the primary design goals of Kerberos is that it is a
*network* security system, where the client is not necessarily
trusted.  It might be running rogue code, or it might be totally under
the control of the attacker; in other words the client is connected to
the wide area network, and is outside of the trusted computing base
(TCB).  The only asumption made by Kerberos is that a rogue client
attempting to access secure network resources is that it does not have
access to the user's keys.

Most biometric systems, in order to be secure, require a U.S. Marine
with an M-16, or some other security agent with a Big Gun, to prevent
an attacker from trying to fool the biometric system.  I refer you to
the Mythbusters TV show where a rubber cement cast of a fingerprint
was sufficent to fool two different biometric systems, including one
billed as a "high security", "unbreakable" door security system.  Far
too often, Biometrics are used more for theatrics than anything else.

Also see Bruce Schneier's reflections on this matter:

    Biometrics can vastly improve security, especially when paired
    with another form of authentication such as passwords. But it's
    important to understand their limitations as well as their
    strengths. On the strength side, biometrics are hard to
    forge. It's hard to affix a fake fingerprint to your finger or
    make your retina look like someone else's. Some people can mimic
    voices, and make-up artists can change people's faces, but these
    are specialized skills.

    On the other hand, biometrics are easy to steal. You leave your
    fingerprints everywhere you touch, your iris scan everywhere you
    look. Regularly, hackers have copied the prints of officials from
    objects they've touched, and posted them on the Internet. We
    haven't yet had an example of a large biometric database being
    hacked into, but the possibility is there. Biometrics are unique
    identifiers, but they're not secrets.

    And a stolen biometric can fool some systems. It can be as easy
    as cutting out a signature, pasting it onto a contract, and then
    faxing the page to someone. The person on the other end doesn't
    know that the signature isn't valid because he didn't see it
    fixed onto the page. Remote logins by fingerprint fail in the
    same way. If there's no way to verify the print came from an
    actual reader, not from a stored computer file, the system is
    much less secure....

    The lesson is that biometrics work best if the system can verify
    that the biometric came from the person at the time of
    verification. The biometric identification system at the gates of
    the CIA headquarters works because there's a guard with a large
    gun making sure no one is trying to fool the system....

    One more problem with biometrics: they don't fail well. Passwords
    can be changed, but if someone copies your thumbprint, you're out
    of luck: you can't update your thumb. Passwords can be backed up,
    but if you alter your thumbprint in an accident, you're stuck. The
    failures don't have to be this spectacular: a voiceprint reader
    might not recognize someone with a sore throat, or a fingerprint
    reader might fail outside in freezing weather. Biometric systems
    need to be analyzed in light of these possibilities.

    http://www.schneier.com/blog/archives/2009/01/biometrics.html

As such, Biometrics are somewhat incompatible with Kerberos's design
philosophies where we don't invest a huge amount of trust in the
client; but with Biometrics, you have to trust that the Biometric
measurement device is correctly testing to make sure measurement is
coming from a live human being, and not from an attacker who is trying
to spoof the system (by using a cast of a fingerprint, etc.).  

This doesn't mean that it's impossible to use Biometrics securely with
Kerberos, of course, but its uses are somewhat limited and you have to
understand the security tradeoffs.  (i.e., if you need to have a
Marine with an assault rifle to prevent someone from spoofing the
Biometrics, maybe some other security system other than a network
security system might be less overhead and/or more secure from a total
system perspective; maybe a dual picture ID card system with a man
trap and a sign "personnel are authorized to use deadly force", for
example.  :-)

						- Ted

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Greg Hudson <[email-masked]>
Date: Tue, 08 Sep 2009 12:01:12 -0400

On Tue, 2009-09-08 at 10:44 -0400, Raymond Brown wrote:
> Surely we are talking about a step up from passwords.  Treating
> biometrics like passwords has it's advantages and disadvantages but
> essentially there are more similarities than differences when you
> reduce them down to a function.

I think there's a pretty important difference.  A big problem with
passwords is that once you type it into a computing device, that
computing device could (if malicious or compromised) store the password
and use it again in the future.  This problem is magnified if you
transmit passwords to remote services.

You mitigate this problem with a password reset policy.  If I'm forced
to change my password once a month, then someone might maliciously
authenticate as me using a password stolen last week, but not one stolen
years ago.  You cannot mitigate this same risk with biometric data.
Once I scan my fingerprint (or vein pattern, or whatever) into a
compromised machine and it gets sent off to the mafia server farm, I
can't reset it.

There are obviously some advantages of biometric data over passwords,
but I'm not sure that matters if there's a glaring fatal flaw.  (I'm
speaking specifically about using biometrics to replace passwords as
long-term keys in a network authentication system; other uses of
biometrics may not have the same concern.)