Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

From: "Raymond Brown" <[email-masked]>
Date: Thu, 10 Sep 2009 20:55:32 +0100

Ted you make a strong point about the use of biometrics in general and what you advise is fact or based on theoretical probabilities. Most of the biometrics used today are already on show and readily available to malicious attackers without requiring them to build some elaborate capture device. Irises and faces can be videod and photographed, fingerprints can be lifted and modelled in putty, etc.. and due to the their identifiable uniqueness once compromised is.. well, once too many.  

The fact does remain however that biometrics have a role to play in authentication, limited perhaps, but defined based on the benefits, risks, costs, etc., in a given situation.  Within the scope of that limited use, I'm seeking to establish whether biometrics could be used as a method of authentication in Kerberos and subsequently to define those benefits, risks, costs, etc.., within that scope. Having already discussed flaws in biometrics in general, I'm keen to have suggestions on how it could or should be used in the authentication process in Kerberos ...in whatever capacity.

-----Original Message-----
From: Theodore Tso <[email-masked]>
To: Raymond Brown <[email-masked]>
Date: Wed, 9 Sep 2009 21:51:52 -0400
Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

On Tue, Sep 08, 2009 at 07:16:59PM +0100, Raymond Brown wrote:
> The glaring fatal flaw with biometrics that you refer to has been a
> major consideration for the industry for some time and as I've
> mentioned previously in these discussions, has been a matter
> addressed by many developers and researchers.  Clearly, no one will
> trust biometrics that aren't cancelable, revocable, capture
> resistant, disposable, etc..  Admittedly, at the point of scanning,
> if your fingerprint is compromised then an attacker has your scanned
> fingerprints, which he could also have lifted from a glass you drank
> from and so on.

As you put it, this is the fatal flaw with biometrics.  I don't see
how Finger Vein Authentication Technology solves this problem.  It may
be somewhat harder to steal than a fingerprint, but the moment these
start getting used for, say, authenticating credit card transactions,
a malicious shopkeeper could simply use a specially hacked unit which
measures his customer's vein patterns.  Worse yet, even if MasterCard
and Visa hasn't started using biometrics, a malicious shopkeeper could
probably install such a unit, claim it was used for secure credit card
transactions, and large number of sheeple will probably fall for it.

After all, if people fall for password phishing e-mails claiming that
they need to reply to an e-mail sending their first name, last name,
birthdate, SSN, and password to someone claiming that they are from
the "MIT Help Desk", I bet a large number of shoppers will comply if a
shopkeeper asks them to place their thumb on a scanner "for security
purposes".

Once the malicious shopkeeper has grabbed the user's fingerprint vein
patterns, they will be able to convert it into a Kerberos key using
whatever scheme you propose --- and the user's security has been
compromised permanently.  (Unless you want to tell us how they can
change their vein patterns after they have been recorded by a
malicious shopkeeper!)

Which is why I repeat my earlier assertion --- unless you have an
Armed Guard with Big Gun to assure that someone isn't spoofing the
biometric measurement device, and that the biometric measurement
device isn't (a) compromised by a malicious user, and (b) the device
is receiving data from the live human which is trying to gain access
to the Resource, biometric security devices like those used on laptops
and doors, are largely Security Theatre.  They look good, but it's
mostly for show (and for extracting money from gullible business
people :-)

     	 	    	       			     - Ted

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: "Josh Howlett" <[email-masked]>
Date: Thu, 10 Sep 2009 21:01:38 +0100

Hi Raymond,

> Having 
> already discussed flaws in biometrics in general, I'm keen to 
> have suggestions on how it could or should be used in the 
> authentication process in Kerberos ...in whatever capacity.

Sorry, I've come to this thread late and trying to catch up; did you
have some use-case/problem in mind that you need to solve?

josh.

JANET(UK) is a trading name of The JNT Association, a company limited
by guarantee which is registered in England under No. 2881024 
and whose Registered Office is at Lumen House, Library Avenue,
Harwell Science and Innovation Campus, Didcot, Oxfordshire. OX11 0SG