Subject: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

From: "Raymond Brown" <[email-masked]>
Date: Tue, 15 Sep 2009 17:57:45 +0100

My thanks to those of you who have taken part in this discussion. Your contributions have been invaluable and I am greatly appreciative of your enthusiasm, expertise and time. Please do keep your comments coming.

A brief summary of some key points in the discussion to date;

The statement was made that; " the primary design goals of Kerberos is that it is a
*network* security system, where the client is not necessarily trusted. It was added that; "the only assumption that Kerberos makes is that a rogue client attempting to access secure network resources does not have access to the user’s keys."  Clients are un-trusted as are biometric devices attached to them.

Concern was raised about the specific use of “biometrics to replace passwords as long-term keys in a network authentication system." It was stated that; “biometrics are unique identifiers but they're not secrets."

The point was made that; "biometric factors are most useful when they can be obtained in an environment that makes it difficult to replay someone else's biometrics." Also added was the point that; “Biometrics work best if the system can verify that the biometric came from a person at the time of the verification “ – (Bruce Schneier).

The view was offered that biometrics have a limited use in Kerberos, possibly best paired with passwords or perhaps One Time Password (OTP).  The point was made that “security is really a matter of costs" but “the cost of additional hardware (to use biometrics with Kerberos) was not an issue. Rather; "getting an IT buyer to deploy these existing hardware solutions is an issue, since it means "change". The opinion was offered that " unless something drastic happens (e.g. corporate IT was hacked, and corporate data was lost), then there is no incentive for the IT folks to deploy better security."

It was further suggested; "biometrics could be used to improve the cryptographic security of the initial authentication exchange. It could be used to generate one-key or some key generation input data to protect a particular message exchange."

It was stated that Biometrics are currently used by way of Smart Card at the end user system using FIPS Certified Card Readers and in Secure Installations “Common Criteria or Secure Systems ".  Without these qualifying conditions, it is believed that “the threat models cannot be controlled and the system becomes too complicated to build and maintain".

Regarding the protection of biometrics and key extraction the advice was given that; "improved methods based on fuzzy extractors would be required as existing methods involved a lot of communication and computation ".  In practice a proposed method that reduces the processing demands placed on the KDC would be favourable. [Does this mean a dedicated and trusted Biometric Authentication Server should be used?]

It was suggested that a method could "use a standards based user authentication approach and remove the need for proprietary technology." The view was that this “would increase the adoption of such technology (biometric authentication) and give customers more choices ".

It was further suggested that biometrics “should be based on policy to require a password as well as biometric or just biometric without password.” The point was also made that; "using authentication sets in FAST would mean that biometric pre-auth can be combined with OTP to give multi-factor authentication” should the customer require this level of authentication.

This view was supported by the suggestion that biometrics could be incorporated "as a feature into PKINIT or OTP or devising a new pre-authentication protocol.” It was added that FAST would probably be the way to go (and possibly delivering the profile via TLS was another suggestion)

It was also suggested that biometrics; “could be implemented in PKINIT – using the fingerprint data (or extract) to replace or supplement the PIN rather than the X.509 signature.” It was suggested that this introduces the problem of transmitting the fingerprint data (or extract) over the network and then having the difficult task of preventing replay of fingerprint data by an attacker.

Ray.

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg