Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

From: "Raymond Brown" <[email-masked]>
Date: Tue, 08 Sep 2009 09:26:41 +0100

What do you see as being the main reasons why biometric data has not been used in authentication in Kerberos to date?

Techniques have been developed to produce keys from noisy and unrealiable biometric data using cryptography. Stored and transmitted biometric data is hardened to be capture resistant, cancelable and revocable. Assuming it is feasible to use biometric data in Kerberos authentication, where do you see it being utilised? Would it be used for generating keys? Could it be combined with a password to be more secure? 

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Tim Alsop <[email-masked]>
Date: Tue, 8 Sep 2009 09:34:32 +0100

Ray,

I have seen biometric user authentication (e.g. fingerprint, facial recognition, retinal scan) being used in cases where users are logging onto sensitive/critical applications. The authentication of the user in this case occurs on the workstation, and typically every time the user logs onto the application. The applications involved are often not yet 'Kerberos enabled', but as more and more business applications become 'Kerberos enabled' the need for using Kerberos to get a TGT via a biometric is getting greater. At moment, biometric hardware vendors provide software and toolkits which are often proprietary which means a customer has to 'buy into' a particular vendor solution for their biometric authentication needs. If it was instead possible to use a standards based user authentication approach and remove the need for proprietary technology, I feel this would increase the adoption of such technology and give customers more choices.

Also, (like with OTP) it should be possible based on policy to require a password as well as biometric, or just biometric without password. Also, using authentication sets in FAST would mean that biometric pre-auth can be combined with OTP auth to give multi-factor authentication if the customer wants to implement this level of authentication.

Thanks,
Tim

---

From: Howard Chu <[email-masked]>
Date: Tue, 08 Sep 2009 01:37:28 -0700

Raymond Brown wrote:
> What do you see as being the main reasons why biometric data has not been
used in authentication in Kerberos to date?
>
> Techniques have been developed to produce keys from noisy and unrealiable
biometric data using cryptography. Stored and transmitted biometric data is
hardened to be capture resistant, cancelable and revocable. Assuming it is
feasible to use biometric data in Kerberos authentication, where do you see it
being utilised? Would it be used for generating keys? Could it be combined
with a password to be more secure?

You probably want to at least combine it with a salt so that a particular 
instance can be revokable, without totally invalidating the original source of 
the biometric data. ("Your retina scan has expired. Please insert other eye:" ...)

-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Theodore Tso <[email-masked]>
Date: Tue, 8 Sep 2009 07:59:27 -0400

On Tue, Sep 08, 2009 at 09:26:41AM +0100, Raymond Brown wrote:
> What do you see as being the main reasons why biometric data has not
> been used in authentication in Kerberos to date?
>
> Techniques have been developed to produce keys from noisy and
> unrealiable biometric data using cryptography. Stored and
> transmitted biometric data is hardened to be capture resistant,
> cancelable and revocable. Assuming it is feasible to use biometric
> data in Kerberos authentication, where do you see it being utilised?
> Would it be used for generating keys? Could it be combined with a
> password to be more secure?

Note that one of the primary design goals of Kerberos is that it is a
*network* security system, where the client is not necessarily
trusted.  It might be running rogue code, or it might be totally under
the control of the attacker; in other words the client is connected to
the wide area network, and is outside of the trusted computing base
(TCB).  The only asumption made by Kerberos is that a rogue client
attempting to access secure network resources is that it does not have
access to the user's keys.

Most biometric systems, in order to be secure, require a U.S. Marine
with an M-16, or some other security agent with a Big Gun, to prevent
an attacker from trying to fool the biometric system.  I refer you to
the Mythbusters TV show where a rubber cement cast of a fingerprint
was sufficent to fool two different biometric systems, including one
billed as a "high security", "unbreakable" door security system.  Far
too often, Biometrics are used more for theatrics than anything else.

Also see Bruce Schneier's reflections on this matter:

    Biometrics can vastly improve security, especially when paired
    with another form of authentication such as passwords. But it's
    important to understand their limitations as well as their
    strengths. On the strength side, biometrics are hard to
    forge. It's hard to affix a fake fingerprint to your finger or
    make your retina look like someone else's. Some people can mimic
    voices, and make-up artists can change people's faces, but these
    are specialized skills.

    On the other hand, biometrics are easy to steal. You leave your
    fingerprints everywhere you touch, your iris scan everywhere you
    look. Regularly, hackers have copied the prints of officials from
    objects they've touched, and posted them on the Internet. We
    haven't yet had an example of a large biometric database being
    hacked into, but the possibility is there. Biometrics are unique
    identifiers, but they're not secrets.

    And a stolen biometric can fool some systems. It can be as easy
    as cutting out a signature, pasting it onto a contract, and then
    faxing the page to someone. The person on the other end doesn't
    know that the signature isn't valid because he didn't see it
    fixed onto the page. Remote logins by fingerprint fail in the
    same way. If there's no way to verify the print came from an
    actual reader, not from a stored computer file, the system is
    much less secure....

    The lesson is that biometrics work best if the system can verify
    that the biometric came from the person at the time of
    verification. The biometric identification system at the gates of
    the CIA headquarters works because there's a guard with a large
    gun making sure no one is trying to fool the system....

    One more problem with biometrics: they don't fail well. Passwords
    can be changed, but if someone copies your thumbprint, you're out
    of luck: you can't update your thumb. Passwords can be backed up,
    but if you alter your thumbprint in an accident, you're stuck. The
    failures don't have to be this spectacular: a voiceprint reader
    might not recognize someone with a sore throat, or a fingerprint
    reader might fail outside in freezing weather. Biometric systems
    need to be analyzed in light of these possibilities.

    http://www.schneier.com/blog/archives/2009/01/biometrics.html

As such, Biometrics are somewhat incompatible with Kerberos's design
philosophies where we don't invest a huge amount of trust in the
client; but with Biometrics, you have to trust that the Biometric
measurement device is correctly testing to make sure measurement is
coming from a live human being, and not from an attacker who is trying
to spoof the system (by using a cast of a fingerprint, etc.).  

This doesn't mean that it's impossible to use Biometrics securely with
Kerberos, of course, but its uses are somewhat limited and you have to
understand the security tradeoffs.  (i.e., if you need to have a
Marine with an assault rifle to prevent someone from spoofing the
Biometrics, maybe some other security system other than a network
security system might be less overhead and/or more secure from a total
system perspective; maybe a dual picture ID card system with a man
trap and a sign "personnel are authorized to use deadly force", for
example.  :-)

						- Ted

---

From: Ken Raeburn <[email-masked]>
Date: Tue, 8 Sep 2009 14:56:32 -0400

On Sep 8, 2009, at 04:26, Raymond Brown wrote:
> unrealiable biometric data using cryptography.

If there's something better than the fuzzy-extractor stuff I saw a  
while back, I'd be interested to read about it.  The mechanisms I  
recall reading about involved a lot more communication and computation  
than the basic Kerberos protocol.  I think it required a significant  
fraction of a second between two machines on a local network, if I  
recall correctly.  But Kerberos KDCs may need to process tens of  
requests per second, maybe more at peak times at busy sites.  And  
Kerberos also needs to work with relatively poor communication links  
(e.g., 3G or worse).

> Stored and transmitted biometric data is hardened to be capture  
> resistant, cancelable and revocable. Assuming it is feasible to use  
> biometric data in Kerberos authentication, where do you see it being  
> utilised? Would it be used for generating keys? Could it be combined  

Aside from the CPU and communication concerns, yes, improving the  
cryptographic security of the initial authentication exchange is  
definitely a possibility.  I'd expect it to probably be used to  
generate one key, or some key-generation input data, to protect that  
exchange; the session key provided by the KDC would then protect later  
exchanges, as usual.

Ken