Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

From: "Raymond Brown" <[email-masked]>
Date: Fri, 04 Sep 2009 11:42:53 +0100

Thank you Thomas.

The background to this proposed system is the recent wide availability of low cost client based USB Fingerprint Readers performing local user (1:1 matching) indentification to their systems. An option to devise a system based on integration of Kerberos with 1:n matching is also considered. The basic aim is to use the fact that the user has biometrically authenticated to their system as a prerequisite  factor in their pre-authentication in Kerberos.

I can make no assurances to the integrity or security of the client in a 1:1 fingerprint matching in the most basic scenario and that remains a local issue as are any other choices users make about access to their local client. In a proposed system involving the 1:n matching scenario that consideration would change and present itself in much the same way as various client/server authentication models do. 

Both PKINIT and OTP lends useful comparisons / groundwork for this project. 

Regards
Raymond

-----Original Message-----
From: Thomas Hardjono <[email-masked]>
To: Raymond Brown <[email-masked]>, "[email-masked]" <[email-masked]>
Date: Thu, 3 Sep 2009 14:55:31 -0400
Subject: RE: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

Hi Raymond,

In my limited experience with fingerprint capabilities on some OEM platforms, the fingerprint match result (often called the "profile") is often used by the OEMs to unlock some BIOS-level credentials (which is the actual credential to then unlock other security-devices on the machine). Not so clean, but when dealing with BIOS nothing is ever clean :)

It would be a great project to see if a fingerprint result could be delivered through a pre-authentication protocol (that conforms to the FAST framework) to the KDC (augmented with fingerprint processing capabilities).  I don't know if you could wedge this feature into PKINIT or OTP. Perhaps a new pre-auth protocol could be devised.

cheers,

/thomas/

> -----Original Message-----
> From: [email-masked] [mailto:ietf-krb-wg-
> [email-masked]] On Behalf Of Raymond Brown
> Sent: Thursday, September 03, 2009 11:41 AM
> To: [email-masked]
> Cc: [email-masked]; [email-masked]
> Subject: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in
> Kerberos v5
> 
> Hi,
> 
> I'm an MSc student currently doing a paper on using Biometric
> (fingerprint) data for pre-authentication in Kerberos v5. The proposal
> is for the client to be identified to the KDC using verified biometric
> output as pre-authentication data. I propose an extension to the
> existing protocol, which will obviously take into consideration
> recommendations in the current draft ' A Generalized Framework for
> Kerberos Pre-Authentication', such as FAST. I propose adding the
> biometric authentication factor to the existing need for a password and
> would also propose an alternative option of replacing the password with
> a biometric input.
> 
> Can anyone advise me if you are aware of any existing work being done on
> this subject matter that could possibly assist me or anyone interested
> who can provide useful guidance.
> 
> Your response will be much appreciated.
> 
> Ray Brown
> MSc Computer Forensics and Security
> University of Bedfordshire
> email: [email-masked]
> 
> _______________________________________________
> ietf-krb-wg mailing list
> [email-masked]
> https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: "Raymond Brown" <[email-masked]>
Date: Fri, 04 Sep 2009 12:28:50 +0100

Thank you Russ.

Interesting point on where biometrics are most useful. Perhaps this relates to where Kerberos is most widely distributed. I am aware that any use of biometrics hanging off a local client is a weak link in any secure system. The proposed use of fingerprint biometrics delivers the commonly accepted advantages over the use of passwords and is intended to be used as an additional factor in Kerberos pre-authentication. How the fingerprint metrics are stored and transmitted is a major consideration in the proposed system.

Regards
Raymond

-----Original Message-----
From: Russ Allbery <[email-masked]>
To: [email-masked]
Date: Thu, 03 Sep 2009 20:14:00 -0700
Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

"Henry B. Hotz" <[email-masked]> writes:

> A concern I have (which is probably outside the scope of your research)
> is that a fingerprint profile plus a PIN has the *appearance* of a
> 2-factor authentication system.  However a practical deployment of such
> a system may not provide the reality because it depends critically on
> hardware outside the protocol chain.  For example a USB fingerprint
> reader's (or PIN reader's) interface might be easily sniffed and the
> relevant data replayed.  Since your fingerprint doesn't change this
> could be worse than having a password stolen.  My concern is that your
> resulting system not be advertised in terms that suggest security that
> isn't actually provided.

Yes, I would second this.  Biometric factors are the most useful when they
can be obtained in an environment that makes it difficult to replay
someone else's biometric data (either electronically or physically).
There's a huge difference in effective security between sending a set of
fingerprint metrics via a network protocol to a server and pressing one's
finger to a reader pad in the physical presence of a security guard.

You may be able to reproduce some of the security of the latter with
sufficient ingenuity in the hardware of the fingerprint reader, although
it would be hard to get all of it.

-- 
Russ Allbery ([email-masked])             <http://www.eyrie.org/~eagle/>
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: "Raymond Brown" <[email-masked]>
Date: Fri, 04 Sep 2009 12:12:59 +0100

Thank you Henry

FAST is definately the way to go and was designed to address such these types of situations - secure transmission of biometrically originated data with Kerberos pre-authentication. However, I haven't undertaken comparisons between FAST and TLS for that particular function.

PKINIT has some relevance and it is clear that fingerprints are neither passwords nor PIN numbers. I make the assumption that with the obvious security shortcomings of generated fingerprint templates & data that implementing cancelable / revocable biometrics would be a prerequisite prior to integrating with the proposed Kerberos pre-authentication system.

It should be noted that one of the aims of the proposed system is to offer a method, via a secure tansport medium (FAST),  an undefined level of client originated, pre-authenticated (verified) biometric data for use in Kerberos pre-authentication.
 
Regards
Raymond 

-----Original Message-----
From: "Henry B. Hotz" <[email-masked]>
To: Raymond Brown <[email-masked]>
Date: Thu, 3 Sep 2009 14:10:25 -0700
Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

As noted, a new pre-auth mech based on FAST would probably be the way  
to go.  (Possibly delivering the profile via TLS would be as good or  
better.)  I don't see PKINIT as relevant, and a fingerprint isn't "one  
time".

A concern I have (which is probably outside the scope of your  
research) is that a fingerprint profile plus a PIN has the  
*appearance* of a 2-factor authentication system.  However a practical  
deployment of such a system may not provide the reality because it  
depends critically on hardware outside the protocol chain.  For  
example a USB fingerprint reader's (or PIN reader's) interface might  
be easily sniffed and the relevant data replayed.  Since your  
fingerprint doesn't change this could be worse than having a password  
stolen.  My concern is that your resulting system not be advertised in  
terms that suggest security that isn't actually provided.

On Sep 3, 2009, at 8:41 AM, Raymond Brown wrote:

> (fingerprint) data for pre-authentication in Kerberos v5. The  
> proposal is for the client to be identified to the KDC using  
> verified biometric output as pre-authentication data. I propose an  
> extension to the existing protocol, which will obviously take into  
> consideration recommendations in the current draft ' A Generalized  
> Framework for Kerberos Pre-Authentication', such as FAST. I propose  
> adding the biometric authentication factor to the existing need for  
> a password and would also propose an alternative option of replacing  
> the password with a biometric input.
>
> Can anyone advise me if you are aware of any existing work being  
> done on this subject matter that could possibly assist me or anyone  
> interested who can provide useful guidance.
>

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email-masked], or [email-masked]

---

From: "Raymond Brown" <[email-masked]>
Date: Fri, 04 Sep 2009 15:53:02 +0100

Thank you Ken.

I have researched the area of key generation from Biometrics and I am familiar with the paper by Dodis et al. The Japanese paper you attached a link for has also cropped up but I have not seen (as yet) this paper, it contents or indeed any academic reference to work undertaken by it. 

The links you provided of previous discussions on the matter are useful. Thank you for your sentiments also!

Regards
Raymond

-----Original Message-----
From: Ken Raeburn <[email-masked]>
To: Raymond Brown <[email-masked]>
Date: Fri, 4 Sep 2009 09:29:36 -0400
Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

> interested who can provide useful guidance.

The idea has come up before, though I don't know how much actual work  
has been done in the area.

It appears at least one proposal has been published, though I haven't  
found an online copy available without payment and have no idea how  
good it is, though the abstract says it's designed to prevent spoofing  
and biometric data leakage: http://sciencelinks.jp/j-east/article/200610/000020061006A0308020.php 
  .

Some previous discussion on this list:
https://lists.anl.gov/pipermail/ietf-krb-wg/2004-January/thread.html  
(listed under several threads)
https://lists.anl.gov/pipermail/ietf-krb-wg/2008-August/007060.html  
(and two followups)

You might also want to look up "Fuzzy Extractors: How to Generate  
Strong Keys from Biometrics and Other Noisy Data" by Dodis et al.  If  
it's the paper I remember skimming some time ago, it may not be ideal  
for Kerberos in its current form, but it's an interesting bit of work.

Good luck with your paper.

Ken

---

From: "Raymond Brown" <[email-masked]>
Date: Tue, 08 Sep 2009 10:15:22 +0100

Tim, 

My thoughts exactly. Having worked in the Police service I have had to access systems where there has been a requirement for additional authentication at the workstation. I agree with your point that more Kerberos enabled applications will increase the interest in using biometrics for TGTs.  I believe that currently the acceptance level of certain biometrics (fingerprint) are high and there are many proprietary authentication systems which are adopting a level of 'uniformity' particularly around the security aspects; securing of templates, etc.

I like the suggestion of using biometrics with OTP to give customers a multi-factor authentication option. You could start with a basic password authentication and have the option of adding biometrics or OTP or any combination of the 3. 

Thanks
Ray

-----Original Message-----
From: Tim Alsop <[email-masked]>
To: Raymond Brown <[email-masked]>, "[email-masked]" <[email-masked]>
Date: Tue, 8 Sep 2009 09:34:32 +0100
Subject: RE: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

Ray,

I have seen biometric user authentication (e.g. fingerprint, facial recognition, retinal scan) being used in cases where users are logging onto sensitive/critical applications. The authentication of the user in this case occurs on the workstation, and typically every time the user logs onto the application. The applications involved are often not yet 'Kerberos enabled', but as more and more business applications become 'Kerberos enabled' the need for using Kerberos to get a TGT via a biometric is getting greater. At moment, biometric hardware vendors provide software and toolkits which are often proprietary which means a customer has to 'buy into' a particular vendor solution for their biometric authentication needs. If it was instead possible to use a standards based user authentication approach and remove the need for proprietary technology, I feel this would increase the adoption of such technology and give customers more choices.

Also, (like with OTP) it should be possible based on policy to require a password as well as biometric, or just biometric without password. Also, using authentication sets in FAST would mean that biometric pre-auth can be combined with OTP auth to give multi-factor authentication if the customer wants to implement this level of authentication.

Thanks,
Tim

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Raymond Brown
Sent: 08 September 2009 09:27
To: [email-masked]
Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

What do you see as being the main reasons why biometric data has not been used in authentication in Kerberos to date?

Techniques have been developed to produce keys from noisy and unrealiable biometric data using cryptography. Stored and transmitted biometric data is hardened to be capture resistant, cancelable and revocable. Assuming it is feasible to use biometric data in Kerberos authentication, where do you see it being utilised? Would it be used for generating keys? Could it be combined with a password to be more secure?

---

From: "Raymond Brown" <[email-masked]>
Date: Tue, 08 Sep 2009 10:36:15 +0100

Thank you Howard. 

The secure use of biometric data is a major consideration. Adding a salt, biometric lock, fuzzy key extractors, etc.., are proposed methods of biometric data protection that assist in making it a worthwhile proposition for use in Kerberos.  

Regards
Ray

-----Original Message-----
From: Howard Chu <[email-masked]>
To: Raymond Brown <[email-masked]>
Date: Tue, 08 Sep 2009 01:37:28 -0700
Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

Raymond Brown wrote:
> What do you see as being the main reasons why biometric data has not been
used in authentication in Kerberos to date?
>
> Techniques have been developed to produce keys from noisy and unrealiable
biometric data using cryptography. Stored and transmitted biometric data is
hardened to be capture resistant, cancelable and revocable. Assuming it is
feasible to use biometric data in Kerberos authentication, where do you see it
being utilised? Would it be used for generating keys? Could it be combined
with a password to be more secure?

You probably want to at least combine it with a salt so that a particular 
instance can be revokable, without totally invalidating the original source of 
the biometric data. ("Your retina scan has expired. Please insert other eye:" ...)

-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/

---

From: "Raymond Brown" <[email-masked]>
Date: Thu, 10 Sep 2009 18:48:10 +0100

Having checked out various methods based around fuzzy extractors and combining biometrics with cryptography I think I've arrived, rather late in the day perhaps, at the point Ken made about communication and computation overheads. By adding complex maths and cryptography to protect the biometric data (the user's identity in effect) at the client and in transmission, it does become overly cumbersome.  If a user is expected to pre-register that biometric data in advance with the KDC, the verification check and the use of the biometric data for key encryption will need to happen in a streamline and low overhead manner.

-----Original Message-----
From: Ken Raeburn <[email-masked]>
To: Raymond Brown <[email-masked]>
Date: Tue, 8 Sep 2009 14:56:32 -0400
Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

On Sep 8, 2009, at 04:26, Raymond Brown wrote:
> Techniques have been developed to produce keys from noisy and  
> unrealiable biometric data using cryptography.

If there's something better than the fuzzy-extractor stuff I saw a  
while back, I'd be interested to read about it.  The mechanisms I  
recall reading about involved a lot more communication and computation  
than the basic Kerberos protocol.  I think it required a significant  
fraction of a second between two machines on a local network, if I  
recall correctly.  But Kerberos KDCs may need to process tens of  
requests per second, maybe more at peak times at busy sites.  And  
Kerberos also needs to work with relatively poor communication links  
(e.g., 3G or worse).

> Stored and transmitted biometric data is hardened to be capture  
> resistant, cancelable and revocable. Assuming it is feasible to use  
> biometric data in Kerberos authentication, where do you see it being  
> utilised? Would it be used for generating keys? Could it be combined  

Aside from the CPU and communication concerns, yes, improving the  
cryptographic security of the initial authentication exchange is  
definitely a possibility.  I'd expect it to probably be used to  
generate one key, or some key-generation input data, to protect that  
exchange; the session key provided by the KDC would then protect later  
exchanges, as usual.

Ken

---

From: "Raymond Brown" <[email-masked]>
Date: Thu, 10 Sep 2009 23:39:42 +0100

Good question Henry. Having first looked at the current pre-auth framework draft proposal to update RFC4120, further extension to the protocol to support biometrics appears now to be a worthwhile consideration and FAST makes a significant contribution. The aim of my research is to establish a standards track through a proposed extension to the protocol to support biometrics, hence this discussion in the ietf-krb-wg.

-----Original Message-----
From: "Henry B. Hotz" <[email-masked]>
To: [email-masked]
Date: Thu, 10 Sep 2009 13:39:26 -0700
Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication	in Kerberos v5

I know I started this digression, and there have been many eloquent  
arguments about why biometric authentication isn't everything it's  
cracked up to be, but. . .

Is there protocol work to be done to support biometric authentication  
that's in-scope for this WG?

 From a purely technical standpoint it could be an interesting  
problem.  If the security considerations section of an RFC is honest  
about the applicability and limitations (and there is a reasonable  
usage scenario that doesn't require a guard with an M16), I can  
imagine supporting protocol extensions.
------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email-masked], or [email-masked]

---

From: "Raymond Brown" <[email-masked]>
Date: Fri, 11 Sep 2009 02:54:15 +0100

Thank you Joe.

So establishing trust with the client and the attached biometric device (say fingerprint reader) is a very important consideration if the server is to verify an identity using biometrics over the network. Perhaps gathering additional, multiple, non-biometric identification from the client using hardware and software methods and beyond acquiring an IP address, Timestamp, etc., appears to be a prerequsite to the server trusting biometrics originating from that client. Other methods of establishing trust between a client and server also needs to be considered.  Trying to present a non-proprietary solution to a set of problems that would normally be solved using solutions tailored specifically to the users need makes this all the more challenging.  

-----Original Message-----
From: "Pato, Joe (HP Labs (at MIT))" <[email-masked]>
To: Raymond Brown <[email-masked]>, "[email-masked]" <[email-masked]>
Date: Thu, 10 Sep 2009 19:45:20 +0000
Subject: RE: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

Raymond asks: " But how much difference will establishing a trust relationship between a Server and client make to using biometrics for authentication?"

All the difference in the world. Biometrics work well(*) when they are used as part of a supervised ceremony. When the relying party knows that the biometric sample was presented by a genuine and willing individual (rather than an artifact that mimics the target individual's biometric trait or by someone who is being compelled to present their trait). When there is human supervision, this genuine and willing condition can be reasonably determined.

When there is no human supervision and we are dealing with network verification of identity, then we must rely on hardware on the client to serve as the surrogate for human supervision. Now, we need to have a trust relationship between the KDC and the client to determine that the purported biometric sample was genuinely presented to a sensor and client processing environment that has been hardened to an appropriate level. If there is no relationship between the KDC and the client, then any manner of attack on the biometric data can take place. Fake artifacts (e.g., "gummy fingers"[1]) can be presented to the sensor from captured images of the trait; for some modalities, presumed one-way transformed template data can be reverse transformed to create images that match the original[2]; or the client can bypass the data capture at the sensor entirely and be driven to used captured intermediary forms.

If the server is going to rely on data from the client about a purported biometric scan, it needs to have confidence that the execution environment on the client is actually performing the scan and that it has techniques to verify "liveness".

(*) biometrics work well in supervised contexts modulo an understanding of the error rates, of the probabilities of an attacker presenting to the sensor, and an understanding of the probabilities of a "biometric doppelganger"[3] existing in the population.

- joe

[1] Matsumoto, Matsumoto, Yamada and Hoshino. 2002. "Impact of Artificial "Gummy" Fingers on Fingerprint Systems." SPIE Vol. #4677, Optical Security and Counterfeit Deterrence 
[2] Jianjiang Feng and Anil K. Jain "FM Model Based Fingerprint Reconstruction from Minutiae Template" ICB2009
[3] Boult & Woodworth "Privacy and Security Enhancements in Biometrics" in Ratha, N. K., Govindaraju, V. (Eds.) (2007). Advances in biometrics: Sensors, algorithms and systems.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Raymond Brown
Sent: Thursday, September 10, 2009 2:43 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

Thank you Simo.

A Smart Card solution appears to have the edge when it comes to using biometrics for network authentication / access and this is evident by the backing of standards and certifications such as FIPS201 (in US) for PIV as mentioned previously by Shivaram. It alleviates the need to processing and storage of the biometrics on the client but it is evidently costly. 

The vision of 'untrusted clients' gaining access to network resources via biometrics appears to have taken our discussion back along a well worn path, one littered with dongles, TPMs, Smart Cards and other bits of proprietary hardware and software. But how much difference will establishing a trust relationship between a Server and client make to using biometrics for authentication? 

-----Original Message-----
From: Simo Sorce <[email-masked]>
To: Theodore Tso <[email-masked]>
Date: Thu, 10 Sep 2009 12:44:38 +0000
Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

On Wed, 2009-09-09 at 21:51 -0400, Theodore Tso wrote:
> 
> Which is why I repeat my earlier assertion --- unless you have an
> Armed Guard with Big Gun to assure that someone isn't spoofing the
> biometric measurement device, and that the biometric measurement
> device isn't (a) compromised by a malicious user, and (b) the device
> is receiving data from the live human which is trying to gain access
> to the Resource, biometric security devices like those used on laptops
> and doors, are largely Security Theatre.  They look good, but it's
> mostly for show (and for extracting money from gullible business
> people :-)

I think it was mentioned before, but there is another way, that involve
a smartcard with embedded sensor. In that case the smartcard uses the
fingerprint/FPAV/retinascan only as a sort of PIN to unlock the
credentials.

You have to steal both the smartcard and the biometric used to be able
to impersonate the user, and the smartcard can be replaced.
Users must be taught to never use any other sensor but the one embedded
in their smartcard for this to be more effective, but a stolen biometric
alone will give you access to nothing.

The problem with a device like this is that costs might be high.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York

---

From: "Raymond Brown" <[email-masked]>
Date: Fri, 11 Sep 2009 03:06:29 +0100

Thomas I agree that hardware cost need not be an issue, especially when you look at the majority of situations (installations) where biometrics could be used with Kerberos. Some installations require a level of security that will undoubtedly go beyond what is being proposed here. The client is the weak link in the security of the network and currently the level of trust needs to be raised to mitigate the security risks. Microsoft server operating systems  now routinely check the security status of attaching clients and can alter status or refuse access to network services accordingly. Establishing the appropriate level of trust in the client by way of software or hardware (or combined) as previously mentioned by Joe is essential and your comment about 'change' rings true.

-----Original Message-----
From: Thomas Hardjono <[email-masked]>
To: "[email-masked]" <[email-masked]>
Date: Thu, 10 Sep 2009 16:09:52 -0400
Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication	in	Kerberos v5

________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Theodore Tso [[email-masked]]
Sent: Thursday, September 10, 2009 3:31 PM
To: Simo Sorce
Cc: [email-masked]
Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in      Kerberos v5

> For example, if you are using a Thinkpad with a built-in fingerprint
> scanner, and a TCPA chip, the fact that the fingerprint scanner is not
> directly wired to the TCPA chip means that a bad guy who has (a)
> stolen the user's fingerprints (perhaps by lifting it from a water
> glass or from a CD case --- as was done on Mythbusters), and (b) has
> stolen the laptop can replay the fingerprint pattern to the TCPA chip,
> and the TCPA chip has no idea whether the fingerprint pattern was
> freshly scanned or inserted by the bad guy, despite the fact that the
> fingerprint reader and the TCPA chip are physically on the same
> laptop.

> If the TCPA chip was actually built into fingerprint scanner, with
> sufficient anti-tamper circuits to defeat a bad guy from being able to
> remove the chip, and either (a) feed in a faked fingerprint pattern,
> or (b) read the key off of the chip directly, then this sort of thing
> can be made secure, to at least some degree.  At the end of the day,
> though it still requires trusted hardware sufficient to prevent some
> amount of determined tampering.  Doing such a thing is extremely
> difficult, and given that most people aren't willing to pay much for
> security in terms of cost or convenience, it remains the case that
> most Biometrics available on the market (including the fingerprint
> reader on most Laptop computers) are nothing but Security Theatre.
>
>                                            - Ted

Security is really a matter of cost as we all know and are fond of saying.
If an attacker really wants to get to the data, he/she can do some
"surgery" to either the TPM chip (TCPA) or the smartcard.
Similarly, IT buyers see security as a cost (to shell out) or
expense to provide "protection" (data, network, etc. etc) -- real or theatre.

The cost of security hardware really should not be an issue today.
Dell has been shipping the Latitude laptop series now for over 2 years with
built-in (a) finger-print scanner, (b) TPM v1.2 chip and (c) SmartCard reader.
So you don't really have to build-in a scanner within a TPM. Its all there and
connected via hardware. Just have to get the IT Admin to activate and use it.

So, IMHO, cost of hardware is not an issue. Getting an IT buyer to deploy
these existing hardware solutions is an issue, since it means "change".
Unless something drastic happens (eg. corporate IT was hacked, and corporate
data was lost), then there is no incentive for the IT folks to deploy
better security. Plus security vendors generally just want
to sell their existing solutions :-)

/thomas/

---

From: "Pato, Joe (HP Labs (at MIT))" <[email-masked]>
Date: Thu, 10 Sep 2009 19:57:10 +0000

Resending after correcting my address on the Kerberos list

-----Original Message-----
From: Pato, Joe (HP Labs (at MIT)) 
Sent: Thursday, September 10, 2009 3:45 PM
To: 'Raymond Brown'; [email-masked]
Cc: [email-masked]
Subject: RE: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

- joe

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Raymond Brown
Sent: Thursday, September 10, 2009 2:43 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

Thank you Simo.

-----Original Message-----
From: Simo Sorce <[email-masked]>
To: Theodore Tso <[email-masked]>
Date: Thu, 10 Sep 2009 12:44:38 +0000
Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

Simo.