Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

From: "Raymond Brown" <[email-masked]>
Date: Thu, 10 Sep 2009 19:43:16 +0100

Thank you Simo.

A Smart Card solution appears to have the edge when it comes to using biometrics for network authentication / access and this is evident by the backing of standards and certifications such as FIPS201 (in US) for PIV as mentioned previously by Shivaram. It alleviates the need to processing and storage of the biometrics on the client but it is evidently costly. 

The vision of 'untrusted clients' gaining access to network resources via biometrics appears to have taken our discussion back along a well worn path, one littered with dongles, TPMs, Smart Cards and other bits of proprietary hardware and software. But how much difference will establishing a trust relationship between a Server and client make to using biometrics for authentication? 

-----Original Message-----
From: Simo Sorce <[email-masked]>
To: Theodore Tso <[email-masked]>
Date: Thu, 10 Sep 2009 12:44:38 +0000
Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

On Wed, 2009-09-09 at 21:51 -0400, Theodore Tso wrote:
> 
> Which is why I repeat my earlier assertion --- unless you have an
> Armed Guard with Big Gun to assure that someone isn't spoofing the
> biometric measurement device, and that the biometric measurement
> device isn't (a) compromised by a malicious user, and (b) the device
> is receiving data from the live human which is trying to gain access
> to the Resource, biometric security devices like those used on laptops
> and doors, are largely Security Theatre.  They look good, but it's
> mostly for show (and for extracting money from gullible business
> people :-)

I think it was mentioned before, but there is another way, that involve
a smartcard with embedded sensor. In that case the smartcard uses the
fingerprint/FPAV/retinascan only as a sort of PIN to unlock the
credentials.

You have to steal both the smartcard and the biometric used to be able
to impersonate the user, and the smartcard can be replaced.
Users must be taught to never use any other sensor but the one embedded
in their smartcard for this to be more effective, but a stolen biometric
alone will give you access to nothing.

The problem with a device like this is that costs might be high.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Simo Sorce <[email-masked]>
Date: Thu, 10 Sep 2009 15:47:52 -0400

On Thu, 2009-09-10 at 19:43 +0100, Raymond Brown wrote:
> But how much difference will establishing a trust relationship between
> a Server and client make to using biometrics for authentication? 

I honestly think the trust between the server and the device reading the
biometrics makes all the difference between being able to use biometrics
at all or not.

Because of the nature of biometrics you can't use them like passwords,
and you can't make the same assumptions you make when dealing with
passwords when it comes to the trust between server and client.

Simo.

---

From: Simo Sorce <[email-masked]>
Date: Thu, 10 Sep 2009 15:54:04 -0400

On Thu, 2009-09-10 at 19:45 +0000, Pato, Joe (HP Labs (at MIT)) wrote:
> When the relying party knows that the biometric sample was presented
> by a genuine and willing individual (rather than an artifact that
> mimics the target individual's biometric trait or by someone who is
> being compelled to present their trait). When there is human
> supervision, this genuine and willing condition can be reasonably
> determined.

I agree with you except for the willingness requirement. In network
facing applications willingness cannot be measured anyway (a password
can be forced out), so that is not a relevant factor in this kind of
discussion.

Simo.

---

From: "Pato, Joe (HP Labs (at MIT))" <[email-masked]>
Date: Thu, 10 Sep 2009 19:45:20 +0000

Raymond asks: " But how much difference will establishing a trust relationship between a Server and client make to using biometrics for authentication?"

All the difference in the world. Biometrics work well(*) when they are used as part of a supervised ceremony. When the relying party knows that the biometric sample was presented by a genuine and willing individual (rather than an artifact that mimics the target individual's biometric trait or by someone who is being compelled to present their trait). When there is human supervision, this genuine and willing condition can be reasonably determined.

When there is no human supervision and we are dealing with network verification of identity, then we must rely on hardware on the client to serve as the surrogate for human supervision. Now, we need to have a trust relationship between the KDC and the client to determine that the purported biometric sample was genuinely presented to a sensor and client processing environment that has been hardened to an appropriate level. If there is no relationship between the KDC and the client, then any manner of attack on the biometric data can take place. Fake artifacts (e.g., "gummy fingers"[1]) can be presented to the sensor from captured images of the trait; for some modalities, presumed one-way transformed template data can be reverse transformed to create images that match the original[2]; or the client can bypass the data capture at the sensor entirely and be driven to used captured intermediary forms.

If the server is going to rely on data from the client about a purported biometric scan, it needs to have confidence that the execution environment on the client is actually performing the scan and that it has techniques to verify "liveness".

(*) biometrics work well in supervised contexts modulo an understanding of the error rates, of the probabilities of an attacker presenting to the sensor, and an understanding of the probabilities of a "biometric doppelganger"[3] existing in the population.

- joe

[1] Matsumoto, Matsumoto, Yamada and Hoshino. 2002. "Impact of Artificial "Gummy" Fingers on Fingerprint Systems." SPIE Vol. #4677, Optical Security and Counterfeit Deterrence 
[2] Jianjiang Feng and Anil K. Jain "FM Model Based Fingerprint Reconstruction from Minutiae Template" ICB2009
[3] Boult & Woodworth "Privacy and Security Enhancements in Biometrics" in Ratha, N. K., Govindaraju, V. (Eds.) (2007). Advances in biometrics: Sensors, algorithms and systems.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Raymond Brown
Sent: Thursday, September 10, 2009 2:43 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

Thank you Simo.

-----Original Message-----
From: Simo Sorce <[email-masked]>
To: Theodore Tso <[email-masked]>
Date: Thu, 10 Sep 2009 12:44:38 +0000
Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

Simo.

---

From: "Pato, Joe (HP Labs (at MIT))" <[email-masked]>
Date: Thu, 10 Sep 2009 20:03:10 +0000

Yes, I typed too quickly. In the human supervised case, willingness on the part of the data subject can (in many cases) be determined. Over the network, we have to forego this goal.

- joe

-----Original Message-----
From: Simo Sorce [mailto:[email-masked]] 
Sent: Thursday, September 10, 2009 3:54 PM
To: Pato, Joe (HP Labs (at MIT))
Cc: Raymond Brown; [email-masked]
Subject: RE: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

Simo.