Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

From: "Raymond Brown" <[email-masked]>
Date: Tue, 08 Sep 2009 19:16:59 +0100

Thank you Greg.

I should have added to the paragraph quoted; "... when you reduce them down to a function within Kerberos authentication. "  

The glaring fatal flaw with biometrics that you refer to has been a major consideration for the industry for some time and as I've mentioned previously in these discussions, has been a matter addressed by many developers and researchers.  Clearly, no one will trust biometrics that aren't cancelable, revocable, capture resistant, disposable, etc..  Admittedly, at the point of scanning, if your fingerprint is compromised then an attacker has your scanned fingerprints, which he could also have lifted from a glass you drank from and so on. My concern is with the biometric data (once the fingerprint is no longer a fingerprint) at the earliest point of it's origin in the authentication process. I have confidence in some (not all) of the current methods that enable a standard fingerprint reader to produce biomteric data that can be used in Kerberos. Admittedly, performance tests have to be conducted on each as some techniques which adds the required protection to the biometric data,
  can adversely affects the reliability of matches, etc.

The proposition of using biometric data for authentication in Kerberos would not have been a serious contemplation if we couldn't first establish confidence in the secure use, storage, transmission of biometric data. The use of cryptography and other techniques on securing biometric data has raise the confidence level, hence this discussion is possible and that needs to be agreed upon. Mitigating the risks associated with biometric data being compromised is essential and very much a prerequisite for interfacing with Kerberos. A checklist of solutions to all the big questions about using biometrics must be the green light for a project of this nature.
 
Regards
Ray

-----Original Message-----
From: Greg Hudson <[email-masked]>
To: Raymond Brown <[email-masked]>
Date: Tue, 08 Sep 2009 12:01:12 -0400
Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

On Tue, 2009-09-08 at 10:44 -0400, Raymond Brown wrote:
> Surely we are talking about a step up from passwords.  Treating
> biometrics like passwords has it's advantages and disadvantages but
> essentially there are more similarities than differences when you
> reduce them down to a function.

I think there's a pretty important difference.  A big problem with
passwords is that once you type it into a computing device, that
computing device could (if malicious or compromised) store the password
and use it again in the future.  This problem is magnified if you
transmit passwords to remote services.

You mitigate this problem with a password reset policy.  If I'm forced
to change my password once a month, then someone might maliciously
authenticate as me using a password stolen last week, but not one stolen
years ago.  You cannot mitigate this same risk with biometric data.
Once I scan my fingerprint (or vein pattern, or whatever) into a
compromised machine and it gets sent off to the mafia server farm, I
can't reset it.

There are obviously some advantages of biometric data over passwords,
but I'm not sure that matters if there's a glaring fatal flaw.  (I'm
speaking specifically about using biometrics to replace passwords as
long-term keys in a network authentication system; other uses of
biometrics may not have the same concern.)

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Theodore Tso <[email-masked]>
Date: Wed, 9 Sep 2009 21:51:52 -0400

On Tue, Sep 08, 2009 at 07:16:59PM +0100, Raymond Brown wrote:
> The glaring fatal flaw with biometrics that you refer to has been a
> major consideration for the industry for some time and as I've
> mentioned previously in these discussions, has been a matter
> addressed by many developers and researchers.  Clearly, no one will
> trust biometrics that aren't cancelable, revocable, capture
> resistant, disposable, etc..  Admittedly, at the point of scanning,
> if your fingerprint is compromised then an attacker has your scanned
> fingerprints, which he could also have lifted from a glass you drank
> from and so on.

As you put it, this is the fatal flaw with biometrics.  I don't see
how Finger Vein Authentication Technology solves this problem.  It may
be somewhat harder to steal than a fingerprint, but the moment these
start getting used for, say, authenticating credit card transactions,
a malicious shopkeeper could simply use a specially hacked unit which
measures his customer's vein patterns.  Worse yet, even if MasterCard
and Visa hasn't started using biometrics, a malicious shopkeeper could
probably install such a unit, claim it was used for secure credit card
transactions, and large number of sheeple will probably fall for it.

After all, if people fall for password phishing e-mails claiming that
they need to reply to an e-mail sending their first name, last name,
birthdate, SSN, and password to someone claiming that they are from
the "MIT Help Desk", I bet a large number of shoppers will comply if a
shopkeeper asks them to place their thumb on a scanner "for security
purposes".

Once the malicious shopkeeper has grabbed the user's fingerprint vein
patterns, they will be able to convert it into a Kerberos key using
whatever scheme you propose --- and the user's security has been
compromised permanently.  (Unless you want to tell us how they can
change their vein patterns after they have been recorded by a
malicious shopkeeper!)

Which is why I repeat my earlier assertion --- unless you have an
Armed Guard with Big Gun to assure that someone isn't spoofing the
biometric measurement device, and that the biometric measurement
device isn't (a) compromised by a malicious user, and (b) the device
is receiving data from the live human which is trying to gain access
to the Resource, biometric security devices like those used on laptops
and doors, are largely Security Theatre.  They look good, but it's
mostly for show (and for extracting money from gullible business
people :-)

     	 	    	       			     - Ted

---

From: Simo Sorce <[email-masked]>
Date: Thu, 10 Sep 2009 12:44:38 +0000

> mostly for show (and for extracting money from gullible business

I think it was mentioned before, but there is another way, that involve
a smartcard with embedded sensor. In that case the smartcard uses the
fingerprint/FPAV/retinascan only as a sort of PIN to unlock the
credentials.

You have to steal both the smartcard and the biometric used to be able
to impersonate the user, and the smartcard can be replaced.
Users must be taught to never use any other sensor but the one embedded
in their smartcard for this to be more effective, but a stolen biometric
alone will give you access to nothing.

The problem with a device like this is that costs might be high.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York

---

From: Theodore Tso <[email-masked]>
Date: Thu, 10 Sep 2009 15:31:32 -0400

> The problem with a device like this is that costs might be high.

Yep, agreed.  In that case, Kerberos doesn't actually have to do
anything special, except maybe interface with the device which is
holding the keys.  The real problem with this sort of thing is the
cost.  The sensor has to be wired directly to the device that holds
the keys.

For example, if you are using a Thinkpad with a built-in fingerprint
scanner, and a TCPA chip, the fact that the fingerprint scanner is not
directly wired to the TCPA chip means that a bad guy who has (a)
stolen the user's fingerprints (perhaps by lifting it from a water
glass or from a CD case --- as was done on Mythbusters), and (b) has
stolen the laptop can replay the fingerprint pattern to the TCPA chip,
and the TCPA chip has no idea whether the fingerprint pattern was
freshly scanned or inserted by the bad guy, despite the fact that the
fingerprint reader and the TCPA chip are physically on the same
laptop.   

If the TCPA chip was actually built into fingerprint scanner, with
sufficient anti-tamper circuits to defeat a bad guy from being able to
remove the chip, and either (a) feed in a faked fingerprint pattern,
or (b) read the key off of the chip directly, then this sort of thing
can be made secure, to at least some degree.  At the end of the day,
though it still requires trusted hardware sufficient to prevent some
amount of determined tampering.  Doing such a thing is extremely
difficult, and given that most people aren't willing to pay much for
security in terms of cost or convenience, it remains the case that
most Biometrics available on the market (including the fingerprint
reader on most Laptop computers) are nothing but Security Theatre.

       	       	      		     	     - Ted

---

From: Thomas Hardjono <[email-masked]>
Date: Thu, 10 Sep 2009 16:09:52 -0400

________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Theodore Tso [[email-masked]]
Sent: Thursday, September 10, 2009 3:31 PM
To: Simo Sorce
Cc: [email-masked]
Subject: Re: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in      Kerberos v5

> reader on most Laptop computers) are nothing but Security Theatre.

Security is really a matter of cost as we all know and are fond of saying.
If an attacker really wants to get to the data, he/she can do some
"surgery" to either the TPM chip (TCPA) or the smartcard.
Similarly, IT buyers see security as a cost (to shell out) or
expense to provide "protection" (data, network, etc. etc) -- real or theatre.

The cost of security hardware really should not be an issue today.
Dell has been shipping the Latitude laptop series now for over 2 years with
built-in (a) finger-print scanner, (b) TPM v1.2 chip and (c) SmartCard reader.
So you don't really have to build-in a scanner within a TPM. Its all there and
connected via hardware. Just have to get the IT Admin to activate and use it.

So, IMHO, cost of hardware is not an issue. Getting an IT buyer to deploy
these existing hardware solutions is an issue, since it means "change".
Unless something drastic happens (eg. corporate IT was hacked, and corporate
data was lost), then there is no incentive for the IT folks to deploy
better security. Plus security vendors generally just want
to sell their existing solutions :-)

/thomas/

---

From: "Henry B. Hotz" <[email-masked]>
Date: Thu, 10 Sep 2009 13:39:26 -0700

I know I started this digression, and there have been many eloquent  
arguments about why biometric authentication isn't everything it's  
cracked up to be, but. . .

Is there protocol work to be done to support biometric authentication  
that's in-scope for this WG?

 From a purely technical standpoint it could be an interesting  
problem.  If the security considerations section of an RFC is honest  
about the applicability and limitations (and there is a reasonable  
usage scenario that doesn't require a guard with an M16), I can  
imagine supporting protocol extensions.
------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email-masked], or [email-masked]

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 10 Sep 2009 18:31:20 -0400

> that's in-scope for this WG?

<hat style=chair>
According to my reading of the present charter, no.  The present charter is 
not nearly as open-ended as the original one, by design.  Of course, the 
charter could be modified, but that would require a clear statement of the 
work to be done and a demonstration that there are enough people willing to 
contribute to and review the work.  I would also want to see a consensus 
that the proposed work is a good idea and worth doing, and so far I'm not 
seeing that.
</hat>

-- Jeff