Subject: [Ietf-krb-wg] Use of Biometric data for Pre-authentication in Kerberos v5

From: "Raymond Brown" <[email-masked]>
Date: Tue, 29 Sep 2009 14:39:08 +0100

Biometrics as a FAST factor in Kerberos pre-authentication 

Following on from our earlier discussions on biometric pre-authentication, I am looking at a scenario which involves; a Client with a Fingerprint Reader device attached, a KDC and a Biometric Authentication Server.

If a KDC policy requires that the Client pre-authenticates using biometrics then a scan of the User’s fingerprint would be sent to the KDC and then Biometric Authentication Server.  So we have biometric data transmitted between the Client and KDC and KDC and Biometric Authentication Server.

FAST provides a protected channel between the Client and the KDC and given the  recommendations in the current draft proposal for OTP pre-authentication, which suggests that the Reply Key is replaced by a key generated from the OTP and Armor Key, would this scenario be the similar using biometrics? Admittedly, an OTP value and a biometric value are somewhat different.

Could FAST provide the same benefits to the use of biometrics as a pre-authentication mechanism, as it promises with OTP; ‘client-authentication, replacing-reply-key and KDC-authentication?’ How well does biometrics fit into the concept of using ‘plug-in’ architectures for Kerberos pre-authentication? 

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Sam Hartman <[email-masked]>
Date: Tue, 29 Sep 2009 12:04:27 -0400

My first guess is that biometrics over FAST would be easier to design than biometric pre-auth without FAST, for some of the same reasons as OTP.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg