Subject: QC's - for human eyes only?

From: Ilan Shacham <[email-masked]>
Date: Sun, 5 Dec 1999 14:39:13 +0200

Hi all,
Section 3.2.4 of the QC profile, which describes the biometricInfo 
extension states:

"   ...This extension SHALL only be used to store a hash of biometric
   information suitable for human verification, i.e. where decision
   whether this information is an accurate representation of the subject
   is performed by a physical person. This implies a usage where the
   biometric information is represented by for example a graphical
   image, displayed to the relying party, which MAY be used by the
   relying party to enhance identification of the subject..."

I don't see why we should limit ourselves in such a way, and not allow
for machine verification of biometric data (such as finger-prints, etc.).
It seems to me that even if today biometrics aren't advanced enough,
we should not limit ourselves towards the future.

Another shortcoming of the biometricInfo extension, is that it does
not allow for the actual biometric data to be included, but instead
mandates the data to be accessed through a URI. This approach
may be relevent today, when biometric data is large, and memory
on smartcards is limited, but surely advances in the future would
allow the actual biometric data to be put in the certificate, it would
be a shame to create a new extension for ActualBiometricInfo...
I could also see why it would be relevent not to rely on the network
for maintaining all the information needed to validate a certificate.

Comments?

Ilan

------------------------------------------------------------------------
Ilan Shacham				mailto:[email-masked]
Algorithmic Research Ltd.		http://www.arx.com
10 Nevatim St.,			phone:	972 - 3 - 9279540
Petach-Tikva, Israel			Fax:	972 - 3 - 9230864

---

From: Eric Murray <[email-masked]>
Date: Sun, 5 Dec 1999 09:00:39 -0800

> we should not limit ourselves towards the future.

There's nothing preventing one from sending the biometric outside the
certificate to be machine verified.  The hash is there to tie that into
the cert.

> be a shame to create a new extension for ActualBiometricInfo...

Actually, that would make sense.  Since there are a number of
different ways of representing biometric data, there would need to
be some indication of which method (and which biometric) was used. 
A seperate extension could describe that in the OID, rather than
needing to put that data in the extension itself.

It's possible to shrink some biometric information down small enough to
get it on a smartcard with no problem-  I have done some work in the
past which allowed me to accurately represent a fingerprint in at little
as 100 bytes... if both biometric readers use the same algorithm for
finding minutae and matching them, all you need to send are the minutae
points themselves.

However putting a biometric in a certificate is like putting your Social
Security Number and mother's maiden name in a certificate- it would
allow anyone who receives the certificate to be able to use those
irrevocable identifiers to impersonate you.  So biometric data should
only be sent encrypted in a session key, if it's ever sent at all.

-- 
 Eric Murray www.lne.com/~ericm  ericm at the site lne.com  PGP keyid:E03F65E5

---

From: Tony Bartoletti <[email-masked]>
Date: Mon, 06 Dec 1999 11:05:22 -0800

>only be sent encrypted in a session key, if it's ever sent at all.

This is why "irrevocables" should never be relied upon as identifiers.

I intend to publish my own photographs, fingerprints, retinal scans and
DNA traces to public fora, precisely to diminish reliance upon them as
evidence of "me"!  I hope to start a global movement...

Seriously, my philosophic problem with biometrics is that, while the
"body" is somewhat of a constant, the "person" is not, especially with
respect to time and circumstance.  Yet (undo) reliance upon biometrics
tends to reinforce the notion of "once an X, always an X".  That is,
it will encourage the limitation of "trust" calculations to constants.

___tony___  

Tony Bartoletti                                             LL
IOWA Center                                              LL LL
Lawrence Livermore National Laboratory                LL LL LL
PO Box 808, L - 089                                   LL LL LL
Livermore, CA 94551-9900                              LL LL LLLLLLLL
phone: 925-422-3881   fax: 925-423-8081               LL LLLLLLLL
email: [email-masked]                                   LLLLLLLL

---

From: [email-masked] (Luther Martin)
Date: Mon, 6 Dec 1999 12:17:57 -0800

If putting biometric data in a certificate is "bad," what about putting a
hash of it?

Or should this type of information be more appropriately stored in a
directory?

---

From: Stefan Santesson <[email-masked]>
Date: Tue, 07 Dec 1999 11:24:51 +0100

This is fairly much a repetition of the previous discussion about biometrics.

I would avoid discussions regarding the privacy issues, but would like to
say that any system that relies on the secrecy of biometrics are likely to
fail. The unique identification capability of biometrics does not come from
keeping it secret, but rather your unique capability to represent these
bio-metric values with your physical body. The wrong body can't represent
these values regardless of wether they are secret or not.

The second general issue is about the value of bio-metrics in long distance
communication. This is where human verification comes in. Schemes aimed for
human verification works well on distance (i.e. my certified photo may help
convince you who I am, because you may have seen me before and recognize
me), while schemes for machine verification doesn't (i.e. finger print
verification must be performed with physical control over the bio-measure
device, and this device must be where you are). 

Anyway. I still think that the current solution is good.... On the other
hand it would be very easy so expand the scheme. Personally I'm not sure
what the best solution is.

The only thing I'm really sure about, is that I believe that the predefined
bio-metric types shall remain as they are (photo and written signature
image) aimed for human verification.

The current scheme allows definition of other bio-metric types with an OID
and I would personally not object if such OID may be allowed to define a
finger print scheme.

I would hope to avoid the actual bio-data in certificates, but I don't have
a strong opinion here. So please continue top argue and find a consensus here.

/Stefan

-------------------------------------------------------------------
Stefan Santesson                <[email-masked]>
Accurata AB                     http://www.accurata.se
Slagthuset                      Tel. +46-40 108588              
211 20  Malmö                   Fax. +46-40 150790              
Sweden                        Mobile +46-70 5247799

PGP fingerprint: 89BC 6C79 5B3D 591B 8547  1512 7D11 DBF4 528F 29A0
-------------------------------------------------------------------