Subject: QC Bio-info leak?

From: "Anders Rundgren" <[email-masked]>
Date: Sun, 12 Dec 1999 07:48:36 -0000

All,
I have another question for you smart-card experts.

I believe that biometrics as defined by the current QC-draft (002) will in 99% be used
in conjunction with smart cards.

Q: How do you anticipate that the bio-template is going to be protected without
also requiring that the RP software is authenticating to the card?    The latter
will IMO not scale that well.

Or is there another genial solution?

My own solution to the problem is to never put "naked" smart cards in unknown readers,
but to have them (or it) in a pesonal security terminal.  In my case the mobile phone. 

Anders

---

From: [email-masked]
Date: Sun, 12 Dec 1999 07:29:03 -0800

note in the AADS strawman case ... the fingerprint sensor can be configured  on
the card and it used to activate the card ... in-place of PIN activation (with
bio information never appearing in the infrastructure).

the AADS w/PIN activation was what was announced at BAI this past week (BAI show
is sort of the world-wide retail banking equivalent of cebit).  the AADS
strawman also allows that the authentication function doesn't have to only
appear in card formfactor ... that contactless/wireless protocol would allow for
formfactor agnostic configurations.

one of the challenges has been use in unfamiliar/unknown POS-like environments

also within X9 ... there has been quite a bit of progress w/X9.84 (Management
and Security For The Biometrics Financial Services Industry) in conjunction with
various world-wide biometric standards organizations.

as alwas ... references at http:/www.garlic.com/~lynn/

"Anders Rundgren" <[email-masked]> on 12/11/99 11:48:36 PM

To:   "PKIX-List" <[email-masked]>
cc:    (bcc: Lynn Wheeler/CA/FDMS/FDC)
Subject:  QC Bio-info leak?

All,

I believe that biometrics as defined by the current QC-draft (002) will in 99%
be used
in conjunction with smart cards.

My own solution to the problem is to never put "naked" smart cards in unknown
readers,
but to have them (or it) in a pesonal security terminal.  In my case the mobile
phone.

Anders

---

From: "Anders Rundgren" <[email-masked]>
Date: Sun, 12 Dec 1999 20:19:00 -0000

Lynn,
thanx for the info although it does not apply to the QC-002 spec as it does not support
finegerprints.

The question is therefore (unfortunately) limited to subject image and handwritten signature.

Although smart cards with built-in finerprint sensors could be great I believe
that this makes them too expensive for most purposes.

X9.84?  Does anyone within the QC-group care to comments on that?

Anders

---

From: [email-masked]
Date: Sun, 12 Dec 1999 15:16:18 -0800

??? not applicable to fingerprint??? ... which part? ... the AADS strawman with
on-device fingerprint sensor for activation or x9.84?

in the AADS scenerio the chip can be configured to be formfactor agnostic with
contactless/wireless infrastructure. the issue of thumb-reader costs
justification then becomes a parameterized risk management issue ... there is
some at least one application that justifies having the thumbreader for the
device ... or there isn't.

as to

x9.84

5.1 fingerprint
5.2 speaker recognition
5.3 eye scanning
5.4 face identification
5.5 hand geometry
5.6 signature verification

---

From: [email-masked]
Date: Sun, 12 Dec 1999 15:57:36 -0800

oh yes, the AADS parameterized risk management is attempting to look at the
issues of deploying 50+ year lifetime infrastructures.

simplifying a bit, the public key becomes the serial number of the
infrastructure that performs the digital signature. That infrastructure has an
overall assessed integrity level and is registered when the public key is
registered. Incoming transactions can be authenticated ... and then
authorization can be decided, in part, based on the integrity level of the
signing infrastructure. Also the integrity level can be downgraded in real time
as discoveries are made in the future.

In theory, AADS strawman help reduce the integrity unknowns for doing risk
assesement portion of authorization. It is even possible that expensive
on-device bio-sensors can reduce the overall aggregate infrastructure expenses
by 1) reducing risk inaccuracies and 2) eliminating cycles currently being spent
in risk assesement things like expensive neural net applications.

Of course, the implication is that reasonable device activation bio-sensors can
have higher integrity properties than other device activation methodologies.

---

From: [email-masked]
Date: Sun, 12 Dec 1999 17:27:43 -0800

... and as a total aside ... did manage to get AADS/X9.59 announcement and press
releases at BAI show last week (something like Cebit for the world-wide retail
banking industry). Also had AADS financial transactions and AADS privacy-broker
transactions being demo'ed at the show ... the only thing missing from the demos
was AADS RADIUS authentication for ISP & webserver connections. references (and
pointer to press release) are at http://www.garlic.com/~lynn/

---

From: Anders Rundgren <[email-masked]>
Date: Mon, 13 Dec 1999 08:45:31 +0100

>on-device fingerprint sensor for activation or x9.84?

Well, I EXPLICITLY referred to QC-002 were bio-metrics that need machine-verification
are BANNED (or not supported depending on how "political" you want to be), for reasons unknown.
That includes fingerprints.

If you have local/personal device sensors and thus reading etc. biometrics is completely outside
of the PKI.  You trust a device instead.  So it is another story.

Such a solution could be interesting for mobile phones  (has been shown actually) as a PIN-code
replacement or better as a PIN-code complement

IMO the QC-editors have quite some homework to do regarding other efforts in this area like
the one you mention.  Thank God I am not a QC editor!

Anders