Subject: Re: Biometrics for AS request

From: "Artyom Borodkin" <[email-masked]>
Date: Wed, 14 Jan 2004 15:21:12 +0300

You are right, the combined and multi-factor biometrics exist and are used
in the certain cases. Maybe the extension should support that as well as a
single biometric factor too.

It seems that the trust to the client host it strongly required for a remote
biometric authentication. If that is true what techniques could be used? As
have been mentioned the PKI and 'shared secret', could be. What else?

I believe that the host protection compromising do not compromise the
biometric credentials ... yet more. Because the security is not provided by
the biometric credentials (that could be stolen) but with the physical
client host that guarantees that the credentials correspond to the
authenticating person.

There should be no ability to use the stolen biometric credentials on a
trusted client host.

> -----Original Message-----
> From: Ken Raeburn [mailto:[email-masked]]
> Sent: Tuesday, January 13, 2004 7:04 PM
> To: Artyom Borodkin
> Cc: [email-masked]
> Subject: Re: Biometrics for AS request
> 
> On Tuesday, Jan 13, 2004, at 08:06 US/Eastern, Artyom Borodkin wrote:
> 
> > The original Kerberos protocol relies on a `shared secret` to
> > authenticate
> > the principal. PK_INIT extension gives us an equivalently strong
> > approach by
> > using of Certification Authorities.
> >
> > But biometrics can't gives a `shared secret`. And the use of
> > Diffie-Hellman
> > algorithm leaves the vulnerable to a middleperson attack.
> 
> How about sending the biometric data encrypted using a public key
> belonging to the KDC?  Unlike PKINIT, it wouldn't need a certificate
> per user, but the KDC's public key would need to be made known in some
> secure fashion.
> 
> > Maybe the host authentication could be used in a sense to fix this
> > problem.
> 
> Perhaps, at least if it's combined with some sort of perfect forward
> secrecy technique.  One problem to watch out for is, if the host key is
> later compromised, we don't want to have then revealed to an
> eavesdropper on the net all the information necessary to forever
> impersonate all the users who have logged in on that host.  But even
> with PFS, if the host key has been compromised, any future logins are
> still vulnerable to an attacker spoofing the KDC.  (Yes, in many UNIX
> systems with remote login access, a compromised host key means it's all
> over anyways, at least until the user can get a secure password change
> done.)
> 
> >> The purpose is to use fingerprint instead of both a user name and a
> >> password.
> 
> I think I'd be a bit more comfortable with a fingerprint *and* a
> password.  I don't have any experience with biometric authentication to
> back that up, but I've read a few web articles about how easy some of
> the biometric systems were to fool.  (Not that I have any data about
> your system specifically, but ideally the solution ought to be
> applicable to a number of systems.)
> 
> That wouldn't offer any more convenience than just using a password,
> but it may offer increased security.
> 
> Ken

---

From: Clifford Neuman <[email-masked]>
Date: Wed, 14 Jan 2004 21:51:58 -0800 (PST)

The key to be used will be the one embedded in the biometric
collection device.  Without such an embedded key, such remote use of
biometrics is not secure, not even as a "second factor".  You first
need to address the deployment and key management issues associated
with these trusted collection devices, at which point, desiging the
appropriate preauthentication scheme for Kerberos is straightforward.

Clifford Neuman

   From: "Artyom Borodkin" <[email-masked]>
   Date: Wed, 14 Jan 2004 15:21:12 +0300