Subject: Re: Biometrics

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 08 Jan 2004 20:33:08 -0500

On Thursday, January 08, 2004 22:07:12 +0300 Artyom <[email-masked]> 
wrote:

> I would like to make a public preauthentication scheme extension if it
> is possible. But I am not certain how exactly to extend the protocol and
> I am also not familiar with doing I-D documents.

Basically anyone can write and submit an internet-draft.  All you need to 
do is write up a clear, complete description of your extension, including 
what it looks like on the wire, the possible values and meanings of various 
fields and messages, and how the parties involved are supposed to behave. 
There are a few formatting requirements, but they're not too difficult. 
Take a look at http://www.ietf.org/ID.html for some more information on the 
internet-drafts series, how to write and format I-D's, and how to submit 
them for publication.  The hard part is virtually always actually designing 
the protocol.

I believe this work is in scope, but it will be up to the group to decide 
whether to take it on as a work item.

The protocol is designed to be extensible in various ways, so even if the 
group decides not to do this work, it should be possible for you to proceed 
with it as an individual submission.  If this turns out not to be the case, 
I think several of us will be quite surprised.

Either way, I'm sure there are some folks here who will be happy to help 
point you in the right direction as far has how to extend the protocol. 
Why don't you give us some more details on what you're thinking about?

-- Jeffrey T. Hutzelman (N3NHS) <[email-masked]>
   Co-chair, IETF Kerberos Working Group
   Carnegie Mellon University - Pittsburgh, PA

---

From: "Artyom" <[email-masked]>
Date: Thu, 8 Jan 2004 22:07:12 +0300

Hello,

I work in a company which develops the biometric authentication systems.
And I consider the using of Kerberos protocol to provide our service.

Studding the standard I have noted that it is not possible to use
biometrics in authentication request without extending the protocol.

If it could be considered in scope for the working group I would be
pleased to discuss it.

I am also looking for and will appreciate any advice and help.

Thank you,

Artyom Borodkin

---

From: "Artyom" <[email-masked]>
Date: Mon, 12 Jan 2004 02:39:17 +0300

Hello,

The purpose is to use fingerprint instead of both a user name and a
password.

We can't create a unique identity from a fingerprint and it is not
possible as our mathematicians say, so we can not use a "shared secret".

The goal is to obtain the TGT in reply to KRB_AS_REQ request using a
biometrics to confirm the person identity.

It could be done in two steps. The former is a key exchange the latter
is a biometric person search and conformation. After the person is
identified the key is used to encrypt TGT.

I would like to pay your attention to few aspects:

1) The algorithm of key exchange should be customable, as far as all
cryptographic algorithms should be for export and licensing purpose.

2) The biometric identification process could demands more than one
request-reply exchange.

As far as PK_INIT already use DH key exchange it could be reasonable to
combine these extensions.

Conceptually I see it as follows:
 
Initially we negotiate about the encryption key and then we confirm the
person identity associated with the request by Password, Certificate,
Biometrics or some other ways.

Thank you,
Artyom Borodkin

---

From: Clifford Neuman <[email-masked]>
Date: Mon, 12 Jan 2004 10:49:04 -0800

This years program for the Internet Society Symposium on Network and
Distributed Systems Security includes a paper from Tom Yu, Sam
Hartman, and Ken Raeburn on the perils of unauthenticated decryption
in Kerberos, as well as many other papers that are of interest to
those practicing computer Security.

I would like to encourage everyone here to consider attending this
years Symposium to be held in San Diego from February 4ht through 6th.

More information may be found at

  http://www.isoc.org/isoc/conferences/ndss/04/

Although the hotel reservation deadline has passed, I am told that
the hotel is still accepting reservations at the conference rate.

Clifford Neuman