Subject: Re: Re: Biometrics for AS request

From: "Artyom Borodkin" <[email-masked]>
Date: Wed, 14 Jan 2004 14:27:49 +0300

The biometrics becomes more popular as an authentication instrument.
Although it demands extra protection along whole path, the customers still
need it and the integration with Single Sign-On systems is required.

It is desirable to get Kerberos authentication available by biometrics with
a clear description of the additional protection requirements to unsure the
security.

So, it would be good if Kerberos leaves up to customers what security level
to choose (Password, PKI, Biometrics) and doesn't force them to use
artificial (non-native) combination Kerberos with another authentication
protocols.

> -----Original Message-----

> From: Derek Atkins [mailto:[email-masked]]

> Sent: Tuesday, January 13, 2004 6:33 PM

> To: Artyom Borodkin

> Cc: [email-masked]

> Subject: Re: Biometrics for AS request

> Remote Biometric Authentication doesn't work.  You need a completely

> trusted path between the sensor and the verifier.  If I can get

> "behind" the sensor then I can replay your biometric data.  Then I've

> just gained access as you.

> Basically, Biometrics are like passwords and should be treated as

> such.  They do not change (indeed, they CANNOT be changed) and they

> _are_ replayable (electronically).  This is why I say you need a

> trusted path from the sensor to the verifier.

> I've got a number of ideas for how to improve this situation, but this

> is not the appropriate forum to discuss remote biometrics.

> -derek

> "Artyom Borodkin" <[email-masked]> writes:

> > Hello,

> > I would like share with you some other thoughts about that Biometric

> > extension.

> > The original Kerberos protocol relies on a `shared secret` to

> authenticate

> > the principal. PK_INIT extension gives us an equivalently strong

> approach by

> > using of Certification Authorities.

> > But biometrics can't gives a `shared secret`. And the use of Diffie-

> Hellman

> > algorithm leaves the vulnerable to a middleperson attack.

> > I think that it is the most important issue and it could remain the

> general

> > constraint of the remote Biometrics authentication.

> > Maybe the host authentication could be used in a sense to fix this

> problem.

> > I would be pleased to hear your comments. Do I have a right vision? And

> is

> > there some way how to avoid these issues?

> > Thank you,

> > Artyom Borodkin

> >> -----Original Message-----

> >> From: Artyom Borodkin [mailto:[email-masked]]

> >> Sent: Monday, January 12, 2004 2:39 AM

> >> To: [email-masked]

> >> Subject: Biometrics for AS request

> >> Hello,

> >> The purpose is to use fingerprint instead of both a user name and a

> >> password.

> >> We can't create a unique identity from a fingerprint and it is not

> >> possible as our mathematicians say, so we can not use a "shared
secret".

> >> The goal is to obtain the TGT in reply to KRB_AS_REQ request using a

> >> biometrics to confirm the person identity.

> >> It could be done in two steps. The former is a key exchange the latter

> >> is a biometric person search and conformation. After the person is

> >> identified the key is used to encrypt TGT.

> >> I would like to pay your attention to few aspects:

> >> 1) The algorithm of key exchange should be customable, as far as all

> >> cryptographic algorithms should be for export and licensing purpose.

> >> 2) The biometric identification process could demands more than one

> >> request-reply exchange.

> >> As far as PK_INIT already use DH key exchange it could be reasonable to

> >> combine these extensions.

> >> Conceptually I see it as follows:

> >> Initially we negotiate about the encryption key and then we confirm the

> >> person identity associated with the request by Password, Certificate,

> >> Biometrics or some other ways.

> >> Thank you,

> >> Artyom Borodkin

> --

>        Derek Atkins                 617-623-3745

>        [email-masked]             www.ihtfp.com

>        Computer and Internet Security Consultant