Subject: Location and Identification

From: "Bob Jueneman" <[email-masked]>
Date: Fri, 19 Mar 1999 13:36:29 -0700

I think Tony has some interesting points, so I'll take him up on 
forwarding them to the list, then respond.

Bob

>>> Tony Bartoletti <[email-masked]> 03/18/99 05:47PM >>>
Bob,

I am a bit reticent to jump into the threads with this, but I offer
it to you to use as you wish (forward, edit, consider, whatever.)
My thoughts here are in response to several recent threads.
 
I don't pretend to know the intimate details of DNs, AltNames, etc.,
(collectively "Name-Like-Things") and the precise handling expected
of them by X.509-conforming software.  Nor am I expert at the varied
contents (keys, et al) that may be bound into the certificates,
(collectively, "Ident-Challenge-Data").

I see from these discussions at least two broad and (in my ideal)
orthogonal dimensions that people intend for them to serve:

1.  Location (of individual/cert or their issuer)

    Ranging from Global-Public-Location to Proprietary-Location

2.  Secured Identification (of located item.  "Ident-Challenge-Data")

    Ranging from Public/Private Keys to Biometric Data.

I think it is useful to consider this (simplified) "quad-chart"
and characterize various schemes/applications accordingly:

  FUNCTION:    |  Object Location         | Object Identification
  METHOD:      |  (via Name-Like-Thing)   | (via Challenge-Data)
  ---------------------------------------------------------------
  (subclass)   |  Global Public Locator   | Keys/Issuer-Keys
  ---------------------------------------------------------------
  (subclass)   |  Proprietary Locator     | Biometric Data/Hash
  ---------------------------------------------------------------

Note:  I do not intend for these "rows" to indicate correspondence.
That is, one could deploy a system where a "Proprietary Locator" is
used to retrieve "Keys/Issuer-Keys" Challenge-Data, (basically, the
current situation with key-certificates) or (God Forbid) a system
where a "Global Public Locator" can retrieve an individual's
Biometric Challenge Data.

Furthermore, in each possible case, one can imagine a protocol
that either does or does not require the "data-owner" to cooperate
in the final step of identification (say, you believe you have
located someones challenge-data, but can only see a piece of it
large enough to query them to release the remainder, and can
then proceed with a full challenge if they concur.)

This is how the telephone white-pages work.  If I find (say) three
"Bob Jueneman" I can call each one.  If I say "Are you the Bob that
posts to the PKIX list," you can either reply with additional
confirming data, or say "Sorry, this is Jueneman's Plumbing Supplies,
we only carry PVC, no 'PKIX'" just to avoid me.  

If I may characterize the discussions of late, I see some threads
hoping to elevate (?) Proprietary Locators to Global Public Locators,
(Simon says, "Lets build the X.500 directory of Babel") and others
to extend certified content from Keys to Biometrics, for instance.

Worse, I also see a blurring of the functions themselves, to wit,
"Let a secure directory hold established name-hierarchies that map
precisely to the material world, thus Existence-In-Directory
implies Identification, (delete one challenge-response.)"
       
As sexy and convenient as it may seem to overload these functions,
especially Location with Identification, such a scheme would be
both unstable and dangerous (the ultimate bad combination).

When someone says "We can make the directories secure" I cringe.
How secure?  For what?

The public telephone white-pages are secure enough for their purpose;
if a hacker or insider makes malicious modifications, it is just an
inconvenience for the most part.  If a directory holding my keys
is compromised, more hassle, but I can revoke and be re-issued.

I don't know if nature allows a directory secure enough to house
my biometric data, unless it is purely encrypted blobs to the
root directory operators, and I have secure control of the keys.

A Final Thought:  I am beginning to wonder if I should start a
global movement to have everyone capture all of their biometric
data (fingerprints, retinals, DNA sequences, etc) and publish
them in a giant, open public repository.  Would this not serve
make such data effectively worthless?  The only way this data
can be used to effectively "impersonate" me, is if there is a
reasonable assumption on the part of the relying party that
such information is uniquely held.  Destroy this assumption,
and the ability to impersonate disappears, no?

___tony___

Tony Bartoletti                                             LL
Center for Information Operations and Assurance          LL LL
Lawrence Livermore National Laboratory                LL LL LL
PO Box 808, L - 303                                   LL LL LL
Livermore, CA 94551-9900                              LL LL LLLLLLLL
phone: 925-422-3881   fax: 925-423-8002               LL LLLLLLLL
email: [email-masked]                                   LLLLLLLL

---

From: "Tolga Acar" <[email-masked]>
Date: Tue, 23 Mar 1999 16:49:32 -0700

>>> Tony Bartoletti <[email-masked]> 3/19/99 18:31:18 >>>
>Out of curiosity, what do you think would happen if everyone
>posted crisp images of their fingerprints and retinas to
>the usenet newsgroup "alt.kill.biometrics"?

It is also my cruosity about the use of biometrics. I fail to see how biometric information is treated in the same pot as secret/private keys. That information should be treated as public. I don't see how that information or its transformed form can be used as a passsword, or as some other form of secret. As you pointed out, posting that information, or data from which that information can be extracted (well, say a good photo of some very well-known person in Time magazine posing for "Got milk?")

>Of what use can it be to have another's fingerprints if it
>is assumed that anyone can spoof them?

I share the same curiosity here. One thing I think right now is that biometric info can be used as some sort of identification or as a Globally Unique Identifier of a person assuming that info is certified in some manner - ok, in a certificate for example. And, it is public. 

Besides, how can you revoke a biometric info if it's compromised (assuming it's used as a secret info) ? Use the other finger ? If I remember correctly, Steve Kent already has a posting on this issue in the last week or so.

>(There is no such newsgroup, but I might start one;)
Maybe the paparazzis are already doing that job some retinas ;-))

- Tolga

---

From: "Bob Jueneman" <[email-masked]>
Date: Wed, 24 Mar 1999 19:48:41 -0700

I should have been more precise in my terminology, although 
I am not certain that there is an agreed upon vocabulary 
in this field. So let me try to clarify.

Generally speaking, a biometric authentication operation takes 
a set of measurements of the biometric indicia and translates that 
into some kind of a digital "result" through a complex, almost
always proprietary algorithm.  That "result" is then compared 
against a previously calculated "template," which is typically 
produced through an enrollment process under the watchful eye
of some kind of an administrator, either the person who is 
responsible for deciding whether Joe Dokes gets into a particular
building, office, or secure facility; or perhaps a CA-like function
that binds that biometric template to an identity, either as part 
of a X.509 certificate which also binds both the identity , biometric 
template, or other attributes to a public key, or not.

When I used the term "hash," I did not mean to imply a message
digest algorithm, which has the property that a single bit of change 
of the input produces a huge difference in the output.  Instead, I 
was using "hash" in its older, computer science/compiler sense
of a many to few (not necessarily many to one) mapping between 
an input and the output.

Although for certain biometric measures, notably a facial image,
the template may be a more or less literal and reproducible
image of the person that if displayed in human visible form could be
easily compared to the subject who is standing in front of the clerk,
in general this is NOT what is used.  Instead, a more complex 
pattern-matching algorithm is used to compare the reduced "result" 
of the input to the target or template.

Depending on the desired false negative and/or false positive ratios,
this matching process then produces a yes/not, or sometimes 
yes/no/maybe result.  (I won't go into the question of whether the
goodness of fit criteria is decided by the mechanism which captures
the input, by the administrator who enrolls the individual, or the relying 
party who is making the decision, as this can vary from system to system 
and may significantly affect both the system design and the security 
of the system.)

But the primary issue, at least with respect to this forum, is exactly 
analogous to the asymmetric cryptography case:  Given a template
(which bears no obvious relationship to the individual, and is analogous
to a public key), is it, or is it not, computationally infeasible to reverse 
engineer that template and produce a simulated input stream that if then
put back through original the "hash" process would satisfy the template 
matching algorithm, without having to effectively reproduce the 
original input through some form of exhaustive search?  In particular,
it is not necessary that an exact match be produced, as even the biometric 
input cant' do that -- it is sufficient if the input just produces a "yes"
result.

Granted that for many applications it is not necessary that the process 
be all that computationally infeasible to reverse to be economically useful, 
just as even a 256 bit RSA key may have some utility for very short-term 
authentication or encryption function.  However, in deciding whether or not 
to use such a mechanism for any important purpose, it is necessary to 
consider the problem of revocation.  I only have ten fingers, and I'm 
rather attached to them emotionally as well as physically, and would hate to
give them up!  so if it is possible to compromise the system, the compromise 
is effectively eternal..

So in addition to the computationally infeasible question, it is also necessary to
ask whether in fact the biometric is a secret, or whether it is routinely available
in other contexts.  If it is, then its use for any important purpose is highly 
questionable.

A latent fingerprint is one such example -- given such a print, it would probably 
be simple to make a wax or latex "finger" that would produce that same image
if pressed on a platen.  If the fingerprint reader scans it in color, and could 
for example tell the difference in skin tone between a red-headed, fair-complected 
Irish lass and her dark complected African sister-under-the-skin counterpart,
spoofing the system becomes more difficult. And if the reader uses near infrared
to scan the capillary pattern under the skin, which is does not leave a latent print
(any more than a retinal scan does), then it becomes much harder yet.

That is, right up until the moment that that same lass voluntarily lets her fingerprint 
be taken for some other, even benign purpose, just as Sears requests that I sign
my name using the electronic stylus to capture my signature. (There have been 
recent cases in criminal court where the police solicitously asked a suspect
whether he would like a drink of water, and afterwards whisked away the glass 
with both his fingerprints and a DNA sample from his saliva and skin particles.
Object lesson -- never drink water from a glass. Suck ice cubes instead.)

At that point, all is lost, and we have the O.J. DNA problem.  The question in 
many people's mind was not whether it was O.J. blood that was found on the 
fence, but how it got there.  And since the rather inept handing of much of 
the evidence plus the high powered defense made it difficult to conclude
beyond a reasonable doubt that O.J. himself put it there under the circumstances
that were alleged, he walked.

Bob

>>> Stephen Kent <[email-masked]> 03/21/99 06:28PM >>>
Bob,

>With respect to the biometric identifiers, my assumption is that
>if these mechanisms are to be at all useful for use at a distance
>(as opposed to at an ATM machine, for example), the biometric
>template must be public, in the same sense that a public key is
>public.
>
>But in order to make this at all feasible, it is ESSENTIAL that the
>transformation from the recorded biometric indicia produce a
>one-way mapping to the template, so that the biometric
>measurement itself cannot be compromised.
>
>In other words, given the template, it must be computationally
>infeasible to produce some biometric indicia, either real or
>artificially constructed, that would satisfy the template.

As I mentioned in a private note to Bob, my experience with biometric
templates suggests that it is generally NOT possible to store templates in
this fashion.  The reason is that the matching algorithm for a biometric
must take the captured data and score it against the template.  Since the
captured data will almost alwways be a little "off," one needs to be able
to determine how far off the data is.  A good hash function defeats this
purpose, e.g., a single bit error is a distant (hamming distance) as a
multi-bit error.

Steve

---

From: Stefan Santesson <[email-masked]>
Date: Thu, 25 Mar 1999 12:28:08 +0100

Bob,

I think I agree to most of what you are saying, but I fail to see where I
was wrong.

>Sorry, but WRONG!
>
>The 4 criteria are necessary but not sufficient.
>
>Even if all four are done with absolute perfection it is still not
sufficient,
>if a biometric identification can be taken in another completely 
>different context, and then applied to authenticate something completely
>different.

This doesn't mean that my described system is failing. This means that some
other system that doesn't meet req 1-4 is failing, thus prove my
assumptions to be right, not wrong.

/Stefan

At 08:14 PM 3/24/99 -0700, Bob Jueneman wrote:
>Sorry, but WRONG!
>
>The 4 criteria are necessary but not sufficient.
>
>Even if all four are done with absolute perfection it is still not
sufficient,
>if a biometric identification can be taken in another completely 
>different context, and then applied to authenticate something completely
>different.
>
>The OJ case I referred to in a previous message is an example.
>It was, allegedly, a case of what we would call in computer security 
>terms either a replay or spoofing attack. There was little question 
>that it was OJ's blood -- the question is how did it get on the fence.
>
>If you present a document in court that has as xeroxed copy of my
>fingerprint on it, does that prove that I approved that document?
>
>No, it certainly does not. I very well might never have seen the 
>document, and the fingerprint could have been photocopied by 
>the police who picked me up, dusted from a fingerprint on a glass offered
>to me by the prosecution attorney, or obtained in any other way.
>
>And even binding the biometrics to the document itself doesn't prove
>very much, because some other application might have legitimately 
>collected and saved the raw input, gone through the process, and 
>hashed (message digest sense) the biometric result and the document.
>
>As Schneirer has succinctly put it, BIOMETRICS ARE NOT SECRETS!
>
>They may be very useful if they involve a physical presence at a 
>tamper-resistant boundary for access control, whether that boundary is
>a human clerk examining a driver's license, a door controller or the 
>much desired fingerprint reader on a smart card.
>
>But if they have to be collected by an application and transmitted over a
wire, 
>they are highly suspect, and are quite likely to do much more harm than 
>good, both to authentication and privacy.
>
>And BTW, I would love to be proven wrong on this -- if someone can provide 
>me suitable evidence of such an application that could reasonable be 
>considered secure against this class of attack, I would gladly buy them a 
>drink, and maybe even a nice dinner.
>
>Bob
>
>>>> Paul Koning <[email-masked]> 03/23/99 03:41PM >>>
>>>>>> "Stefan" == Stefan Santesson <[email-masked]> writes:
>
>> The reliability in a biometric identification scheme lies in a combination
>> of:
>> 1) The subjects unique posession of the original biological limb itself
>> (the finger, eye etc.)
>> 2) The function of a capture device which only allows the real biological
>> human original to produce valid digital capture data.
>> 3) The absolute critical function to integrity protect the capture data
>> between the capture device and the comparing algorithm, and the equally
>> critical function to authenticate and integrity protect pre stored data
>> used by the comparing algorithm.
>> 4) The function of a comparing algorithm, comparing captured data with the
>> pre stored information in such way that it produce a good balanced, low
>> probability, of both false positive (wrong original accepted) and false
>> negative (right original rejected) response.
>> 
>> If any of these 4 fail, the system is unreliable. If not, the system works.
>
>It seems to me that all four of these are, at best, highly immature
>and at worst, beyond the state of the art.
> 
>> But note that none of these steps require any digital representation of the
>> bio-data to be secret.
>
>Yes, IF all four are rigorously satisfied.  If they are not, then when 
>an attacker has access to the digital representation, he has the means 
>to create forgeries that get past imperfect implementations of
>properties 1 through 4 you listed.
>
>	paul
>
-------------------------------------------------------------------
Stefan Santesson                <[email-masked]>
Accurata Systemsäkerhet AB      http://www.accurata.se
Slagthuset                      Tel. +46-40 108588              
211 20  Malmö                   Fax. +46-40 150790              
Sweden                        Mobile +46-70 5247799

PGP fingerprint: 89BC 6C79 5B3D 591B 8547  1512 7D11 DBF4 528F 29A0
-------------------------------------------------------------------

---

From: Stefan Santesson <[email-masked]>
Date: Thu, 25 Mar 1999 12:55:02 +0100

At 04:49 PM 3/23/99 -0700, Tolga Acar wrote:
>Besides, how can you revoke a biometric info if it's compromised (assuming
it's used as a secret info) ? Use the other finger ? If I remember
correctly, Steve Kent already has a posting on this issue in the last week
or so.

This is a major point.

You can not revoke biometrics. And NO biometric verification system should
rely on biometric data to be secret.

The bio-metric system MUST rely on the secure capturing device to ensure
that only biological originals are able to feed the system with capture data.

And this IS a major design criteria for biometric capture devices.

Then, how reliable this have to be in a certain system is just a matter of
policy, as always. And this goes also for how long time in the future we
must assume that the capture device can't be fooled by a faked bio-copy. If
this is just used for authentication this parameter might be set to almost
zero (We always have to replace the capture devices when they no longer are
reliable). In non-repudiation we have to prove that the means of producing
a signature was secure at the time of signature creation, and that's
another problem which by no means are unique to the use of biometrics.

As was said earlier, BIOMETRICS ARE NOT SECRETS! (they are only unique
biological properties)

/Stefan

---

From: Stephen Kent <[email-masked]>
Date: Thu, 25 Mar 1999 10:56:03 -0500

Bob,

I think we agree on most of the principles underlying biometric systems,
but we disagree about the difficulty of working backwards to create a bit
stream that will be accepted by the biometric validation system.  I do not
believe that most of the functions used to create templates are designed
with the features of one-way hash functions, for the reasons we have both
cited, e.g., the functions must tolerate the inevitable capture errors.
Thus I do not assume that it is computationally diffiuclt to work backwards
to create inputs that will be accepted. I am willing to be convinced on a
case-by-case basis, but so far no vendor of one of these systems has been
willing/able to establish non-invertability.

I believe that it is feasible to make fake fingers for fingerprints, given
a latent image. An example was given last year in tests reported on in
Network Security magazine, using a copier and transparency material. Most
of the tested fingerprint scanners were fooled.  To the best of my
knowledge, none of the widely available biometric capture devices for use
with a PC meets objective tamper-resistance standards (e.g., 140-1 level 3
or better), which suggests that even the few that employ crypto to protect
captured data can be subverted.

So, I stand by my contention that a capable adversary can, in general,
generate a bit stream that will fool a biometric authentication system,
given that the capture is not physically 9and crypto) secure, and given
access to a template.  For many such systems, one can also generate such a
bit stream from incidential capture of the biometrics of the target subject
by other means, e.g., latent prints, etc.  Thus one should consider
carefully under what circumstances it is appropriate to use this sort of
technology in conjunction with certificates.  Some of the example put forth
don't suffer from all of the problems cited above, and this might be
reasonable uses of biometrics.  For example, human matching of a cerified
image of a user's face against a physically present individual.  But, even
in this case, it is far from clear that we should put such an image in a
certificate, as David mentioned.

Steve