Subject: Re: Location and Identification

From: "Bob Jueneman" <[email-masked]>
Date: Wed, 24 Mar 1999 20:14:13 -0700

Sorry, but WRONG!

The 4 criteria are necessary but not sufficient.

Even if all four are done with absolute perfection it is still not sufficient,
if a biometric identification can be taken in another completely 
different context, and then applied to authenticate something completely
different.

The OJ case I referred to in a previous message is an example.
It was, allegedly, a case of what we would call in computer security 
terms either a replay or spoofing attack. There was little question 
that it was OJ's blood -- the question is how did it get on the fence.

If you present a document in court that has as xeroxed copy of my
fingerprint on it, does that prove that I approved that document?

No, it certainly does not. I very well might never have seen the 
document, and the fingerprint could have been photocopied by 
the police who picked me up, dusted from a fingerprint on a glass offered
to me by the prosecution attorney, or obtained in any other way.

And even binding the biometrics to the document itself doesn't prove
very much, because some other application might have legitimately 
collected and saved the raw input, gone through the process, and 
hashed (message digest sense) the biometric result and the document.

As Schneirer has succinctly put it, BIOMETRICS ARE NOT SECRETS!

They may be very useful if they involve a physical presence at a 
tamper-resistant boundary for access control, whether that boundary is
a human clerk examining a driver's license, a door controller or the 
much desired fingerprint reader on a smart card.

But if they have to be collected by an application and transmitted over a wire, 
they are highly suspect, and are quite likely to do much more harm than 
good, both to authentication and privacy.

And BTW, I would love to be proven wrong on this -- if someone can provide 
me suitable evidence of such an application that could reasonable be 
considered secure against this class of attack, I would gladly buy them a 
drink, and maybe even a nice dinner.

Bob

>>> Paul Koning <[email-masked]> 03/23/99 03:41PM >>>
>>>>> "Stefan" == Stefan Santesson <[email-masked]> writes:

> The reliability in a biometric identification scheme lies in a combination
> of:
> 1) The subjects unique posession of the original biological limb itself
> (the finger, eye etc.)
> 2) The function of a capture device which only allows the real biological
> human original to produce valid digital capture data.
> 3) The absolute critical function to integrity protect the capture data
> between the capture device and the comparing algorithm, and the equally
> critical function to authenticate and integrity protect pre stored data
> used by the comparing algorithm.
> 4) The function of a comparing algorithm, comparing captured data with the
> pre stored information in such way that it produce a good balanced, low
> probability, of both false positive (wrong original accepted) and false
> negative (right original rejected) response.
> 
> If any of these 4 fail, the system is unreliable. If not, the system works.

It seems to me that all four of these are, at best, highly immature
and at worst, beyond the state of the art.
 
> But note that none of these steps require any digital representation of the
> bio-data to be secret.

Yes, IF all four are rigorously satisfied.  If they are not, then when 
an attacker has access to the digital representation, he has the means 
to create forgeries that get past imperfect implementations of
properties 1 through 4 you listed.

	paul

---

From: "Jan Nielsen" <[email-masked]>
Date: Thu, 25 Mar 1999 01:02:57 -0700

Hi Bob,

I think of secure I&A as the secure possession, collection, transmission
and evaluation of credential(s).  All phases must be performed within the
TCB.  The use of biometrics in I&A does not change this.  However, the fact
that biometric revocation is not a palatable option places significantly
greater burden on the system to perform each of these phases correctly.
The network partitioning of these phases is, however, not restricted; the
phases may be performed within a NTCB.  (But I cannot identify an
appropriately designed biometric device, which probably saves you the
expense a Squatters stout, and possibly even their Jambalaya.)

In traditional secure I&A systems, e.g., password/passphrase system,
possession is not disputed because of credential policy enforcement, i.e.,
credentials must be of a certain size, with certain alphanumic
characterists, and changed every so often.  Collection, however, is
disputed much of the time, typically because of the lack of a trusted path
in the operating system for the credential collection.  Transmission and
evaluation are usually not disputed because appropriate protocols have been
designed and analyzed

In your example, possession is not disputed, but the collection,
transmission and evaluation of the biometric material was not maintained
appropriately.  Had the crime scene been properly sealed upon discovery,
then collection of the biometric material, transmission to a forensic
laboratory, and the subsequent evaluation by the appropriate specialist
would have been possible with a higher degree of trust than that which was
executed by the LAPD in this case.  (Each of these phases would, of course,
have been "attacked", and rightfully so, by the defendant's lawyers but
with a "good" crime scence policy and "good" compliance, the verdict may
have been different.)

In a previous example of a verified representation of a biometric, e.g., a
signed picture, possession and evaluation are in dispute because,
presumably, the evaluator must accept the signed picture of the individual
and then correlate the signed picture with the individual presenting the
signed picture.  Given that evaluation of possession of physical
characteric(s) and correlation of those characteristic(s) to some verified
representation is a "hard" problem this type of system must involve a human
as the evaluator.

Regards, and "hello" to all of Gabe's group,

Jan Nielsen