Subject: Conclusion - Biometric inclusion in QC

From: Stefan Santesson <[email-masked]>
Date: Sat, 27 Mar 1999 00:03:16 +0100

I have now concluded the bio-metric topic as settled.

The conclusion is to NOT include support for bio-metric data in the profile
at this stage.
At least not until the list has provided an agreeable solution that can
enhance interoperability in some meaningful way.

The informational web site http://www.accurata.se/QC/ has been updated with
the rationale for this conclusion.

Look under "Settled topics"

/Stefan
-------------------------------------------------------------------
Stefan Santesson                <[email-masked]>
Accurata Systemsäkerhet AB      http://www.accurata.se
Slagthuset                      Tel. +46-40 108588              
211 20  Malmö                   Fax. +46-40 150790              
Sweden                        Mobile +46-70 5247799

PGP fingerprint: 89BC 6C79 5B3D 591B 8547  1512 7D11 DBF4 528F 29A0
-------------------------------------------------------------------

---

From: Denis Pinkas <[email-masked]>
Date: Tue, 30 Mar 1999 16:42:03 +0200

Stefan,

I have kept silent but looked at this interresting discussion. I will re-use
some of the arguments sent to the list.

How can I make a difference between "the" John Brown I met last monday and the
other 2000 (?) John Brown's ?
Maybe "my" John Brown is John Brown 1278, but in fact I do not know. I could
easily make the difference if the picture from John Brown was included in the
certificate. While reading this, some might jump from their chair since I have
been advocating low-fat leaf certificates at the last PKIX meeting !

The solution has already been given on this list. Instead of including the
whole picture, a hash of the picture could be included. Now John Brown could
provide me with the picture while sending me a signed message and I could
verify that it corresponds to the picture of the John Brown I met.

Two observations:

1) John Brown is free to release me his picture or not. In this way his privacy
may be respected, even if his certificate is published.
2) Once I got the picture, I do not need it once again. This solves bandwith
for other exchanges.

As a conclusion, I would welcomme an extension able to handle hash values of
biometric information, in particular pictures.

Denis