Subject: Re: Location and Identification

From: Stefan Santesson <[email-masked]>
Date: Tue, 23 Mar 1999 22:34:57 +0100

At 05:31 PM 3/19/99 -0800, Tony Bartoletti wrote:
<snip>
>Out of curiosity, what do you think would happen if everyone
>posted crisp images of their fingerprints and retinas to
>the usenet newsgroup "alt.kill.biometrics"?
>
>Of what use can it be to have another's fingerprints if it
>is assumed that anyone can spoof them?
>
>(There is no such newsgroup, but I might start one;)
>
>___tony___

I sense a major misconception.

The reliability in a biometric identification scheme does NOT lie in ANY
digital representation of the captured biometrics (if the system is well
designed).

Yes, there must be a pre stored record some ware, but that is not
necessarily secret. It must be integrity protected, Yes, but not secret (to
provide reliability)

The reliability in a biometric identification scheme lies in a combination
of: 
1) The subjects unique posession of the original biological limb itself
(the finger, eye etc.)
2) The function of a capture device which only allows the real biological
human original to produce valid digital capture data.
3) The absolute critical function to integrity protect the capture data
between the capture device and the comparing algorithm, and the equally
critical function to authenticate and integrity protect pre stored data
used by the comparing algorithm.
4) The function of a comparing algorithm, comparing captured data with the
pre stored information in such way that it produce a good balanced, low
probability, of both false positive (wrong original accepted) and false
negative (right original rejected) response.

If any of these 4 fail, the system is unreliable. If not, the system works.

But note that none of these steps require any digital representation of the
bio-data to be secret.

A digitally signed hash of the pre stored bio-data (included in a
certificate) could for example provide the needed authentication of pre
stored bio-data (in step 3 above), even if it was held in a totally
unsecure directory.

I also believe that the pre stored data could have a form which does not
reveal the exact shape of the bio-original, but that is only guessing. If
that's not the case, the only reason for keeping the pre stored data
secret, would be of privacy reasons. Otherwise, I believe there is no
reason at all.

/Stefan  

-------------------------------------------------------------------
Stefan Santesson                <[email-masked]>
Accurata Systemsäkerhet AB      http://www.accurata.se
Slagthuset                      Tel. +46-40 108588              
211 20  Malmö                   Fax. +46-40 150790              
Sweden                        Mobile +46-70 5247799

PGP fingerprint: 89BC 6C79 5B3D 591B 8547  1512 7D11 DBF4 528F 29A0
-------------------------------------------------------------------

---

From: Paul Koning <[email-masked]>
Date: Tue, 23 Mar 1999 17:41:35 -0500

>>>>> "Stefan" == Stefan Santesson <[email-masked]> writes:

> If any of these 4 fail, the system is unreliable. If not, the system works.

It seems to me that all four of these are, at best, highly immature
and at worst, beyond the state of the art.
 
> But note that none of these steps require any digital representation of the

Yes, IF all four are rigorously satisfied.  If they are not, then when 
an attacker has access to the digital representation, he has the means 
to create forgeries that get past imperfect implementations of
properties 1 through 4 you listed.

	paul

---

From: Tony Bartoletti <[email-masked]>
Date: Tue, 23 Mar 1999 16:25:17 -0800

>digital representation of the captured biometrics (if the system is well

The definition of "well-designed" may be at issue here, in particular with
regard to assumptions about near-term future capabilities of attackers.

>1) The subjects unique posession of the original biological limb itself

This assumes that I will never be able to "produce" a physical "thumb"
that exhibits your thumbprint (and temperature, surface conductivity, et al)
from a copy of your thumbprint I have lifted from a soda can.  Correct?

>human original to produce valid digital capture data.

This "may" require the presence of a human operator-witness, and also
involve some intense scrutiny, given my previous comment.

>used by the comparing algorithm.

Authenticating the pre-stored data (aside from subsequent integrity
protections) may be problematic.  There are many possible avenues of
attack.  If I can produce a serviceable "thumb" with YOUR thumbprint
(and driver's licence with your name, but MY picture) I might be able
to get such elements "certified".  Alternately, I could use MY thumb
print, with a driver's licence bearing YOUR name/address, but MY
picture, thus binding your "credentials" to my physical presence.

>But note that none of these steps require any digital representation of the

Again, only under the assumption that (say) 5-10 years from now, it will
not be trivial to produce a thumb with matching thumbprints, an eye with
matching retina, etc., given the source of the said bio-data.

And to reiterate, I can use MY thumb, with a fake driver's licence and
birth-certificate, to "take over" your identity even more thoroughly,
especially if you have not already had your bio-stats "registered" first.

>secret, would be of privacy reasons. Otherwise, I believe there is no

My final point, and one that seems to go unaddressed:  If every person
on earth were easily able to "leave", via reproduction, my fingerprints
or retinal images anywhere they like, then no one will assume that the
occurance of such a trace necessarily represents "me".  So there is no
longer a privacy concern.

___tony___

>/Stefan  

Tony Bartoletti                                             LL
Center for Information Operations and Assurance          LL LL
Lawrence Livermore National Laboratory                LL LL LL
PO Box 808, L - 303                                   LL LL LL
Livermore, CA 94551-9900                              LL LL LLLLLLLL
phone: 925-422-3881   fax: 925-423-8002               LL LLLLLLLL
email: [email-masked]                                   LLLLLLLL