Subject: Re: Location and Identification

From: [email-masked]
Date: Tue, 23 Mar 1999 18:40:44 -0500

Paul Koning <[email-masked]> on 03/23/99 05:41:35 PM

To:   [email-masked]
cc:   [email-masked] (bcc: Tom Gindin/Watson/IBM)
Subject:  Re: Location and Identification

>>>>> "Stefan" == Stefan Santesson <[email-masked]> writes:

> The reliability in a biometric identification scheme lies in a
combination
> of:
> 1) The subjects unique posession of the original biological limb itself
> (the finger, eye etc.)
> 2) The function of a capture device which only allows the real biological
> human original to produce valid digital capture data.
> 3) The absolute critical function to integrity protect the capture data
> between the capture device and the comparing algorithm, and the equally
> critical function to authenticate and integrity protect pre stored data
> used by the comparing algorithm.

[Tom Gindin] There seems to be another critical step here, which may be
more difficult than either number 2 or number 3 above.  How does the
comparing algorithm authenticate that the data being sent in step 3 is
coming from a capture device and not from something else?  I know a
certified key pair for the device will work - I wouldn't know how else to
do it.

> 4) The function of a comparing algorithm, comparing captured data with
the
> pre stored information in such way that it produce a good balanced, low
> probability, of both false positive (wrong original accepted) and false
> negative (right original rejected) response.
>
> If any of these 4 fail, the system is unreliable. If not, the system
works.

It seems to me that all four of these are, at best, highly immature
and at worst, beyond the state of the art.

> But note that none of these steps require any digital representation of
the
> bio-data to be secret.

Yes, IF all four are rigorously satisfied.  If they are not, then when
an attacker has access to the digital representation, he has the means
to create forgeries that get past imperfect implementations of
properties 1 through 4 you listed.

[Tom Gindin] If the capture device signs its data on transmission and
includes a timestamp, the forgeries will be detected as not coming from a
registered device.  If arbitrary senders are permitted, even a perfect
device and comparison algorithm will not help.

     paul

---

From: Stephen Kent <[email-masked]>
Date: Wed, 24 Mar 1999 04:08:04 -0500

Tom,

>certified key pair for the device will work - I wouldn't know how else to

I  think Stefan tried to subsume the authenticity/integrity requirement in
step 2. Having the data be signed by the capture device is a good strategy,
though not nthe only one.  A symmetric crypto approach might suffice as
well, since what we need here is point-to-point authentication and
integrity for the captrured data. However, one must also examine the
physical security of the device and the associated cryptography, to really
satisfy the requirements established in the second step.

>device and comparison algorithm will not help.

Note my earlier comment; in the real world we need to pay attention to the
implementation of the crypto and its resistance to physical attacks.

Steve