Subject: Re: New proposed solution to the QC biometric issue

From: Petra Gloeckner <[email-masked]>
Date: Thu, 15 Apr 1999 17:05:55 +0200

I'm forwarding the following comment on behalf of Bruno Struif who 
is involoved in biometric technologies and algorithms at GMD:

Comment to "Biometrics in Qualified Certificates"

1. The only biometric data which may have some relevance to qualified
certificates is  a "certificate holder portrait image" (i.e. a foto) in
a defined coding scheme.
2. If the foto is too big (about 2 kbytes in a compressed version), the
hash value of the foto may be used.
3. If the hash value is used then the hash algorithm has to be denoted
and the reference where the foto from which the hash value was derived
is located. A verifier has to fetch the foto, to hash it and to compare
the computed hash value with the hash value presented in the qualified
certificate.
4. The rationale as it stands is wrong from my point of view: There are
no "biometric comparing algorithms" involved which have to compare
reference data with actually measured verification data taken from the
person to be authenticated. An acceptable wording would be: "The
rationale for supporting biometric data (i.e. a certificate holder
portrait image) would be to support biometric data in a qualified
certificate in the sense of a certified attribute of the certificate
holding person."

Bruno Struif
e-mail: [email-masked]

---

From: Stephen Kent <[email-masked]>
Date: Fri, 16 Apr 1999 19:02:26 -0400

Petra,

>certificate in the sense of a certified attribute of the certificate

I'm a bit confused by your statement. Biometric authentication is
generically done by registering a user and creating a template that
characterizes the biometric for that user.  later, when the user tries to
"login" a new biometric is captured and is compared, algorithmically, to
the template.  if a suitably high score is achieved, the user is
authenticated.  In the more restricted cases we are considering here, the
assumption is that the template is an image of a user's face or of his/her
handwritten signature, that will be viewed by a person acting as the
authenticator, matched against an in-person image of the user or signature.

Steve