Re: REVIEW: "Biometrics for Network Security", Paul Reid

From: Bruce Barnett (spamhater103+U041004200405_at_grymoire.com)
Date: 10/05/04

  • Next message: Anne & Lynn Wheeler: "Re: REVIEW: "Biometrics for Network Security", Paul Reid" 
    Date: 5 Oct 2004 00:43:07 GMT

    "Richard S. Westmoreland" <richardsw@suscom.net> writes:

    > Sorry I was going off on a tangent - I don't care so much about the book
    > itself, thought I'd hop into a conversation about biometrics.

    No problem.

    >> Well, how does one know the reader is trusted? I can walk up to a
    >> Trojan'ed reader, and it can capture my thumbprint and replay it at a
    >> later date.
    >
    > I considered this. Some kind of CRC the reader goes through and the server
    > matches up a hash with the reader's internal circuitry, to confirm it is
    > untainted.

    There is still two potential problems that ideally should be addressed.

            1) The reader has been compromised. Any fingerprint it sees is
               stores in a hidden location.

            2) The user uses the wrong thumbprint reader. Or some other
               thumbprint reader at another location. The data is captured.

    Both the end user and the remote system has be consider these risks.

    For instance, suppose the reader was attached to the local
    host/controller by a USB cable. Some evil person might insert a USB
    sniffer in the cable, unknown to the remote system.

    While some locations are going to have high physical
    security, not all locations will. So it's a potential problem.

    I mentioned the Sony Puppy,

    http://bssc.sel.sony.com/Professional/puppy/products.html

    Because this is a way for a remote system to confirm that the local
    system does have the token. Only with the token can the local system
    generate the suitable credentials. The local system cannot replay the
    data, because it doesn't have the private key stored inside the puppy.

    And stealing the token won't help, because only the fingerprint will
    unlock the key/credentials.
            
    >> This also requires the reader to be connected to the server in order
    >> to be authenticated. If the network is down, or disconnected, the
    >> person cannot be authenticated. So that's two potential problems.
    >
    > Server or desktop/laptop - can be connected to either. If I have an RSA
    > SecureID, and the server is down, I'm not getting on then either.

    Well, a smartcard can be used without a central server. I've been
    using the open source musclecard applet to do so. The java code in the
    card generates a key pair, and exports the private key. The public key
    can be stored in a local machine's cache/storage (especially if the
    user is a frequent user).

    The host generates a random challange, and asks the card to encrypt it
    with the private key. The card does so, and the host verifies the ID
    and grants access. (Once the PIN is verified).

    This has a man-in-the-middle risk, by the way.

    >I thought
    > the point was authentication to the *network*?

    I see the need for both local authentication and remote/network
    authentication.

    In large scale systems, with millions of users (the CAC card has 5
    million cards issued), there is an advantage for allowing the local
    system to authenticate a user, expecially in remote locations
    throughout the world, during war time, etc..

    > No network, then I sit and
    > wait until it's fixed.

    There are critical situations where waiting is not suitable. Medical,
    homeland security, first response teams, military, etc.

    Cheers. 

    -- 
Sending unsolicited commercial e-mail to this account incurs a fee of 
$500 per message, and acknowledges the legality of this contract.
  • Next message: Anne & Lynn Wheeler: "Re: REVIEW: "Biometrics for Network Security", Paul Reid"

    Relevant Pages

    • Re: REVIEW: "Biometrics for Network Security", Paul Reid
      ... Some kind of CRC the reader goes through and the server ... because it doesn't have the private key stored inside the puppy. ... The host generates a random challange, and asks the card to encrypt it ... I see the need for both local authentication and remote/network ...
      (alt.computer.security)
    • Re: SCardTransmit Fails
      ... ' Advanced Card Systems, Ltd for the Smart Card Development Kit sample code. ... ' this reader be ignored. ... ' This implies that the given ... End Sub ...
      (microsoft.public.platformsdk.security)
    • Re: SCardTransmit Fails(Forgot to Attach File)
      ... ' Advanced Card Systems, Ltd for the Smart Card Development Kit sample code. ... ' this reader be ignored. ... ' This implies that the given ... End Sub ...
      (microsoft.public.platformsdk.security)
    • Re: RFID Flap Silences Security Researchers
      ... while - now it's down to credit card size. ... through a reader, just passed near it. ... RFID devices as people pass by. ...
      (comp.home.automation)
    • Re: External firewire CF card reader not recognised
      ... See if you can find any firmware updates for the card ... | After rebooting OS would recognise card reader as a type II CF reader, | however there was yellow exclamation mark next to it, after few seconds | ""SBP2 Compliant ... | I forgot to mention my machine has two firewire ports, one on the | motherboard the other with Audigy Platinum. ... | Weird thing both ports are listed in Dev Manager as OHCI Compliant IEEE 1394 | Host Controller with Microsoft drivers loaded. ...
      (microsoft.public.windowsxp.hardware)