Illustration of an eye with a scanning target over the iris
Image: ricardomaia, openclipart.org

As Microsoft announce they will be supporting Intel's biometric authentication in Windows 10 we should take a moment to think about whether this is a good idea. It's hard to argue with the convenience offered by biometrics. There's also little doubt that they are often going to be more secure than a poorly chosen, re-used, or just plain weak (or default) password. However they are no silver-bullet.

Strengths

  • Convenient.
  • Automatically high entropy.
  • Hard to brute force in untargeted attacks.
  • If implemented carefully robust to "pass the hash" style attacks (effectively preventing remote exploits).

Weaknesses

  • Automatically "re-used".
  • Kind of hard to change.
    (your fingerprints/iris images have been stolen, please change them)
  • Fairly easy to copy or spoof - and expect this to get commoditised in the form of a biometrics black market. Think of it as a bit like card "skimmers" that are inserted into cash points and copy your card, only what they are copying is your biometrics. Or lifting fingerprints from physical objects or high resolution photographs. Hacking poorly implemented biometric scanners could also yield this data.
  • A large scale example of databases of biometric information is the airports in the US capturing all your fingerprints as you enter.

The Solution

We have the answer already - in the form of strong asymmetric encryption with the private key held in a hardware security module. Now simply having access to something physically is not sufficient for many use cases (though we rely on it for securing many of our highest worth assets such as cars and houses). Unlocking the key using a local pin or biometric is not an unreasonable further precaution - and indeed I'd like to unlock my car or house that way! If a biometric is used for this anyone reasonably motivated with physical access is likely to be able to get in – which, though not perfect, is a huge improvement on what we often have today - but must be designed with great care and attention to detail.

So the bio-metric "answer you are looking for" is:

  • The key is protected in a hardened crypto-hardware module that does not allow the extraction of the key.
  • Bio-metrics or local pin / passphrase are used locally to unlock a key (implemented in hardware / firmware independent of the OS). A correctly implemented pin / passphrase being the more secure option in the right hands - ideally an option for both, potentially context dependent.
  • So bio-metrics are a complementary technology at best, and a placebo at worst.

I have a reasonable level of optimism this solution is what Intel / MS will actually deliver.

Cheers
Andy