Lets assume that there is a bio-metric algorithm for user authentication which compares fingerprints with a user's signature saved in a database (comparing function is not important here). Next, there is a device with a fingerprint sensor and memory to hold the user's signature. Now we have two options:
- Put algorithm and signature on device - device does computing and sends to PC information about matching captured fingerprint with signature
- Put signature only on device - device sends captured fingerprint and signature to PC which will run authentication algorithm
In each case data is encrypted and there is some security protocol used in communication.
The question is, which method is more secure?
I am not familiar with IT security but I see a risk with both methods. In case 2, someone may intercept the signature and crack its encryption. In case 1, I see a problem with a message sent to the PC. What information is needed to confirm that this message was from our device and that it contains a true matching response? Does connection encryption provide that information?