5

Lets assume that there is a bio-metric algorithm for user authentication which compares fingerprints with a user's signature saved in a database (comparing function is not important here). Next, there is a device with a fingerprint sensor and memory to hold the user's signature. Now we have two options:

  1. Put algorithm and signature on device - device does computing and sends to PC information about matching captured fingerprint with signature
  2. Put signature only on device - device sends captured fingerprint and signature to PC which will run authentication algorithm

In each case data is encrypted and there is some security protocol used in communication.

The question is, which method is more secure?

I am not familiar with IT security but I see a risk with both methods. In case 2, someone may intercept the signature and crack its encryption. In case 1, I see a problem with a message sent to the PC. What information is needed to confirm that this message was from our device and that it contains a true matching response? Does connection encryption provide that information?

  • Why have the signature on the device? This way you will have to always worry about the signature being forged. Solution no.2 sounds better as long as you encrypt the communication channel – Ulkoma Jul 26 '15 at 12:55
  • The idea was to have personal device smartcard, smartphone etc. which will give access to bigger system. When signature is held on device there is no need to connect with database. – tobix10 Jul 26 '15 at 14:12
  • 4
    Do you need actual security? Because fingerprints are easy to copy – Natanael Jul 27 '15 at 20:58
  • The question involves imagined system, as an example I wrote about fingerprints. I want to know which method is more secure, thats all. – tobix10 Jul 29 '15 at 17:41
2

Generally, method 1 is more secure as it is possible to ensure the fingerprint image never leaves the scanner thus cannot be trivially copied via compromised software. Some anti-tampering technology can be employed to make it very expensive to try to extract data from the device.

Your concern about how the scanner proves to the computer that the actual fingerprint is scanned is normally done by making the device hold some secret. For example, when a fingerprint is enrolled, the scanner also agrees on the secret key with the host. Each time a user needs to be authenticated, the host will ask the device to perform some operation that is only possible with the knowledge of the secret.

Such a scanner is typically tied into some other security hardware (like a TPM on PCs or security co-process on phones) so that the correct fingerprint activates the security key for data encryption. All of these are handled outside the main CPU so data cannot be practically decrypted without the fingerprint.

-3

The security in this particular embodiment is generally quite low. But a proposal that I could make, is to do some hashing inside the fingerprint device if possible. Then the software in the PC will get the hash as password. In this way your fingerprint information is a little safer and you have a quick and strong password effortless.

Edit:

I am sorry for this wrong explanation. What I assumed is that you are constructing the device that you are referring to. So I proposed that the device could send a standard random produced and saved hash in case of correct fingerprint recognition. Not the fingerprint itself! So no fingerprint information leaves the hardware. Just the hash.

  • 2
    Hashing a fingerprint is impossible since the scanned fingerprint will vary with every scan. – marstato Mar 7 '16 at 12:56
  • Hash what inside the device? And wouldn't any sort of hashing have to be done by the manufacturer? as you wouldn't have access to the device's internal code. – Chenmunka Mar 7 '16 at 13:10
  • @Kostas Do you have examples that you can cite to show where this was done or KB/whitepaper evidence provided by a fingerprint device manufacturer that recommends this as a solution? – Jack Bahou Mar 7 '16 at 15:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.