Not surprisingly, there’s been a lot of discussion about the RSA SecurID debacle among my colleagues at Kuppinger-Cole. Martin Kuppinger has written an advisory note for SecurID customers (“Advisory Note – RSA SecurID”) in which he notes, “Throwing out SecurID and starting anew is not an option for most user organizations.” Distinguished analyst Craig Burton penned a blog entry (“How to Spot an Unnecessary Identity Fail”) reminding us that the failure of SecurID wasn’t also a failure of PKI. (Public Key/Private Key infrastructure, invented by Rivest, Shamir and Adleman, who founded RSA Security). He also notes the major difference between asymmetric (the good kind) and symmetric (the not so good kind) of PKI.
It reading all of these things together I was struck by how similar the arguments were to those surrounding biometric authentication.
DEBATE: National Research Council report on biometrics raises hard questions, ire
On the pro side, the quality of biometric authentication (just as the quality of PKI) shouldn’t be denigrated because of poor implementations (as RSA seems to have done with SecurID).
On the con side, we’re always being told that “if criminals have compromised your fingerprints, you can’t get new fingers” (“Fingerprint Follies and the Superman/Clark Kent Biometric Conundrum” Yale Law School Lawmeme).
Now I do agree that there is no unbreakable authentication scheme. So it’s always a question of when, not if, your authentication is compromised. Fingerprint readers can be (and have been) designed to overcome simple fraud (pictures, rubber fingers, amputated fingers, etc.) — they just cost a little more.
But if one fingerprint has been compromised — you still have nine others (just as you can re-seed your SecurID token).
So here’s what we need:
• Hardened fingerprint readers that aren’t easily fooled.
• Asymmetric PKI using the fingerprint measurements as the seed for the private key.
• Use of a PIN (or username/password if you will) to generate the PKI encryption.
That’s at least as strong an authentication as a well designed security token but with great advantages:
• You can’t forget your finger on your bureau, or look it in your car.
• No one can surreptitiously pick your pocket and steal your finger.
• No amount of spear phishing will be able to get you to reveal your fingerprint metrics — because you don’t know what they are.
Take another look at biometrics; it could be the key that protects your most valuable assets.
