Chaos Computer Club breaks Apple TouchID
(Huge discussion here - lets add to it. ;-)There are several things here that people in discussion seems to miss och confuse. I've been working with biometrics and can at least try to clear things up.For authentication (and identification) of a user we have three types of information: Things you have (a hard token generator), things you know (password) and things you are (shape of face, gait, voice, pattern in the iris, arteries in the back of the eye, hand, DNA. And fingerprints). Measuring what you are info and using it is called biometrics.For good security we normally want to have a combination of at least two of the types. OpenID using for example a Yubikey is a good example.The good thing with biometrics is that the user always carry the info needed with him/her. There are a few drawbacks though:(1) The information is not very stable. It changes during the lifetime of the user. Sometimes it can be pretty rapid.(2) The information is not very unique. Some types of biometrics is better than others. There is also differences in informational quality between individuals and ethnic groups. Depending on type of biometrics we get anything from a few bits to a few ten of bits. This means that it is not better than a good password that is 8 characters or more, but as good as or a bit better than a normal PIN code.(3) The information is not under the users control and can't readily be replace. This is one thing many here and elsewhere seem to have missed in the CCC announcement. The point is that you as a user can't decide at any given time that you don't trust you token anymore, invalidate it and get a new token. That is why biometrics is foremost a tool _for others_ to identify you (passports, forensics).The reason fingerprint based biometrics is so popular (compared to other types of biometrics) is that it is possible to build compact, cheap sensors that are pretty easy to use and are simple to integrate into digital systems.All types of biometrics are fuzzy. We normally talk about False Acceptance Rate (FAR), that is how often do we accept a biometric ID as valid when in fact it is not. And correspondingly we have False Rejection Rate, where a valid ID is rejected. Good biometric systems have FAR, FRR under 10%. But for a busy airport there is still quite a few mistakes during a day.The way a fingerprint based biometric system normally works is that you have a sensor that creates an image (256 levels of gray scale or similarly). The image is then processed (differential filters etc) followed by feature extraction. The features are called minuae:https://en.wikipedia.org/wiki/MinutiaeTypically sworls, where lines end, merges splits. Normally we find 8-10-15 or a few more good minutae in the image. Based on the location of the minutae we create a graph.The graph is then stored (if registering a user - called enrollment) or compared to stored graphs. And here comes the fuzziness. The graph will not be similar so we simply can't do a SHA-1 digest and match. The graph will be rotated, scaled, stretched, have fewer or more points. Basically fuzzy congruence matching with threshold.The feature extraction can be done directly in the sensor. But in the case of TouchID I don't think so. Apple bought Authentec and their area sensors (that can capture a whole image directly. Sweep sensors detect movement of a finger over the sensor, estimate speed and stitch image slices together) simply delivered a raw image. This means that the filtering, feature extraction and matching is done inside A7.Apple has touted the security of the processing. Basically it is ARM Trust Zone used in several other devices.http://www.arm.com/products/processors/technologies/trustzon...TZ is good, but there has been attacks published. And there is nothing that says that Apple has not added a read port from the untrusted enclave into the memory of the trusted enclave. For efficient debug reasons for example.So. Biometrics is fuzzy and will give false acceptance (as the main problem. rejextion is less of a problem). There is quite probably an image available in the A7 and we really don't know if it and/or the graph database is in fact accessible.When it comes to the CCC attack - we simply don't know if they tried lower resolution before ending up with 2400 dpi. I wouldn't be surprised if it works (at least sometimes - fuzziness again) with lower resolution. Also attack always gets better. I'm prepared to bet a good IPA that someone within 2 years will show how he/she can unlock a 5S just by smartly pressing on the home button while breathing to activate residue as fingerprint. It has been done with area sensors such as Authentecs before.TouchID is good if it makes users without PIN to use it. But if it gets users with PINs stop using PINs, it is not as good. What would be great if we could combine TouchID with PIN or password. All the time.I hope all this explains a few things. And remember, once again, the main problem with biometrics is that it can't be changed at will by the user. Good for others, less so for the user.