Subject: RE: [Speechsc] Advance Material for SI/SV Security Discussion atSpeechSC WG meeting Tuesday

From: "Shanmugham, Saravanan" <[email-masked]>
Date: Thu, 10 Mar 2005 09:27:27 -0800

I agree with Dave's analysis here.

Further more, what we are trying to achieve here is no more risky than
what is already supported in the IETF protocol or achitecture.

    1. If we are concerned about the storage of the voiceprint on a
server that could theoretically be broken into, the question we should
ask ourselves is, what is the risk it adds to the
system(network+server), considering we already transmit and store voice
in these systems. And these stored or transmitted voice streams, if
compromised, could be used to generate the voice print for the user. The
way I look at it, generating and storing a voice print is no more
different than transmitting & storing the voice in a different
code(though a highly custom codec, that cannot generate the audio back,
but then so is the DSR codec).
    
    2. The next question we should ask ourselves, is the value of the
voiceprint. Does it really compare to other biometrics like a
fingerprint or a retina scan in how its applied in verifying identity.
In speech verification we use a challenge response method which would
require the caller to mimic the voice on the voiceprint.  In that sense
the voice equivalent of a fingerprint or retina scan is a sufficient
segment of the users voice, which we know is already allowed to be
stored on servers attached to the network(voice mail) 

    3 If we are concerned about the security of the audio used for
verification, it is no more or less risky than today, as speech, today,
is carried over RTP/SRTP and that speech is used for various purposes,
including storing as a voicemail, to be recognized for information such
as passwords and PINs etc. The fact that we are applying a verification
algorithm instead of a recognition or storage operation does not make it
anymore of a risk.

Sarvi 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of David R Oran
Sent: Sunday, March 06, 2005 4:32 AM
To: [email-masked]'
Subject: [Speechsc] Advance Material for SI/SV Security Discussion
atSpeechSC WG meeting Tuesday

Here is some advance reading to frame the discussion. The IESG has a
"discuss" on the SpeechSC requirements document over the issue of
security and privacy concerns about providing speaker verification and
identification services.

This note contains some points I gleaned from reading the document cited
by the IESG (and which is also already cited in the security
considerations of section of the Requirements draft).

I'd appreciate any thoughts you have on this to inform the discussion. 
Please post as response to the list so we have a record.

If any of you wish to spend the $22 to otain the report, that wold be
very helpful. It's probably worth the money because there's a lot of
good stuff in there (despite my disagreement with the conclusions
related to SI and SV). See draft-ietf-speechsc-reqts-06.txt for the
exact citation.

Thanks, Dave (co-chair SPEECHSC and draft-ietf-speechsc-reqts-06.txt
author)

------------------------------------------------

I thought it prudent to read the entire NRC report which Steve Bellovin
used as a major justification for his "discuss". So, I swallowed my
annoyance at having to spend the $22 to download the PDF (otherwise you
can only read piecemeal and can't search). Here are what I believe are
the relevant quotes from the report:

"Recommendation: If biometrics are used to uniquely identify license
holders and to prevent duplicate issuance, care must be taken to prevent
exploitation of the resulting centralized database and any samples
gathered.  (6.3)" - Box Es.1 on P.21.

"Biometrics has the obvious advantage of authenticating the human, not
just the presented token or password.  Common biometrics in use today
verify fingerprints, retinas, irises, and faces, among other things.  
Downsides to biometrics include the fact that not all people can use all
systems, making a backup authentication method necessary (and
consequently increasing vulnerability); the fact that revocation is not
possible for current systems (the saying goes that most individuals
"have only two thumbs"); and that remote enrollment of a biometric
measure (sending one's fingerprint or iris scan over the Internet, for
example) may defeat the purpose and is easily compromised. " followed by

"Recommendation: Biometric technologies should not be used to
authenticate users via remote authentication servers because of the
potential for large-scale privacy and security compromises in the event
of a successful attack (either internal or external) against such
servers.  The use of biometrics for local authentication-for example, to
control access to a private key on a smart card-is a more appropriate
type of use for biometrics. (5.2) " - N.B. This seems to be the key
point of contention.

- External attacks against a speaker verification system can be foiled
by well-understood security means, and these are in fact employed by
speechsc - TLS encryption of the control channel, SRTP encryption of the
media channel, and authentication/authorization of all elements in the
chain from the speaker to the server holding the voiceprints.

- Internal attacks can be simply the stealing of the database or the
compromise of the server system, including its keying material. There is
the pragmatic issue of a server with voiceprints being like a
/etc/passwd file, so it is of course prudent to store the data encrypted
so it can't be stolen en masse. But speechsc is addressing a protocol
standard, so it isn't clear why we need to say more than we do about
that aspect, or more than is said about server security in the Radius
specs. Server compromise can leak voiceprint information. At issue is
whether it is the use of the voiceprints for authentication, or the mere
storage of the voiceprints which causes the security concerns. For
internal attacks, it appears to be the latter which is the privacy
issue.

- Speaker verification differs from other biometric authentication
techniques because it is easier to make it resilient to replay or
impersonation attacks. Unlike static biometrics like retina, face
geometry, fingerprints, etc., speaker verification can (and is) done via
challenge response protocols. The subject is asked to say a number of
words or a phrase chosen by the verification system, and the result
matched against the vocal characteristics captured in the voiceprint. 
Possession of a stolen voiceprint does not by itself enable
impersonation, as would a fingerprint or retina scan (c.f "The Sixth
Day", "Mission Impossible") etc.

- voiceprints of varying quality can be obtained by anything which can
record your voice. A voiceprint used for identification/verification
needs to be protected, but reality dictates that not all recording
devices will be super-secure, hence requiring those holding voiceprints
to be more secure than those holding speech recordings seems
questionable. The "security first" tradeoff would say well, then all
voice recording things need to be as secure as the servers holding
voiceprints. Are we prepared to go that far - revisit all the specs like
RTSP, SIP, XCON, etc. to ensure that they cannot be used to make
recordings that can be turned offline into voiceprints?

- an accurate voiceprint is in practice a biometric of the same
confidence as a fingerprint, retina scan, etc., with the exception that
it can't be used unless you can be induced to speak enough to allow a
match (sort of like the old call trace scene in the movies where the
bad/good guy hangs up before the listeners have enough time/info to
trace the call). Superficially it is more subject to surreptitious
acquisition and mishandling than other biometrics, but in reality I
don't believe it is given how easy it is to lift fingerprints from
identifying objects, get DNA samples from personal items, etc.

- speaker identification can be done by anything which can hear you
speak. If you speak in a non-secure session, there are obvious problems
(including surreptitious recording, as noted above). If you speak in a
secure session with authentication (by means other than speaker
verification, rendering the identification issues moot) it seems there
is an implicit agreement that your identity can be ascertained by the
participants, by your voice or other means with or without the aid of
computational services. If you speak in a secure session with explicit
anonymity, there is a higher degree of expectation that if the context
is one in which you are not identifiable by other means (e.g. 
historical, correlation with prior sessions that were not anonymous,
etc.) that no voiceprint exists, or if it does exist it is of limited
utility (e.g. it can identify you as "the one who's been interrupting on
the last three calls"). While the existence of speaker identification in
this situation does limit privacy somewhat, it is not out of line with
common expectations of privacy in live communication situations, or
after the fact for that matter. Those who are truly concerned that
indirect methods of identification (such as speaker
identification) be thwarted are the people who do things like use voice
distorting devices, rendering the identification and verification
systems impotent.

- Many other authentication methods also have privacy weaknesses of
various sorts. As the report points out (cf. p.67):
  "Private secrets are items of information that are so intimately
associated with an individual or with events in the (human) individual's
life that no other person (or few others) would be expected to know
about them. The use of private secrets for authentication causes several
problems.
People resist the use of private secrets for authentication on the
grounds that they are private and should not have to be revealed to
third parties (even to third parties who wish to authenticate us).
Private secrets are rarely completely private.23 This leads to another
problem: Any item of information that is used as a private secret to
authenticate an individual will typically be shared with all the people
and organizations that want to authenticate the individual (technical
measures exist that could prevent sharing this, but they are not widely
used). Each party who authenticates the individual therefore comes to
know the information that is supposed to be a private secret, and thus
the information becomes less private and less secret as time goes by.
Not only do these problems compromise the individual's privacy, but they
also gradually destroy the usefulness of the information as an
authenticator.
When the information's value as an authenticator has been substantially
degraded, another piece of (private) information will have to be chosen
as a new basis for the private-secret authentication process.
If this sequence of events is repeated enough times, many of the
individual's private secrets will have been revealed to large numbers of
other parties. The individual's privacy will have been put at
considerable risk, as will the ability of other parties to authenticate
the individual.
Social Security numbers are an excellent case study in this phenomenon,
as a recent incident involving the Princeton University admissions
office illustrates. Both Princeton University and Yale University use
Social Security numbers as student identifiers. Yale's admissions office
used the Social Security number as an authentication key to allow
students to access the status of their applications for admission via a
Web browser. A member of the Princeton University admissions office
staff discovered this and apparently used Social Security numbers
obtained from the records of applicants to Princeton in order to access
the Yale admissions Web site and learn about Yale's admissions
decisions."

_______________________________________________
Speechsc mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speechsc

_______________________________________________
Speechsc mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speechsc