Subject: [Speechsc] Advance Material for SI/SV Security Discussion at SpeechSC WG meeting Tuesday

From: David R Oran <[email-masked]>
Date: Sun, 6 Mar 2005 07:32:02 -0500

Here is some advance reading to frame the discussion. The IESG has a 
"discuss" on the SpeechSC requirements document over the issue of 
security and privacy concerns about providing speaker verification and 
identification services.

This note contains some points I gleaned from reading the document 
cited by the IESG (and which is also already cited in the security 
considerations of section of the Requirements draft).

I'd appreciate any thoughts you have on this to inform the discussion. 
Please post as response to the list so we have a record.

If any of you wish to spend the $22 to otain the report, that wold be 
very helpful. It's probably worth the money because there's a lot of 
good stuff in there (despite my disagreement with the conclusions 
related to SI and SV). See draft-ietf-speechsc-reqts-06.txt for the 
exact citation.

Thanks, Dave (co-chair SPEECHSC and draft-ietf-speechsc-reqts-06.txt 
author)

------------------------------------------------

I thought it prudent to read the entire NRC report which Steve Bellovin 
used as a major justification for his "discuss". So, I swallowed my 
annoyance at having to spend the $22 to download the PDF (otherwise you 
can only read piecemeal and can't search). Here are what I believe are 
the relevant quotes from the report:

"Recommendation: If biometrics are used to uniquely identify license 
holders and to prevent duplicate issuance, care must be taken to 
prevent exploitation of the resulting centralized database and any 
samples gathered.  (6.3)" - Box Es.1 on P.21.

"Biometrics has the obvious advantage of authenticating the human, not 
just the presented token or password.  Common biometrics in use today 
verify fingerprints, retinas, irises, and faces, among other things.  
Downsides to biometrics include the fact that not all people can use 
all systems, making a backup authentication method necessary (and 
consequently increasing vulnerability); the fact that revocation is not 
possible for current systems (the saying goes that most individuals 
“have only two thumbs”); and that remote enrollment of a biometric 
measure (sending one’s fingerprint or iris scan over the Internet, for 
example) may defeat the purpose and is easily compromised. " followed 
by

"Recommendation: Biometric technologies should not be used to 
authenticate users via remote authentication servers because of the 
potential for large-scale privacy and security compromises in the event 
of a successful attack (either internal or external) against such 
servers.  The use of biometrics for local authentication—for example, 
to control access to a private key on a smart card—is a more 
appropriate type of use for biometrics. (5.2) " - N.B. This seems to be 
the key point of contention.

- External attacks against a speaker verification system can be foiled 
by well-understood security means, and these are in fact employed by 
speechsc - TLS encryption of the control channel, SRTP encryption of 
the media channel, and authentication/authorization of all elements in 
the chain from the speaker to the server holding the voiceprints.

- Internal attacks can be simply the stealing of the database or the 
compromise of the server system, including its keying material. There 
is the pragmatic issue of a server with voiceprints being like a 
/etc/passwd file, so it is of course prudent to store the data 
encrypted so it can't be stolen en masse. But speechsc is addressing a 
protocol standard, so it isn't clear why we need to say more than we do 
about that aspect, or more than is said about server security in the 
Radius specs. Server compromise can leak voiceprint information. At 
issue is whether it is the use of the voiceprints for authentication, 
or the mere storage of the voiceprints which causes the security 
concerns. For internal attacks, it appears to be the latter which is 
the privacy issue.

- Speaker verification differs from other biometric authentication 
techniques because it is easier to make it resilient to replay or 
impersonation attacks. Unlike static biometrics like retina, face 
geometry, fingerprints, etc., speaker verification can (and is) done 
via challenge response protocols. The subject is asked to say a number 
of words or a phrase chosen by the verification system, and the result 
matched against the vocal characteristics captured in the voiceprint. 
Possession of a stolen voiceprint does not by itself enable 
impersonation, as would a fingerprint or retina scan (c.f "The Sixth 
Day", "Mission Impossible") etc.

- voiceprints of varying quality can be obtained by anything which can 
record your voice. A voiceprint used for identification/verification 
needs to be protected, but reality dictates that not all recording 
devices will be super-secure, hence requiring those holding voiceprints 
to be more secure than those holding speech recordings seems 
questionable. The "security first" tradeoff would say well, then all 
voice recording things need to be as secure as the servers holding 
voiceprints. Are we prepared to go that far - revisit all the specs 
like RTSP, SIP, XCON, etc. to ensure that they cannot be used to make 
recordings that can be turned offline into voiceprints?

- an accurate voiceprint is in practice a biometric of the same 
confidence as a fingerprint, retina scan, etc., with the exception that 
it can't be used unless you can be induced to speak enough to allow a 
match (sort of like the old call trace scene in the movies where the 
bad/good guy hangs up before the listeners have enough time/info to 
trace the call). Superficially it is more subject to surreptitious 
acquisition and mishandling than other biometrics, but in reality I 
don't believe it is given how easy it is to lift fingerprints from 
identifying objects, get DNA samples from personal items, etc.

- speaker identification can be done by anything which can hear you 
speak. If you speak in a non-secure session, there are obvious problems 
(including surreptitious recording, as noted above). If you speak in a 
secure session with authentication (by means other than speaker 
verification, rendering the identification issues moot) it seems there 
is an implicit agreement that your identity can be ascertained by the 
participants, by your voice or other means with or without the aid of 
computational services. If you speak in a secure session with explicit 
anonymity, there is a higher degree of expectation that if the context 
is one in which you are not identifiable by other means (e.g. 
historical, correlation with prior sessions that were not anonymous, 
etc.) that no voiceprint exists, or if it does exist it is of limited 
utility (e.g. it can identify you as "the one who's been interrupting 
on the last three calls"). While the existence of speaker 
identification in this situation does limit privacy somewhat, it is not 
out of line with common expectations of privacy in live communication 
situations, or after the fact for that matter. Those who are truly 
concerned that indirect methods of identification (such as speaker 
identification) be thwarted are the people who do things like use voice 
distorting devices, rendering the identification and verification 
systems impotent.

- Many other authentication methods also have privacy weaknesses of 
various sorts. As the report points out (cf. p.67):
  "Private secrets are items of information that are so intimately 
associated
with an individual or with events in the (human) individual’s life
that no other person (or few others) would be expected to know about
them. The use of private secrets for authentication causes several 
problems.
People resist the use of private secrets for authentication on the 
grounds
that they are private and should not have to be revealed to third 
parties
(even to third parties who wish to authenticate us). Private secrets are
rarely completely private.23 This leads to another problem: Any item of
information that is used as a private secret to authenticate an 
individual
will typically be shared with all the people and organizations that 
want to
authenticate the individual (technical measures exist that could prevent
sharing this, but they are not widely used). Each party who 
authenticates
the individual therefore comes to know the information that is supposed
to be a private secret, and thus the information becomes less private 
and
less secret as time goes by. Not only do these problems compromise the 
individual’s privacy, but
they also gradually destroy the usefulness of the information as an 
authenticator.
When the information’s value as an authenticator has been
substantially degraded, another piece of (private) information will have
to be chosen as a new basis for the private-secret authentication 
process.
If this sequence of events is repeated enough times, many of the
individual’s private secrets will have been revealed to large numbers of
other parties. The individual’s privacy will have been put at 
considerable
risk, as will the ability of other parties to authenticate the 
individual.
Social Security numbers are an excellent case study in this phenomenon,
as a recent incident involving the Princeton University admissions 
office
illustrates. Both Princeton University and Yale University use Social 
Security
numbers as student identifiers. Yale’s admissions office used the
Social Security number as an authentication key to allow students to 
access
the status of their applications for admission via a Web browser. A
member of the Princeton University admissions office staff discovered
this and apparently used Social Security numbers obtained from the
records of applicants to Princeton in order to access the Yale 
admissions
Web site and learn about Yale’s admissions decisions."

_______________________________________________
Speechsc mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speechsc

---

From: Dan Burnett <[email-masked]>
Date: Tue, 8 Mar 2005 11:19:20 -0800 (PST)

Good analysis.  I have one comment embedded below
which is a minor elucidation of a point you already
make.

-- dan

> draft-ietf-speechsc-reqts-06.txt 

Voiceprints typically consist of voice characteristics
compiled from multiple user utterances.  The original
utterances cannot be derived from the contents,
ensuring that access to a voiceprint alone does not
enable the direct creation of impostor utterances.
I believe you allude to this in the next paragraph.

> is an implicit agreement that your identity can be
> ascertained by the participants, by your voice or
> other means with or without the aid of computational
> services. If you speak in a secure session with
> explicit anonymity, there is a higher degree of
> expectation that if the context is one in which you
> are not identifiable by other means (e.g.
historical, 
> correlation with prior sessions that were not
anonymous, 

> associated with an individual or with events in the
(human) individual’s life
> them. The use of private secrets for authentication
causes several problems.
> People resist the use of private secrets for
authentication on the grounds
> that they are private and should not have to be
revealed to third parties
> (even to third parties who wish to authenticate us).
rarely completely private.23 This leads to another
problem: Any item of
> information that is used as a private secret to
authenticate an individual
> will typically be shared with all the people and
organizations that want to
> sharing this, but they are not widely used). Each
party who authenticates
> to be a private secret, and thus the information
becomes less private and
> less secret as time goes by. Not only do these
problems compromise the individual’s privacy, but
> they also gradually destroy the usefulness of the
information as an authenticator.
> to be chosen as a new basis for the private-secret
authentication process.
> other parties. The individual’s privacy will have
been put at considerable
> risk, as will the ability of other parties to
authenticate the individual.
> as a recent incident involving the Princeton
University admissions office
> illustrates. Both Princeton University and Yale
University use Social Security
> Social Security number as an authentication key to
allow students to access
> records of applicants to Princeton in order to
access the Yale admissions
> Web site and learn about Yale’s admissions decisions."

		
__________________________________ 
Celebrate Yahoo!'s 10th Birthday! 
Yahoo! Netrospective: 100 Moments of the Web 
http://birthday.yahoo.com/netrospective/