Biometric Authentication: How “Private” is Private Key?

Gregory J Chevalier

With each day, they are bringing new accounts of data theft, computer hacking and other forms of cyber crime.

Among the many solutions, biometrics, normally fingerprint authentication, has the potential to significantly increase the quality of security at the individual and network level. But the promise of biometrics – greater assurance that the individual accessing data is the person they claimed to be and is authorized to do so – can only be realized by eliminating the ability to circumvent that protection at the password level by securing a private key.

The most common digital keys on the Internet are in Asymmetrical Public Key Encryption. This involves use of two randomly generated keys. The first is referred to as the public key. As the name implies, a public key can be seen or known by anyone. It encrypts data for protection and verifies an electronic signature generated by its owner. The second key is the private key used to decrypt data that has been encrypted with the matching public key. It is also used to generate an electronic signature that can later be verified by the matching public key.

By having two keys, it allows for the creation and verification of digital identities. The private key represents a connection of a person’s physical identity to his or her digital identity. Maintaining its security is fundamental to overall data security.

So the question becomes how to secure the private key.

Historically, the private key, protected with a password, resides on a local computer. While this may provide adequate protection for users with a lower need for security, storing the private key on a computer’s hard drive means an average hacker who gains access to the hard drive could decrypt the private key in less than 30 minutes and then decrypt all data that is protected.

The best method for protecting access is through biometric authentication, and to have that authentication occur on a remote device.

True Solutions

There are two key elements to achieve true data security:

Protection of the private key by a much stronger factor of authentication than the current password authentication.
Removal of the private key from the physical location where it is being used.

Biometric authentication provides the higher level of user authentication assurance. Once the key is protected, there is a strong binding between the digital and physical identities. This strong binding provides true non-repudiation that the person performing the action was present. But on its own, it does nothing to physically protect the private key.

Off-location storage

If the private key is stored on the local computer, or ever generated on the local computer, it may be still be possible for an attacker to go after that key. If, on the other hand, the key was stored off the computer and generated on a secure cryptographic device, it is now much harder, if not nearly impossible, for the private key to be compromised. By storing the private key off the local computer, its owner can physically control when the key will be used. In this way, someone attacking the local machine where the protected data is stored would not be able to access the private key at the same time.

Such separation of protected data from the key used for its access is vitally important.

By using a cryptographic device for the protection of the private key, the device will interact with the local workstation to have documents accessed and digitally signed. The cryptographic device can provide functionality by performing so-called “on-board” signing and decryption. To decrypt a secured document, the publicly encrypted symmetrical key that was used to protect the document is sent to the cryptographic device for decryption. Once on the device, the private key is used to decrypt the symmetrical key, which is then sent back to the local workstation for decrypting of the protected document. When a digital signature is needed, the data to be signed is hashed, and the hash is sent to the cryptographic device. Once safely contained within the device, the private key is used to sign the hash, after which it is sent back to the local workstation to be sent with the data. During both processes, the private key never leaves the cryptographic device, providing no opportunity for it to be compromised.

The choice of cryptographic device is important as well.

The device storing the key needs to be physically secured and given strong authentication for digital protection.

The best method for protecting access to the key is through biometric authentication, and to have that authentication occur on a remote device.