2
$\begingroup$

enter image description here

I'm working with the above figure which shows a challenge-response protocol.

Kc - shared key between the host and the client
B' - is a biometric captured by device
BT' - biometric template computed from B'
D' - device authenticator. 

Match(BT', BT) returns yes if the user computed biometric matches with the template, no otherwise.

Verify(D', D) checks the validity of the authenticator. If all succeed at the host, host returns yes.

My question is, does message 3 from client > host need to be encrypted for integrity protection?

My instinct is no it doesn't, and using a keyed MAC is sufficient, because encryption does not guarantee integrity protection.

$\endgroup$
2
$\begingroup$

My question is, does message 3 from client > host need to be encrypted for integrity protection?

Encryption doesn't provide integrity protection at all. Authenticated encryption may provide such protection, but it would provide the same security as the MAC, which is already performed.

My instinct is no it doesn't, and using a keyed MAC is sufficient, because encryption does not guarantee integrity protection.

You are correct.


However, you are also sending a biometric template unencrypted. This will leak information about the person's biometrics, and may compromise the entity authentication of the system. It is unclear from the question what use the template is to an attacker, but generally just sending out biometric data from a person is not secure in any form.

Leaking biometric data is morally wrong. If you send out biometric data without preserving confidentiality then you may be in violation of various laws and privacy regulations even at the UN-level. Note that even if the template doesn't directly spill biometric information of a person, maybe it can be used for others to perform entity authentication.

In short: you are in violation of the integrity of the person you are trying to protect (if you don't encrypt) rather than violating the integrity of the message; that is indeed covered by the MAC.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.