📋 Tender Overview
Eurosmart welcomes this opportunity to provide feedback on the BSI draft TR-03166 Technical Guideline for Biometric Authentication Components in Devices for Authentication. This document is very timely the European Commission published two months ago its proposal for a revision of eIDAS which includes the issuance of a European Digital Identity Wallet in every Member State. Biometric technologies increasingly provide authentication means to access essential services e.g. finance administration soon a European Digital Identity Wallet. Therefore these technologies need to be secure enough and fulfil some necessary security requirements.However requirements applicable to biometric technologies need to undergo a reality check to ensure that they can effectively be implemented on the field specifically in consumer smartphone devices as we understand the intention. In this respect Eurosmart would like to provide its insights on the BSI technical guideline.I. Clarify The ScopeA section presenting the scope of this document seems to be missing. It will be beneficial as the field of application is unclear.In particular it should be clarified that this document does not cover the case of biometric authentication used in remote identity proofing.Besides biometric cards card fitted with a fingerprint sensor performing the biometric matching internally cant meet the requirements stated in this document for several reasons size of their sensors As such it should be explicitly noted that this document does not apply to biometric cards fitted with sensors i.e. biometric payment cards.Also all the usage of biometric authentication pertaining to law enforcement should be out of the scope of this document i.e. Automated border Control ABC used for border crossing or device for controlling the identity of an individual. The main reason is that these usages are ruled by very specific requirements Frontex national requirements in particular regarding FAR. Also as they usually take place in a supervised environment the risk of presentation attacks is lower particularly for face biometry.It seems this document also aims at addressing biometric verification used for physical access control A3UC1b 2.1Example. However we think the current document is unsuitable for physical access control using biometric verification in a single factor authentication. In this use case it is quite common that the reference biometry of authorised users is preregistered so that the user only has to present its biometry to cross the access control. The biometric system checks the candidate biometry to the reference biometry of authorised users. Therefore the biometric system does not really perform a biometric verification in 1 to 1 but in 1 to N where N is usually small a few hundredsthousands. When performing biometric verification in 1 to N with N small the requirements of FAR are much harder to meet.II. Biometric Assurance Level HighA VERY HIGHLY DEMANDING LEVEL BUT FOR WHICH USE CASESThe BSI technical guidelines do not provide any requirement to fit in with the current commercial use cases. The only applicable requirements for consumer biometrics are those defined by FIDO. As defined by the BSI technical guideline Biometric Assurance Level High requirements are more demanding than those used for current commercial use cases.Lack of biometric modalitiesThe FAR for single biometry for BAL High 1 in 333333 is 10 times the one required for BAL Substantial 1 in 33333. For facial biometry this level of requirement is beyond what NIST currently tests through its Facial Recognition Vendor Test FRVT which is limited at 1100 000 even for Technology Testing. When applied to scenario testing as per ISO 19795 testing this operation point is entirely impractical. This lack will definitely hamper the deployment on the market of products meeting this highly demanding requirement. Besides for those that will meet this requirement it is highly likely that the testing procedure may be questionable and thus may exhibit some bias. Therefore alternate modes of implementation as provided by the BSI technical guideline which rely on multimodal or multi-instance biometry may have to be carried out. While these alternates provide for higher FAR 1100 000 it still remain very hard to meet for facial biometry for many suppliers limiting the vendors able to meet this requirement. . Therefore additional biometric modalities should be added in the scope of the document such as iris to allow 1 multimodal biometry or 2 choice of biometry when opting for the single biometry authentication at level high which is impossible as of today in the current scope of the document. Also the technical report should be regularly updated to include any biometric modality that may arise on the market.BAL High does not take into consideration devices already on the fieldFrom the point of view of current devices the FAR required for single biometry for BAL High 1 in 333333 runs the risk of becoming an obstacle for users. Besides alternate modes of implementation relying on multimodal biometry may not be possible as whether this multimodal mode of implementation is supported by current devices is not guaranteed. In that regard a supplemental mode of implementation commensurate with the capacity of devices already on the field should be introduced for BAL High. Eurosmart suggests introducing a new mode of implementation combining PIN code and biometric verification to allow devices already on the field to meet BAL high but also Substantial. Also Eurosmart underlines that the FAR required for level Normal 1 in 10000 is the one currently used for finance and required by FIDO.
