...except for those with arrhythmia.

All fine and dandy, but will somebody please think of the heart transplant patients.

Paris, because she has a heart.

that by inducing stress (fear, etc) one could possibly prevent the patient from generating the correct key. Could this be useful to an attacker?

A very neat solution.

And no - arrhythmia isn't a problem. What they have done is to solve the key distribution problem. Here the key is encoded the time between a series of heartbeats. They showed that, in principle, the pacemaker can observe the heartbeat intervals, and the external programmer can observe the same intervals. They both see the same data, and hey presto - shared key. What you are hoping for is a reasonable amount of entropy in that shared observation. Enough to find 64 bits (at least) of shared key.

There are lots of different cardiac conditions, and as many pacemaker types. Even those conditions that require every heartbeat to be triggered by the pacemaker could in principle include enough variation in period to encode the key - in this case the pacemaker itself would effectively be generating and transmitting the key in its normal operation. Pacemakers that watch and only step in when needed would rely on the heart's natural jitter in heartbeat period to generate the key. The worst thing would be a very stable heartbeat - since there would not be so much entropy in the shared key.

Like I said - neat.

Actually it would make no difference for people with arrhythmia. Would work just as well if not better with these people.

would be better surely.. the point is both are derived from the same pulse, the more irregular the less susceptibe it is to guessing...

This is all good and well, but this helps proove the point that biometrics is a bad form of authentication because it's non-revokable. At the base level its security by obscurity. Hide the pattern and hope to god no-one else finds it and can replicate it.

So when fingerprints and iris scanners are common place, lets move onto anatomical scans (Heartrate, size of forearm, how many hairs on your deriarse?) but its always going to get easier to scan for that info. Tit for Tat.

On the otherhand, a fast processor can break a private key. So keep increasing it, bigger harder numbers, New algorithms. Ah, Quantum computing :- there is quantum cryptography too. PKI ensures that the probability of a identity theft is very low, assuming that the private key is kept secret. Just as secret as your fingerprint or the formula for predicting your heartrate.

The point is that if anyone discovers your private key, you change it. If anyone discovers the blueprints to your body.. what? Kill yourself?

Meanwhile its one hell of a money feast at the public pork barrel.

...do you get a warning saying "Specified key is a known weak key and cannot be used"? ;)

That'd be fine. The system only allows you to fiddle with the settings if the remote has a matching signal. A doctor would have the remote hooked up to the patient, but Boris T Hacker won't.

Would someone who'd had a heart transplant need a pacemaker?

Oh great, now I would have to authenticate against my own machine. Get Microsoft BOB or clippy in on the action and it would be complete!

"I see that you are having a heart attack - would you like me to defib you?"

Only to get a response like:

"I'm very sorry Dave but I cannot do that" -or-

"authentication failed - please retype your password"

I realize there is no password but imagine if your own pacemaker locks you out.

My reading of the article is that you connect a device to the patient's finger, it triggers the implant to prepare a key, both devices watch the next 16 beats to build a key, then use it for secure communications. So how are arrhythmia or heart transplants a problem?

So, let me get this straight. In order to communicate with a wireless device, they need to create a physical connection to the person carrying said device?

Wouldn't it just be easier to have some sort of "through the skin" induction-like direct connection and get rid of the wireless completely? Benefit there is increased battery life as it then doesn't have to drive that signal.

Does no heartbeat map to a default key as a safety backup? I'm working on plans for my remote controlled zombie army.

...are analogous to electrical pulses travelling through transmission lines with capacitance: waveforms will deform.

Blood vessels will constrict to different degrees at different times (analogous to changing the capacitance in an electric line), so the agreement between the two heartbeat waveforms can be expected to fluctuate over time. Whether the signal degradation would be enough to affect the timing scheme is open to question. I just hope they're testing over a wide range of constriction.

Give us a fag, mate?

I'm not the best at maths, but it seems to me that there just aren't enough variables in a heartbeat to make this too challenging to overcome. If someone could clarify for me it'd be great.

So, if you can monitor someone's heartbeat, perhaps when they touch something, e.g. a door handle, you can take control of their implants.

On the other hand, wiring the door handle to a high voltage supply is probably a more effective, though less subtle means of attack. And you don't have to wait for your target to hold the handle for 16 heartbeats.

Mine's the one with the insulated gloves...

What do you get? The Blue Screen of Death of course.

If you heartbeat goes up if you see a 'racy' picture advert and that's used as the key.

Does this mean we more porn to watch on this inter-wet thing.?

The devices would only authenticate if both are taking the same reading from the patient at the same time.

Prevents someone from committing random murders by hacking together some gear and wirelessly reprogramming people's pacemakers.

Then again I am hoping current pacemakers do some sanity checking in the range of values they accept, and that the wrong values wouldn't lead to sudden death.

well, the variables that we take in consideration are the variation of the size between the heartbit duration.

made up example:

using the first interval like unit and then you compare with the others intervals, for example. if you measure with accuracy of 1000th parts, then every interval after first heart bit gives you to at least 3 decimal, discard the first decimal( as will be commonly 0,1 or 9) and the 3rd( as will contain the measurement error),taking the second and "more" ramdon cipher, you got at least 14 digits decimal number like:

58692834495220 using an approx 10^3 ~= 2^8 this is on the 2^(8*5) range, or 40 bits.

the key size depens on the number of heart bit measure and the accuracy of measurement and the number of cipher used per measurement.

Yea - review folks, it doesn't matter if you have a baboon's heart - the heart is simply the generator of the common key both "listeners" need to chat. Heck, you could probably use a microphone on the gurgles of stomach acid for 15secs to generate a sufficient key.

Just comes down to true strong authentication: Have something you know + something you have/are/do... in this case, you have to know you need 2nd listening device and the something you have is the heart's natural rhythm (so long as the pace maker isn't active the entire time they are listening...)

But really folks - i know it's academic, bet we're talking about people hacking a sick person's heart - so Rube Goldberg... just freaking feed the person McD's double quarter pounders or maybe that new "Baconator", or even better - fire up a degausser... - they won't be 'round much longer after that. >:-)

what when the doctors favorite nurse walks in just as he/she is logging in?

or if the patient is crashing and the doctor is anxious?

like the idea of making a black hole on a planet, how did this make it from doodle to whiteboard, let alone get through approval stages. duh.

umm didn't they already do this on mission impossible 3?

p.s i have it on good authority that the record of accidental defibrillations at the top heart hospital currently stands at 32.. (making my paltry 8 seem a little febrile)

"Nope, This one's dead, It can't be him."

Are'nt they missing the beat?

And "randomly hacking together some gear"?

I just use a microwave...and ZAP!"

how about using those Wii controllers, strap a few around the body when having sex.

new type of key gen.....

In the best eastenders voice, "here lov, lets hav a quick one .I need to check my online banking"