Is a keyed MAC sufficient for integrity protection? I'm working with the above figure which shows a challenge-response protocol. 

Kc - shared key between the host and the client
B' - is a biometric captured by device
BT' - biometric template computed from B'
D' - device authenticator. 


Match(BT', BT) returns yes if the user computed biometric matches with the template, no otherwise. 

Verify(D', D) checks the validity of the authenticator. If all succeed at the host, host returns yes. 

My question is, does message 3 from client > host need to be encrypted for integrity protection? 

My instinct is no it doesn't, and using a keyed MAC is sufficient, because encryption does not guarantee integrity protection.
My question is, does message 3 from client > host need to be encrypted for integrity protection?


Encryption doesn't provide integrity protection at all. Authenticated encryption may provide such protection, but it would provide the same security as the MAC, which is already performed.


  My instinct is no it doesn't, and using a keyed MAC is sufficient, because encryption does not guarantee integrity protection.


You are correct.



However, you are also sending a biometric template unencrypted. This will leak information about the person's biometrics, and may compromise the entity authentication of the system. It is unclear from the question what use the template is to an attacker, but generally just sending out biometric data from a person is not secure in any form.

Leaking biometric data is morally wrong. If you send out biometric data without preserving confidentiality then you may be in violation of various laws and privacy regulations even at the UN-level. Note that even if the template doesn't directly spill biometric information of a person, maybe it can be used for others to perform entity authentication.

In short: you are in violation of the integrity of the person you are trying to protect (if you don't encrypt) rather than violating the integrity of the message; that is indeed covered by the MAC.