The Practical Subtleties of Biometric Key Generation

The inability of humans to generate and remember strong secrets makes it difficult for people to manage cryptographic keys. To address this problem, numerous proposals have been suggested to enable a human to repeatably generate a cryptographic key from her biometrics, where the strength of the key rests on the assumption that the measured biometrics have high entropy across the population. In this paper we show that, despite the fact that several researchers have examined the security of BKGs, the common techniques used to argue the security of practical systems are lacking. To address this issue we reexamine two well known, yet sometimes misunderstood, security requirements. We also present another that we believe has not received adequate attention in the literature, but is essential for practical biometric key generators. To demonstrate that each requirement has significant importance, we analyze three published schemes, and point out deficiencies in each. For example, in one case...

• Type: Conference
• Year: 2008
• Where: USS
• Authors: Lucas Ballard, Seny Kamara, Michael K. Reiter
• Keywords: Biometric Key Generators, Cryptographic Key, Key Rests, Operating System, USS 2008