Biometric keys: suitable use cases and achievable information content

摘要

This article surveys use cases for cryptographic keys extracted from biometric templates (“biometric keys”). It lays out security considerations that favor uses for the protection of the confidentiality and privacy of biometric information itself. It is further argued that the cryptographic strength of a biometric key is determined by its true information content. I propose an idealized model of a biometric system as a Shannon channel. The information content that can be extracted from biometric templates in the presence of noise is determined within this model. The performance of state-of-the-art biometric technology to extract a key from a single biometric feature (like, e.g., one iris pattern or one fingerprint) is analyzed. Under reasonable operating conditions the channel capacity limits the maximal achievable information content k of biometric key to values smaller than about 30 bits. This upper length limit is too short to thwart “brute force” attacks on crypto systems employing biometric keys. The extraction of sufficiently long biometric keys requires either: (a) technological improvements that improve the recognition power of biometric systems considerably or (b) the employment of multimodal and/or multiinstance biometrics or (c) the use of novel biometric features, such as, e.g., the pattern DNA nucleotides in the human genome.