Biometric keys: suitable use cases and achievableinformation content

摘要

This article surveys use cases for cryptographickeys extracted from biometric templates ("biometric keys").It lays out security considerations that favor uses for theprotection of the confidentiality and privacy of biometricinformation itself. It is further argued that the cryptographicstrength of a biometric key is determined by its true infor-mation content. I propose an idealized model of a biometricsystem as a Shannon channel. The information content thatcan be extracted from biometric templates in the presence ofnoise is determined within this model. The performance ofstate-of-the-art biometric technology to extract a key from asingle biometric feature (like, e.g., one iris pattern or one fin-gerprint) is analyzed. Under reasonable operating conditionsthe channel capacity limits the maximal achievable informa-tion content k of biometric key to values smaller than about30 bits. This upper length limit is too short to thwart "bruteforce" attacks on crypto systems employing biometric keys.The extraction of sufficiently long biometric keys requireseither: (a) technological improvements that improve the rec-ognition power of biometric systems considerably or (b) theemployment of multimodal and/or multiinstance biometricsor (c) the use of novel biometric features, such as, e.g., thepattern DNA nucleotides in the human genome.