User-Centric Key Entropy: Study of Biometric Key Derivation Subject to Spoofing Attacks

Abstract

Biometric data can be used as input for PKI key pair generation. The concept of not saving the private key is very appealing, but the implementation of such a system shouldn't be rushed because it might prove less secure then current PKI infrastructure. One biometric characteristic can be easily spoofed, so it was believed that multi-modal biometrics would offer more security, because spoofing two or more biometrics would be very hard. This notion, of increased security of multi-modal biometric systems, was disproved for authentication and matching, studies showing that not only multi-modal biometric systems are not more secure, but they introduce additional vulnerabilities. This paper is a study on the implications of spoofing biometric data for retrieving the derived key. We demonstrate that spoofed biometrics can yield the same key, which in turn will lead an attacker to obtain the private key. A practical implementation is proposed using fingerprint and iris as biometrics and the fuzzy extractor for biometric key extraction. Our experiments show what happens when the biometric data is spoofed for both uni-modal systems and multi-modal. In case of multi-modal system tests were performed when spoofing one biometric or both. We provide detailed analysis of every scenario in regard to successful tests and overall key entropy. Our paper defines a biometric PKI scenario and an in depth security analysis for it. The analysis can be viewed as a blueprint for implementations of future similar systems, because it highlights the main security vulnerabilities for bioPKI. The analysis is not constrained to the biometric part of the system, but covers CA security, sensor security, communication interception, RSA encryption vulnerabilities regarding key entropy, and much more.

Comparison of Security Signing Data Authentication Integrity in Combination of Digest And AES Message Algorithm

“…The 16 bytes which is produced from MixColumns is equal to 128 bits which is XORed with the round key of 128 bits. The above process has been repeated until final round to produce the corresponding cipher text [40].…”

An efficient emerging network and secured hopping scheme employed over the unsecured public channels

“…The strong channel established corresponding to a weak channel by the non-legitimate user could grab the original signals, and thus, the transmitter has no awareness at all about the interruption of the illegitimate entity in the system. For that, advanced security designs at the physical layer, the cryptanalysis solutions have also been implemented in the literature, 1,[35][36][37][38][39] but are considered as difficult implementations due to complexity of mathematical modeling for physical layer security. Although, almost all available cryptography solutions deployed for various communication systems are evaluated the best, regardless of massive complexities that are accounting during computations.…”

Feasibility analysis of Inter-Pulse Intervals based solutions for cryptographic token generation by two electrocardiogram sensors

“…Fuzzy extractors are not only applied to key generation protocols based on biometrics [60,61,62] but also for generating keys for authentication purposes, by using Physical Unconlable Functions (PUFs) [63,64], and for key generation in Vehicular Ad-Hoc Networks (VANETs) [65]. Formally, a fuzzy extractor is a function f which takes as input a biometric signal w, and produces a random string R and a public parameter P .…”