Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I am wondering if a biometric device can be used to generate some entropy or key material that would be stable across each authentication.

The contrary would be for biometric devices to act like an oracle, with a simple YES/NO answer to any authentication request.

What I am thinking about would be to gather the results of a biometric authentication and always come up with the same "number", which would be unique for any given biometric input.

For example, Alice biometric ouput would always be 64489c85dc2fe0787b85cd87214b3810, without having that number stored in advance somewhere, like I would generate a key from a password to decrypt something, without having store the password or key anywhere in advance.

I'm not interested (yet) in any standards or API for this, or in implementation details like the fact that all fingers from a same person would have a different (but stable) output. My question relates to the biometric authentication process inside the device.

share|improve this question
1  
I wouldn't rely on the biometrics to be "stable across each authentication" as you describe - at least, not without storing some sort of data (which goes directly against your proposal) they can be validated against. Biometric inputs are not always uniform, even from the same person using the same finger/eye/whatever. Heads might be tilted, eyes might be dilated/constricted, finger swipes might be harder/softer/longer/shorter/angled, etc. This is why, for authenticator registration, you are usually required to take multiple samples. – Iszi Jun 21 '12 at 19:48
I like your comment, make it an answer ! – ixe013 Jun 22 '12 at 14:42

2 Answers

up vote 1 down vote accepted

No,

If a device sequenced the user's genome from a skin cell, the results would be the same each time. Assuming the skin cells have replicated without errors. But it seems what you are asking is impossible, since you have to have a database somewhere that stores the answer to your key.

share|improve this answer
up vote 0 down vote

Entropy means that you get a different and unpredictable result each time through. So using a source that is even a little bit stable somewhat defeats the purpose.

If instead you mean using biometrics as a means for verifying identify, then now we're talking about old news -- that's exactly what biometrics are for. As for how to make it work the way you say, that's just an implementation detail, though I suspect the problem would be getting a number that's stable enough to be repeatable but at the same time unique to a given user.

share|improve this answer
Right, entropy might not be the best word to describe this. What I meant is that if were to compare all keys for all users, I would see that they are totally random, i.e. there is no way to predict one even if you know all the others. – ixe013 Jun 22 '12 at 14:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.