Biometrics vs. Cryptography

Today I attended a talk by Cathy Tilton, VP of Standard and Technology at Daon, on the $subject. It was pretty interesting.

The current security model for the verification of identity is based on using a token, tied to and thereby representing an individual. This token may be
- a password or shared secret (something you know)
- an identity card (something you have) or
- a biometric (something you are)

There is a growing interest in the use of biometrics which is evident from identification requirements at airports, embassies, new access control systems etc.

People in the field of cryptography (like me!) tend to compare privacy, security issues of biometrics with respect to cryptographic standards (mind-set if you will). However, this may not hold when you look at the way each is used.

In cryptographic authentication, users are provided with credentials by the service provider. It should be kept secret at all times. The objective is to verify the possession of such credentials when accessing the service. On the other hand, biometrics authentication does not rely on the secrecy of the biometrics used (finger prints, face, iris, etc). Rather, it relies on the integrity and authenticity of the data source. It should not be mistaken that privacy of biometric information is equally important - a compromised biometric database could be very harmful to public safety and national security. Further, biometrics alone for authentication have another potential drawback; how do we revoke a biometric template (digital form of biometric) when compromised?

The way to go forward is to combine biometrics with cryptography. One of the inherent issue (which is a current hot research topic) with biometrics is confidently associate a template with a user as different templates captured from the same user hardly match. It is always a probabilistic measure that leads to identification. I have seen some papers where people try to come up with techniques to associate a single value with user's biometrics measurements.