The short answer is that you can't do that.
All forms of biometrics are inexact. The input is a picture, and pictures are
never exactly the same from time to time. The picture might not be optical, but
it's a picture, no matter how it's gotted. The input picture is compared to a
set of reference pictures, and a comparison comes back as to whether it's close
enough to the reference.
In contrast, other forms of authentication are (in general) exact. Even if
someone's password is a stupid one like "puppies", an attacker is not going to
get in with "babydogs". It is very easy to do math to turn an exact input into
an exact, cryptographically useful result -- like turning a passphrase into an
AES key.
It is very difficult, nigh unto impossible, to take an inexact input like a
biometric and turn it into something exact and cryptographically useful.
Jonathan Katz mentioned fuzzy extractors, but they're not a mature technology.
I know someone who did a very nice extractor for fingerprints. It was very
elegant, but it's maximum entropy was about 18 bits, and typically more like 9.
Once you knew how the algorithm turned a fingerprint into a key, the search
space was small and not evenly distributed. In fact, it wasn't much harder to
compute a rainbow table than to do a single search.
Jon
_______________________________________________
cryptography mailing list
[email protected]
http://lists.randombit.net/mailman/listinfo/cryptography
