Re: Fingerprint as cryptokey

In article <ed41f6$o2o$1@xxxxxxxxxxxxxxxxxx>,
Kristian Gjøsteen <kristiag+news@xxxxxxxxxxxx> wrote:

Francois Grieu <fgrieu@xxxxxxxxxxxx> wrote:
I'm trying to find an information-theoretic argument that
there can't be a Biometrics -> Cryptokey function, not using
a database CONSTRUCTED FROM enrolled person's inputs, that
- generates the same output from two inputs acquired from
the same person with sizable probability (say > 2^-10)
- but still is very unlikely to produce the same outputs
from two inputs acquired from any two different persons
(say 2^-100).

Any clue ?

I don't see how there can be such an argument. If we ignore issues
of practicability and twins, what about DNA sequencing?
I would guess there is enough variability in DNA to ensure
perfect matches, even if you have to add some huge
error-correcting code to compensate for the inevitable
errors. Pass the error-corrected sequence through a suitable
hash function and you have your cryptokey with no database
involved, right?

No. Problem is, one can't "add error-correcting code" to biometrics
measurements, or DNA, without some database. The problem is in
"add": we can't change some of the biometrics. We'd have to find
an error-correcting code that works from arbitrary data, and this
is can be proven impossible, at least in some simplified models.


François Grieu
.

Relevant Pages
Quantcast