Cryptography is the art of coding private information using secret keys, while biometrics use personal features and behaviour of the individual (iris, face, fingerprints, voice, gait, etc.) to indentify and verify the user correctly.
Crypto-biometric systems combine cryptography and biometrics to benefit from the strengths of both fields. In such systems, while cryptography provides high and adjustable security levels, and can be used not just for authentication, but also for encryption, biometrics brings in non-repudiation and eliminates the need to remember passwords or to carry tokens.
Some characteristics of crypto-biometry are:
- Perfect and unique keys linked to your own human attributes.
- Perfect Authentication: no one can be yourself and nobody can impersonate you.
- Impossible to repudiate: no one can deny being himself.
- Impossibility of theft or manipulation by another of your criptobiometrics key.
- A high entropy password with no need to remember: you carry with you forever.
- The keys are obtained from your attributes, but they are not your attributes, so you can generate as many criptobiometrics keys from your biometric patterns as desired.
It is important makes the distinction between two general approaches within of crypto-biometric systems, according to the coupling level of cryptography and biometric:
Biometrics-based key release: refers to the use of biometrics authentication to release a previously stored cryptographic key. Biometric authentication is used as a wrapper, adding convenience to traditional cryptography where the user would have been in charge of remembering his/her key; however the two techniques are only loosely coupled.
Biometrics-based key generation: refers to extracting/generating a cryptographic key from a biometric template. In this case, biometrics and cryptography are tightly coupled: the secret key is bound to the biometric information and the biometric template is not stored in plain form.
- Access Control and Identity.
- Card-free access.
- Secure payment systems.
- Reliable e-Commerce.
- Secure financial transaction management.
- Border control systems and immigration check.
- e-Voting and citizenships management systems.
- Hospital management of patients.
- Legal security and verification.
- Criminal identification.