{"id":743,"date":"2007-04-05T08:34:02","date_gmt":"2007-04-05T16:34:02","guid":{"rendered":"\/?p=743"},"modified":"2007-04-05T08:34:02","modified_gmt":"2007-04-05T16:34:02","slug":"without-be-templates-are-your-biometrics","status":"publish","type":"post","link":"https:\/\/www.identityblog.com\/?p=743","title":{"rendered":"Without BE, templates ARE your biometrics"},"content":{"rendered":"

The more I learn<\/a> from Alex Stoianov about the advantages of Biometric Encryption<\/a>, the more I understand how dangerous the use of conventional biometric templates really is.  I had not understood that the templates were a reliable unique identifier reusable across databases and even across template schemes without a fresh biometric sample.<\/em>  People have to be stark, raving mad to use conventional biometrics to improve the efficiency of a children's lunch line.<\/p>\n

Alex begins by driving home how easy template matching across databases really is:<\/p>\n

Yes, that\u00e2\u20ac\u2122s true: conventional biometric templates can be easily correlated across databases. Most biometric matching algorithms work this way: a fresh biometric sample is acquired and processed; a fresh template is extracted from it; and this template is matched against previously enrolled template.<\/p>\n

If the biometric templates are stored in the databases, you don\u00e2\u20ac\u2122t need a fresh biometric sample for the offline match – the templates contain all the information required.<\/p>\n

Moreover, this search is extremely fast, such as 1,000,000 matches per sec is easily available. In our example, it would take only 10 sec to search a database of 10,000,000 records (we may disregard for now the issue of false acceptance \u00e2\u20ac\u201c the accuracy is constantly improving). Biometric industry is actively developing standards, so that very soon all the databases will have standardized templates, i.e. will become fully interoperable.<\/p>\n

BE, on the other hand, operates in a \u00e2\u20ac\u0153blind\u00e2\u20ac\u009d mode and, therefore, is inherently a one-to-one algorithm. Our estimate of 11.5 days for just one search makes it infeasible at present to do data mining across BE databases. If the computational power grows according to Kim\u00e2\u20ac\u2122s estimates, i.e. without saturation, then in 10 – 20 years the data mining may indeed become common.<\/p>\n

Kim already suggested a solution \u00e2\u20ac\u201c just make the BE matching process slower! In fact, the use of one-way slowdown functions (known in cryptography) for BE was considered before. The research in this area has not been active because this is not a top priority problem for BE at present. In the future, as long as the computer power grows, every time the user gets re-enrolled, the slower function will be applied to keep the matching time at the same level, for example, 1 sec.<\/p>\n

Other points to consider:<\/p>\n