Post-Quantum Secure Biometric Systems

Abstract

Biometrics, which is defined as the automated recognition of individuals based on their behavioural and biological characteristics, can be applied to increase the trust and usability of digital interactions. Due to their uniqueness and persistence, biometric characteristics allow for a reliable connection between an individual and their digital identity. However, these same properties of uniqueness and persistence also give rise to privacy concerns. Therefore, this thesis investigates the cryptographic protection of biometric systems. If such protection is built from classical cryptography, it has two main shortcomings: firstly, it is limited in the type of computations that can be performed on the encrypted data, and secondly, it does not provide longterm protection against threats posed by quantum computers. Fully homomorphic encryption can mitigate both of the aforementioned concerns. Based on hard lattice problems, it falls into a new category of mathematical problems that are believed to withstand known quantum computing attacks, called post-quantum cryptography. However, its practical efficiency remains an open challenge. Therefore, this thesis studies the efficiency of biometric systems under fully holomorphic encryption. In addition, this thesis addresses how biometric characteristics can be used to facilitate cryptographic key exchange, where a shared key for encrypted communication between a client and a server is computed correctly if and only if the biometric verification was successful. As with biometric comparisons in the encrypted domain, the security of such schemes against quantum computing threats needs to be considered in order to achieve a lasting protection of the sensitive biometric information. Finally, the security of biometric information protection against malicious adversaries, which can deviate arbitrarily from a given protocol, and its impact on the computational efficiency are investigated in this thesis.