Signature schemes with a fuzzy private key

Abstract

In this paper, we introduce a new concept of digital signature that we call fuzzy signature, which is a signature scheme that uses a noisy string such as biometric data as a private key, but does not require user-specific auxiliary data (which is also called a helper string in the context of fuzzy extractors), for generating a signature. Our technical contributions are threefold:(1) we first give the formal definition of fuzzy signature, together with a formal definition of a "setting" that specifies some necessary information for fuzzy data. (2) We give a generic construction of a fuzzy signature scheme based on a signature scheme that has certain homomorphic properties regarding keys and satisfies a kind of related key attack security with respect to addition, and a new tool that we call linear sketch. (3) We specify two concrete settings for fuzzy data, and for each of the settings give a concrete instantiation of these building blocks for our generic construction, leading to two concrete fuzzy signature schemes. We also discuss how fuzzy signature schemes can be used to realize a biometric-based PKI that uses biometric data itself as a cryptographic key, which we call the public biometric infrastructure.

Revisiting Fuzzy Signatures: Towards a More Risk-Free Cryptographic Authentication System based on Biometrics

“…In this work, we show that fuzzy signatures can indeed be efficiently and securely implemented in practice, and advocate the benefit of further practice-oriented research on fuzzy signatures. Our contribution is threefold: (i) we provide a much simpler, more efficient, and direct construction of fuzzy signature compared to [33]. Very roughly, depending on the amount of min-entropy we can extract from the fuzzy biometric, our construction can be proven secure based on the standard discrete logarithm (DL) assumption or proven unconditionally secure in the generic group model [31]; (ii) we establish novel statistical techniques to experimentally evaluate the conditions on biometrics that are required to securely instantiate fuzzy signatures; and (iii) we provide experimental results using real-world finger-vein dataset to show that finger-veins from a single hand can be used to construct efficient and secure fuzzy signatures.…”

“…In this section, we define a linear sketch, which has served as the main building block in previous generic constructions of fuzzy signature [33]. 3 Recall the main purpose of this was to "bridge" fuzzy data and standard cryptographic operations.…”

“…In a typical biometric authentication, the most natural and widely-used way to judge two biometrics x, x ′ are "close" is to calculate how close they are with respect to the Euclidean distance ∥x−x ′ ∥ 2 . The triangular lattice is a very suitable lattice in the sense that AR L tri (which is a regular hexagon) best approximates the closeness induced by the Euclidean distance compared to any other lattice L. We note that casting the linear sketch schemes in [33] in the framework of lattices, we see that they considered lattices with a square as the AR L (i.e., a lattice with basis B = 𝑑 • I 𝑛 for some positive real 𝑑 ∈ R). See Fig.…”

“…It can be checked that the fuzzy signaturebased biometric authentication system achieves the lowest security risk among the three systems. are quite limited and only produced by a small group [18,21,33] 2 .…”

“…[33] is the full-version of[32] and[21] with additional sections. Below, we mainly cite the full-version[33].…”