Generating and sharing biometrics based session keys for secure cryptographic applications

Crypto-biometric systems, which combine biometrics with cryptographic systems, are gaining more and more attention. Person verification with high degree of assurance offered by biometrics can greatly improve the security of a cryptographic system. In such systems, a stable crypto-biometric key (to be used for cryptography) is derived from biometrics and a strong link between the user identity and the cryptographic keys is established. In this paper, we first propose a simple and effective protocol to securely share such crypto-biometric keys. Moreover, we propose another protocol to generate and share session keys which are valid for only one communication session. This protocol achieves mutual authentication between the client and the server without the need of trusted third party certificates. This protocol also facilitates easy online updating of templates. The stored templates are cancelable. The protocols are evaluated for biometric verification performance on a subset of the NIST-FRGCv2 face database.