Abstract Privacy regulations and ethical concerns have encouraged the use of privacy-friendly synthetic data for the training of facial analysis systems. However, the automated generation of images depicting the same synthetic subject in different environmental scenarios remains challenging, as identity-related features may not be accurately preserved. This is a severe issue for the training of differential morphing attack detection (MAD) algorithms, where subtle differences in facial features can indicate morphing attacks. This work introduces IDSwapMAD as a new way for generating privacy-friendly training data for differential MAD methods. In detail, a generative adversarial network is employed to generate synthetic facial images of which the faces are swapped with pairs of real reference and probe images containing variations that mimic a border control scenario. In this way, style-related properties of the reference and probe images are retained, while identity-related features are replaced. It is shown that the proposed IDSwapMAD technique is an effective and privacy-friendly strategy for training differential MAD methods, whose detection performance is on par with a state-of-the-art MAD method trained on real data.

The fuzzy vault scheme has been established as cryptographic primitive suitable for privacy-preserving biometric authentication. To improve accuracy and privacy protection, biometric information of multiple characteristics can be fused at feature level prior to locking it in a fuzzy vault. In this work, we provide a formalisation of feature-level fusion in multi-biometric fuzzy vaults, on the basis of which relevant security issues are elaborated. In a case study, we construct a multi-biometric fuzzy vault based on face and multiple fingerprints. On a multi-biometric database constructed from the FRGCv2 face and the MCYT-100 fingerprint databases, a perfect recognition accuracy is achieved at a false accept security above 30 bits. We define countermeasures for observed security issues, that are commonly ignored and may impair the overall system’s security. Finally, a method for extending the fuzzy vault scheme with a password is proposed.

The vulnerability of facial recognition systems to face morphing attacks is well known. Many different approaches for morphing attack detection (MAD) have been proposed in the scientific literature. However, the MAD algorithms proposed so far have mostly been trained and tested on datasets whose distributions of image characteristics are either very limited (e.g., only created with a single morphing tool) or rather unrealistic (e.g., no print-scan transformation). As a consequence, these methods easily overfit on certain image types and the results presented cannot be expected to apply to real-world scenarios. For example, the results of the latest NIST FRVT MORPH show that the majority of submitted MAD algorithms lacks robustness and performance when considering unseen and challenging datasets. In this work, subsets of the FERET and FRGCv2 face databases are used to create a realistic database for training and testing of MAD algorithms, containing a large number of ICAO-compliant bona fide facial images, corresponding unconstrained probe images, and morphed images created with four different face morphing tools. Furthermore, multiple post-processings are applied on the reference images, e.g., print-scan and JPEG2000 compression. On this database, previously proposed differential morphing algorithms are evaluated and compared. In addition, the application of deep face representations for differential MAD algorithms is investigated. It is shown that algorithms based on deep face representations can achieve very high detection performance (less than 3% D-EER) and robustness with respect to various post-processings. Finally, the limitations of the developed methods are analyzed.

At Crypto'88, Matsumoto, Kato, and Imai presented two server-aided RSA protocols, RSA-S1 and RSA-S2, which speed up a clients RSA signature generation by interacting with a computationally strong but untrusted server. These protocolls are quite attractive by their efficiency, but unfortunately they are susceptible to multi-round active attacks. Therefore, on Eurocrypt'92, Pfitzmann and Waidner suggested to renew the decomposition of the secret key after each signature generation. In this paper we show that in this case the non-binary version of RSA-S1 becomes totally insecure. Our experiments show that the secret key can be reconstructed very efficiently by lattice reduction using the data obtained by the server during some executions of the protocol. On the other hand we show that if the decomposition of the secret key is slightly modified, our attacks become inefficient. This modification does not significantly affect the efficiency of the protocol. Furthermore, we present a very sim...