This paper introduces a novel protocol for privacy-preserving biometric identification, named Monchi, that combines the use of homomorphic encryption for the computation of the identification score with function secret sharing to obliviously compare this score with a given threshold and finally output the binary result. Given the cost of homomorphic encryption, BFV in this solution, we study and evaluate the integration of two packing solutions that enable the regrouping of multiple templates in one ciphertext to improve efficiency meaningfully. We propose an end-to-end protocol, prove it secure and implement it. Our experimental results attest to Monchi's applicability to the real-life use case of an airplane boarding scenario with 1000 passengers,taking less than one second to authorize/deny access to the plane to each passenger via biometric identification while maintaining the privacy of all passengers.

This paper proposes a novel method to perform privacy-preserving face identification based on the notion of group testing, and applies it to a solution using the Cheon-Kim-Kim-Song (CKKS) homomorphic encryption scheme. Securely computing the closest reference template to a given live template requires K comparisons, as many as there are identities in a biometric database. Our solution, named Grote, replaces element-wise testing by group testing to drastically reduce the number of such costly, non-linear operations in the encrypted domain from K to up to 2\sqrtK . More specifically, we approximate the max of the coordinates of a large vector by raising to the α-th power and cumulative sum in a 2D layout, incurring a small impact in the accuracy of the system while greatly speeding up its execution. We implement Grote and evaluate its performance.

We propose a novel privacy-preserving, two-party computation of various distance metrics (e.g., Hamming distance, Scalar Product) followed by a comparison with a fixed threshold, which is known as one of the most useful and popular building blocks for many different applications including machine learning, biometric matching, etc. Our solution builds upon recent advances in function secret sharing and makes use of an optimized version of arithmetic secret sharing. Thanks to this combination, our new solution named Funshade is the first to require only one round of communication and two ring elements of communication in the online phase, outperforming all prior state-of-the-art schemes while relying on lightweight cryptographic primitives. Lastly, we implement our solution from scratch in portable C and expose it in Python, testifying its high performance by running secure biometric identification against a database of 1 million records in ~10 seconds with full correctness and 32-bit precision, without parallelization.

We propose an on-site voting system Themis, that aims at improving security when local authorities are not fully trusted. Voters vote thanks to voting sheets as well as smart cards that produce encrypted ballots. Electronic ballots are systematically audited, without compromising privacy. Moreover, the system includes a precise dispute resolution procedure identifying misbehaving parties in most cases.

We introduce a new wallet recovery pro-cess. Our solution associates 1) visual passwords: a photograph ofa secretly picked object (Chabanne et aI., 2013) with 2) ImageNet classifiers transforming images into binary vectors and, 3) obfuscated fuzzy matching (Galbraith and Zobernig, 2019) for the storage of visual passwords/retrieval of wallet seeds. Our experiments show that the replacement of long seed phrases by a photograph is possible.

This paper proposes a novel collaborative decryption protocol for the Brakerski-Fan-Vercauteren (BFV) homomorphic encryption scheme in a multiparty distributed setting, and puts it to use in designing a leakage-resilient biometric identification solution. Allowing the computation of standard homomorphic operations over encrypted data, our protocol reveals only one least significant bit (LSB) of a scalar/vectorized result resorting to a pool of N parties. By employing additively shared masking, our solution preserves the privacy of all the remaining bits in the result as long as one party remains honest. We formalize the protocol, prove it secure in several adversarial models, implement it on top of the open-source library Lattigo and showcase its applicability as part of a biometric access control scenario.

Given oracle access to a Neural Network (NN), it is possible to extract its underlying model. We here introduce a protection by adding parasitic layers which keep the underlying NN's predictions mostly unchanged while complexifying the task of reverse-engineering. Our countermeasure relies on approximating a noisy identity mapping with a Convolutional NN. We explain why the introduction of new parasitic layers complexifies the attacks. We report experiments regarding the performance and the accuracy of the protected NN.

International audience

International audience

International audience

The most fundamental purpose of blockchain technology is to enable persistent, consistent, distributed storage of information. Increasingly common are authentication systems that leverage this property to allow users to carry their personal data on a device while a hash of this data is signed by a trusted authority and then put on a blockchain to be compared against. For instance, in 2015, MIT introduced a schema for the publication of their academic certificates based on this principle. In this work, we propose a way for users to obtain assured identities based on face-to-face proofing that can then be validated against a record on a blockchain. Moreover, in order to provide anonymity, instead of storing a hash, we make use of a scheme of Brands to store a commitment against which one can perform zero-knowledge proofs of identity. We also enforce the confidentiality of the underlying data by letting users control a secret of their own.We show how our schema can be implemented on Bitcoin's blockchain and how to save bandwidth by grouping commitments using Merkle trees to minimize the number of Bitcoin transactions that need to be sent. Finally, we describe a system in which users can gain access to services thanks to the identity records of our proposal.

In this paper, we apply verifiable computing techniques to a biometric matching. The purpose of verifiable computation is to give the result of a computation along with a proof that the calculations were correctly performed. We adapt a protocol called sumcheck protocol and present a system that performs verifiable biometric matching in the case of a fast border control. This is a work in progress and we focus on verifying an inner product. We then give some experimental results of its implementation. Verifiable computation here helps to enforce the authentication phase bringing in the process a proof that the biometric verification has been correctly performed.

The secure two-party computation (S2PC) protocols SHADE and GSHADE have been introduced by Bringer et al. in the last two years. The protocol GSHADE permits to compute different distances (Hamming, Euclidean, Mahalanobis) quite efficiently and is one of the most efficient compared to other S2PC methods. Thus this protocol can be used to efficiently compute one-to-many identification for several biometrics data (iris, face, fingerprint).

We propose a novel vein extraction technique adapted to template protection and use it to apply a fuzzy commitment scheme. We construct dedicated error correcting codes that enable us to maintain a good accuracy after template protection. In a second application, we offer to overcome the alignment issues when comparing two vein templates by performing this step outside of the protection scheme. Different implementations are proposed to explore trade-offs between False Rejection Rate, False Acceptance Rate, comparison time and security. All approaches are tested on the recent database of University of Twente from ICB 2013. Our biometric performances are close to state of the art approaches whilst bringing security with the template protection scheme.

Since the seminal paper of Ratha et al. in 2001 that introduced cancelable biometrics, inner permutation of biometric templates has been widely suggested as one of the basic components to protect biometric data against compromised or cross-checking between two databases. In this paper, we study the case of iris biometrics where an inner permutation corresponds to shuffling the bits of a template in order to diversify the stored data. We analyze the security brought by a permutation and underline the impact of non-uniformity of templates on the robustness of cancelable biometrics: we introduce new attack strategies on permuted biometric databases that enable to reconstruct part of the permutation, leading to a potential privacy leakage. We finally suggest ways to improve efficiently the protection, by designing specific countermeasures, with no impact on accuracy and a low impact on the overall architecture of the system.

At WAHC'13, Bringer et al. introduced a protocol called SHADE for secure and efficient Hamming distance computation using oblivious transfer only. In this paper, we introduce a generalization of the SHADE protocol, called GSHADE, that enables privacy-preserving computation of several distance metrics, including (normalized) Hamming distance, Euclidean distance, Mahalanobis distance, and scalar product. GSHADE can be used to efficiently compute one-to-many biometric identification for several traits (iris, face, fingerprint) and benefits from recent optimizations of oblivious transfer extensions. GSHADE allows identification against a database of 1000 Eigenfaces in 1.28 seconds and against a database of 10000 IrisCodes in 17.2 seconds which is more than 10 times faster than previous works.

Shamir proposed the setbase approach as a means of improving security and privacy of the traditional biometric system. In this paper, we propose privacy-preserving drawer size standards for the biometric setbase. The proposal incorporates database privacy metrics such as k-anonymity and l-diversity into the definition of privacy-preserving drawer size standard for the biometric setbase. We also empirically evaluate the system reliability of the prototype setbase for the purpose of studying the trade-off values between the level of privacy protection and the level of system security.

Shamir proposed the setbase approach as a means of improving security and privacy of the traditional biometric system. As a result of the limitation of the current setbase filling procedure, we demonstrate that there are potential privacy weaknesses due to non-default distributions on attributes inside the identity database. We introduce in this paper, the concept of ϵ-closeness as a general framework to describe quantitatively the distribution anomaly. As a consequence, we are able to formulate a privacy-preserving drawer size standard for the setbase that includes the non-default distribution cases.

At ICS 2010, Dziembowski et al. introduced the notion of Non-Malleable Codes (NMC), adapting the cryptographic notion of non-malleability to the coding theory. Using NMC, if an attacker modifies a codeword, decoding this modified codeword will return either the original message or a completely unrelated value. The property of non-malleability depends on a family of modifications authorized to the attacker. In their paper, Dziem-bowski et al. propose a construction valid for the family of all bit-wise independent functions. At ITW 2011, Chabanne et al. proposed another construction for non-malleable codes w.r.t. bit-wise independent tampering functions by drawing a parallel between NMC and the Wire-Tap Channel II. In this paper, we show that the construction using Linear Coset Coding proposed by Chabanne et al. is non-malleable w.r.t. a larger class of functions, by considering linear tampering. Our results are derived from security results on Secure Network Coding using Linear Coset Coding, introduced by El Rouayheb and Soljanin at ISIT 2007.

In 2009, Shamir proposed the setbase approach to protect the privacy of biometric data during ID documents issuance. One year later, Bringer and Chabanne introduced negative databases for biometric data. In this paper, we show that negative database techniques can also be applied to the setbase approach to enforce some of its security characteristics.

In this correspondence, we analyze the vulnerabilities of biometric authentication protocols with respect to user and data privacy. The goal of an adversary in such context is not to bypass the authentication but to learn information either on biometric data or on users that are in the system. We elaborate our analysis on a general system model involving four logical entities (sensor, server, database, and matcher), and we focus on internal adversaries to encompass the situation where one or a combination of these entities would be malicious. Our goal is to emphasize that when going beyond the usual honest-but-curious assumption much more complex attacks can affect the privacy of data and users. On the one hand, we introduce a new comprehensive framework that encompasses the various schemes we want to look at. It presents a system model in which each internal entity or combination of entities is a potential attacker. Different attack goals are considered and resulting requirements on data flows are discussed. On the other hand, we develop different generic attacks. We follow a blackbox approach in which we consider components that perform operations on biometric data but where only the input/output behavior is analyzed. These attack strategies are exhibited on recent schemes such as the distributed protocol of Bringer (ACISP 2007), which is based on the Goldwasser-Micali cryptosystem, the related protocol of Barbosa (ACISP 2008), which uses the Paillier cryptosystem, and the scheme of Stoianov (SPIE 2010), that features the Blum-Goldwasser cryptosystem. All these schemes have been developed in the honest-but-curious adversary model and show potential weaknesses when considered in our malicious insider attack model.

At ITW'10, Bringer suggested to strengthen their previous identification protocol where the security depends on computational assumptions (related to the Polynomial Reconstruction problem) by extending the Code Reverse Engineering (CRE) problem to identification codes. We formalize this new problem and we extend security results by Tillich on this very problem. This enables us to prove the security of this protocol using information theoretical arguments.

Recently, Dziembowski et al. introduced the notion of non-malleable codes (NMC), inspired from the notion of non-malleability in cryptography and the work of Gennaro et al. in 2004 on tamper proof security. Informally, when using NMC, if an attacker modifies a codeword, decoding this modified codeword will return either the original message or a completely unrelated value. The definition of NMC is related to a family of modifications authorized to the attacker. In their paper, Dziembowski et al. propose a construction valid for the family of all bit-wise independent functions. In this article, we study the link between the second version of the Wire-Tap (WT) Channel, introduced by Ozarow and Wyner in 1984, and NMC. Using coset-coding, we describe a new construction for NMC w.r.t. a subset of the family of bit-wise independent functions. Our scheme is easier to build and more efficient than the one proposed by Dziembowski et al.

Abstract Biometrics make human identification possible with a sample of a biometric trait and an associated database. Classical identification techniques lead to privacy concerns. This paper introduces a new method to identify someone using his biometrics in an encrypted way. Our construction combines Bloom Filters with Storage and Locality‐Sensitive Hashing. We apply this error‐tolerant scheme, in a Hamming space, to achieve biometric identification in an efficient way. This is the first non‐trivial identification scheme dealing with fuzziness and encrypted data. Copyright © 2010 John Wiley & Sons, Ltd.

Starting from a practical use of Reed-Solomon codes in a cryptographic scheme published in Indocrypt'09, this paper deals with the threshold of linear q-ary error-correcting codes. The security of this scheme is based on the intractability of polynomial reconstruction when there is too much noise in the vector. Our approach switches from this paradigm to an Information Theoretical point of view: is there a class of elements that are so far away from the code that the list size is always superpolynomial? Or, dually speaking, is Maximum-Likelihood decoding almost surely impossible? We relate this issue to the decoding threshold of a code, and show that when the minimal distance of the code is high enough, the threshold effect is very sharp. In a second part, we explicit lower-bounds on the threshold of Maximum-Distance Separable codes such as Reed-Solomon codes, and compute the threshold for the toy example that motivates this study.

Identification codes were introduced by Ahlswede and Dueck more than twenty years ago. There is today a lot of studies to identify objects such as contactless devices (for instance RFID tags) but, surprisingly, no one has considered the use of this kind of codes in the literature for that purpose until the recent work of Bringer et al. at Indocrypt '09. We here show how the security of these new identification protocols is related to some well-known problems in coding theory. We also extend the original proposal to a new problem.

At first glance, privacy and zero-knowledgeness seem to be similar properties. A scheme is private when no information is revealed on the prover and in a zero-knowledge scheme, communications should not leak provers' secrets.

In this paper, we describe a new primitive for error-tolerant searchable encryption and a security model for it. This generic scheme permits to make searches on encrypted data with only an approximation of some keyword. It enables to efficiently query secure databases in order to get the exact data with a close estimation of it. An application to biometric identification arises from this construction. This is the first construction both for error-tolerant searchable encryption and for a biometric identification protocol over encrypted personal data.

Fuzzy commitment schemes, introduced as a link between biometrics and cryptography, are a way to handle biometric data matching as an error-correction issue. We focus here on finding the best error-correcting code with respect to a given database of biometric data. We propose a method that models discrepancies between biometric measurements as an erasure and error channel, and we estimate its capacity. We then show that two-dimensional iterative min-sum decoding of properly chosen product codes almost reaches the capacity of this channel. This leads to practical fuzzy commitment schemes that are close to theoretical limits. We test our techniques on public iris and fingerprint databases and validate our findings.

HB+is a lightweight protocol secure against active attacks but only in a detection based model. Since its introduction at Crypto'05 by Juels and Weis, many workers have tried to enhance its security. We here propose a new approach to achieve resistance against man-in-the-middle (MITM) attacks. Our requirements - in terms of extra communications and hardware - are surprisingly low.

In 1999, Juels and Wattenberg introduce an effective construction of Fuzzy Sketch, i.e., a way of handling errors into string verification. This allows them to consider data varying in time, such as, for instance, answers to a list of subjective questions. To this end, they use an error-correcting code. We show here how to embed a trapdoor into Fuzzy Sketches, reducing to authorized people the ability to correct errors and thus to verify the fuzzy equality to the Fuzzy Sketch.

Considering some passive eavesdropper, the feasibility of exchanging some secret data between an RFID tag and its reader through public discussion is established. No key distribution is required by our solution; the tag and the reader do not have to share any common data to form a confidential channel. For this, a natural phenomenon—the inherent noise on their communication link—is exploited. Classical protocols, consisting after an initialization step in three phases called advantage distillation, information reconciliation and privacy amplification, are then adapted to these highly constrained devices. First, the canvas of our study is presented. Next, the advantage distillation phase is discussed. Then, Brassard and Salvail's Cascade protocol is proved to be modifiable so as to reduce the hardware implementation cost while still maintaining adequate correction rate and tolerable leaked information during the reconciliation phase. Finally, as for the privacy amplification phase, the work on low-cost universal hash functions from YÜksel is pointed out, achieving to allege that public discussion under noisy environment might be an interesting possibility for low cost RFID tags.

We show how to attack an implementation of AES on an FPGA where all bytes are processed in parallel. We introduce a new way of retrieving information, mixing algebraic properties and physical observations. The attack is based on a generalization of the Square Attack. We focus on the electromagnetic side-channel, but our results are still valid for power consumption analysis as they reflect a global phenomenon inside the chip; and so, this contrasts with situations where eavesdroppers take advantage of local electromagnetic emanations.

The author introduce the n-dimensional key equation, which exhibits the error-locator polynomial of an n-dimensional cyclic code as a product of n univariate polynomials and the error-evaluator polynomial as an n-variable polynomial. They then reinterpret these polynomials in the context of linear recurring sequences. In particular, they reduce the decoding problem to successive application of the Berlekamp-Massey algorithm. With this new method, they are able to decode (up to half their minimum distance) many codes in a table of 2-D cyclic codes due to Jensen (1985).>

A permutation decoding procedure for abelian codes is introduced by using the Groebner bases theory. This method is valid for decoding all the binary abelian codes. Some examples are given to show how powerful this method can be.>