Vulnerabilities in Biometric Encryption Systems

Biometric encryption systems embed a secret code within a biometric image in a way that it can be decrypted with an image from the enrolled individual. We describe a potential vulnerability in biometric encryption systems that allows a less than brute force regeneration of both the secret code and an estimate of the enrolled image. This vulnerability requires the biometric comparison to “leak” some information from which an analogue for a match score may be calculated. Using this match score value, a “hill-climbing” attack is performed against the algorithm to calculate an estimate of the enrolled image, which is then used to decrypt the code. Results are shown against a simplified implementation of the algorithm of Soutar et al. (1998). Possible extensions of this attack to other biometric encryption algorithms are discussed.