Preventing Guessing Attacks Using Fingerprint Biometrics

Security protocols involving the use of poorly chosen secrets, usually low-entropy user passwords, are vulnerable to guessing attacks. Here, a penetrator guesses a value in place of the poorly chosen secret and then tries to verify the guess using other information. In this paper we develop a new framework extending strand space theory in the context of these attacks to analyze the effect using fingerprint biometrics in those protocols. In particular, we will prove the efficacy of biometrics in preventing some known forms of guessing attacks which differ in the way the guess is verified. Interestingly, our approach shows a remarkable increase in security of selected protocols, subject to off-line guessing attacks. We illustrate these concepts on some examples.