Revisiting Yasuda et al.’s Biometric Authentication Protocol: Are You Private Enough?

Abstract

Biometric Authentication Protocols ($\mathsf {BAP}$s) have increasingly been employed to guarantee reliable access control to places and services. However, it is well-known that biometric traits contain sensitive information of individuals and if compromised could lead to serious security and privacy breaches. Yasuda et al. [23] proposed a distributed privacy-preserving $\mathsf {BAP}$ which Abidin et al. [1] have shown to be vulnerable to biometric template recovery attacks under the presence of a malicious computational server. In this paper, we fix the weaknesses of Yasuda et al.’s $\mathsf {BAP}$ and present a detailed instantiation of a distributed privacy-preserving $\mathsf {BAP}$ which is resilient against the attack presented in [1]. Our solution employs Backes et al.’s [4] verifiable computation scheme to limit the possible misbehaviours of a malicious computational server.

A Details in the Correctness Analysis

In this section, we show the intermediate steps of the calculation.

The derived tags are:

The homomorphic bilinear map calculation results are:

To prove that $W = {\mathbf {GroupEval}}(f,R_{\alpha }, R_{\beta })$ satisfies Eq. (4), we start by analysing the three factors that made up the righthand of the equation, namely: $e(g, g)^{y_{0}^{{\mathsf {HD}}}}\cdot e(Y_{1}^{{\mathsf {HD}}}, g)^{\theta }\cdot (\hat{Y}_{2}^{({\mathsf {HD}})})^{\theta ^{2}}$.We in turn expand each one of the factors and finally compute the product of the results, evaluating it against W.

The first factor can be expanded as:

$$\begin{aligned} e(g, g)^{y_{0}^{HD}}=e(g, g)^{C_2 \cdot y_{0}^{(A)}+ C_1 \cdot y_{0}^{(B)}+ D \cdot y_{0}^{(A)}\cdot y_{0}^{(B)}} =e(g, g)^{C_2\alpha + C_1 \beta + \alpha \beta D}. \end{aligned}$$

The second factor is expanded as:

The third factor is expanded as:

Here we need to prove the right hand side is equal to W. We use a temporary variable $P = e(g, g)^{y_{0}^{{\mathsf {HD}}}}\cdot e(Y_{1}^{{\mathsf {HD}}}, g)^{\theta }\cdot (\hat{Y}_{2}^{({\mathsf {HD}})})^{\theta ^{2}}$ to denote the expansion result of the righthand-side. The expression below proves the correctness of the second verification Eq. (4).