Statistical attack against iris-biometric fuzzy commitment schemes

The fuzzy commitment scheme has been leveraged as a means of biometric template protection. Binary templates are replaced by helper data which assist the retrieval of cryptographic keys. Biometric variance is overcome by means of error correction while authentication is performed indirectly by verifying key validities. A statistical attack against the fuzzy commitment scheme is presented. Comparisons of different pairs of binary biometric feature vectors yield binomial distributions, with standard deviations bounded by the entropy of biometric templates. In case error correction consists of a series of chunks helper data becomes vulnerable to statistical attacks. Error correction codewords are bound to separate parts of a binary template among which biometric entropy is dispersed. As a consequence, chunks of the helper data are prone to statistical significant false acceptance. In experiments the proposed attack is applied to different iris-biometric fuzzy commitment schemes retrieving cryptographic keys at alarming low effort.