1

I've always argued that, while biometrics can be a step in the right direction for basic passwords/hashing setups like computer or phone lock screens, especially when combined with multi-factor authentification, I have yet to see any value in the technology as far as encryption goes. Thus, my question is twofold:

  1. Can a file be symmetrically encrypted using something like a fingerprint? If not, does it just have to do with a lack of available data points, or is there some other explanation?

  2. Could something like multi-factor authentication exist for symmetrical encryption, such as requiring data from both a password and fingerprint?

Verbal Kint
  • 737
  • 1
  • 6
  • 20
  • 1
    A fingerprint would be a terrible key. It's relatively easy to discover, and nearly impossible to change. – S.L. Barth Aug 04 '16 at 14:10
  • I'm not saying that it would be practical or secure, especially on its own. Which lends more emphasis to the second part of the question, can multi-factor authentication be used with common encryption algorithms? – Verbal Kint Aug 04 '16 at 14:13

1 Answers1

2

Can a file be symmetrically encrypted using something like a fingerprint? If not, does it just have to do with a lack of available data points, or is there some other explanation?

You could scan a fingerprint, and use that file as a key. It's a terrible idea however. A fingerprint is relatively easy to obtain, and nearly impossible to change. A brute force attack on this type of key is probably quite effective too.

Could something like multi-factor authentication exist for symmetrical encryption, such as requiring data from both a password and fingerprint?

Two-factor authentication relies on two things. One is something you know (the password), the other is something you have or something you are (in pratice, that means biometric data). In a sense, this would make a second part of the key.

Biometric data, due to the fact that it can't be changed, is a poor part of a key.

Something you have could work - the recipient of the encrypted message could be given a black box that contains part of the key. Or you could use a device that uses a challenge-response protocol.
The difficulty is that the recipient must be given this black box ahead of time. If the amount of data you want to communicate is limited, you might be better off giving them a one-time pad. But it is an option - I know of at least one bank that issues a device that, when presented with the bank pass and proper PIN code, allows the user to get in a challenge-response protocol to prove their identity for a transaction. A similar mechanism could be used for releasing part of a symmetric encryption key.
Whether or not that is efficient is an open question, as that part of the key itself would need to be communicated via a secure channel.

S.L. Barth
  • 5,486
  • 8
  • 38
  • 47