<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><br></div><div><br>On 14 Jul 2013, at 20:00, <a href="mailto:fprint-request@lists.freedesktop.org">fprint-request@lists.freedesktop.org</a> wrote:<br><br></div><blockquote type="cite"><div><span>Send fprint mailing list submissions to</span><br><span> <a href="mailto:fprint@lists.freedesktop.org">fprint@lists.freedesktop.org</a></span><br><span></span><br><span>To subscribe or unsubscribe via the World Wide Web, visit</span><br><span> <a href="http://lists.freedesktop.org/mailman/listinfo/fprint">http://lists.freedesktop.org/mailman/listinfo/fprint</a></span><br><span>or, via email, send a message with subject or body 'help' to</span><br><span> <a href="mailto:fprint-request@lists.freedesktop.org">fprint-request@lists.freedesktop.org</a></span><br><span></span><br><span>You can reach the person managing the list at</span><br><span> <a href="mailto:fprint-owner@lists.freedesktop.org">fprint-owner@lists.freedesktop.org</a></span><br><span></span><br><span>When replying, please edit your Subject line so it is more specific</span><br><span>than "Re: Contents of fprint digest..."</span><br><span></span><br><span></span><br><span>Today's Topics:</span><br><span></span><br><span> 1. fingerprints as a crypto key? (Brian J. Murrell)</span><br><span> 2. Re: fingerprints as a crypto key? (Pavel Herrmann)</span><br><span></span><br><span></span><br><span>----------------------------------------------------------------------</span><br><span></span><br><span>Message: 1</span><br><span>Date: Sat, 13 Jul 2013 22:45:24 -0400</span><br><span>From: "Brian J. Murrell" <<a href="mailto:brian@interlinx.bc.ca">brian@interlinx.bc.ca</a>></span><br><span>To: <a href="mailto:fprint@lists.freedesktop.org">fprint@lists.freedesktop.org</a></span><br><span>Subject: [fprint] fingerprints as a crypto key?</span><br><span>Message-ID: <<a href="mailto:51E210C4.4020501@interlinx.bc.ca">51E210C4.4020501@interlinx.bc.ca</a>></span><br><span>Content-Type: text/plain; charset=ISO-8859-1; format=flowed</span><br><span></span><br><span>I opened bug 66881 about this but I wonder if discussion on the list is </span><br><span>more appropriate so here goes...</span><br><span></span><br><span>I wonder what the general consensus is about using fingerprints to </span><br><span>[un]lock a password store. Is there enough information in a fingerprint </span><br><span>to provide a decent level of cryptographic security?</span><br><span></span><br></div></blockquote><div><br></div><div><span style="font-family: '.HelveticaNeueUI'; font-size: 15px; line-height: 19px; white-space: nowrap; -webkit-tap-highlight-color: rgba(26, 26, 26, 0.296875); -webkit-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469); -webkit-text-size-adjust: none; "><a href="http://homepages.cs.ncl.ac.uk/feng.hao/files/biocrypt_TC.pdf">http://homepages.cs.ncl.ac.uk/feng.hao/files/biocrypt_TC.pdf</a></span></div><br><blockquote type="cite"><blockquote type="cite"><span></span></blockquote><blockquote type="cite"><span></span></blockquote><blockquote type="cite"><span></span></blockquote><blockquote type="cite"><span></span></blockquote><blockquote type="cite"><span></span></blockquote><blockquote type="cite"><span></span></blockquote><blockquote type="cite"><span></span></blockquote></blockquote><div>Some research in this area. Based on iris scanners but the principle is the same</div><div><br></div><div>Problems include false negatives locking you out</div><div>- we use fingerprint recognition for identifying patients in order to dispense controlled drugs to them daily but we need to relearn their prints every couple of months and use a stored photo of the patient as a second identifier for the dispenser</div><div><br></div><div>And </div><div>If you have your machine compromised and your fingerprint image hash stolen then how do you revoke that "key"</div><div><br></div><div>The paper above was written in conjunction with Professor Ross Anderson, author of "Security Engineering" and may be if interest to you</div><div><br></div><div>Mike</div></body></html>