# Post-Quantum Biometric Authentication Based on Homomorphic Encryption and Classic McEliece
## 2 Related Work
At the verification phase, \(f_{c}\big{(}b^{V},K^{c}\big{)}\) is computed using the \(random(K^{c})\) provided by the smart card and it is compared with the stored \(f_{c}\big{(}b^{R},K^{c}\big{)}\). If the matching score resulting from the comparison falls within the system threshold, then the user is authenticated. Otherwise, authentication fails. The proposal in [22] is equivalent since the \(random(K^{c})\) can be seen as the result of applying a key derivation function to a knowledge-based (\(K^{c}\) is related to a password) or a possession-based factor. In [23], the \(random(K^{c})\) can be seen as provided by a possession-based factor, in particular by a Physically Unclonable Function (PUF) in the user's device. These proposals increase the unlinkability and irreversibility of fuzzy commitments but remain vulnerable to FAR attacks. The proposal based on LPN (Learning Parity with Noise) commitments in [15] avoids the problems of fuzzy commitments. In this proposal, the accuracy of the unprotected system is preserved, providing irreversibility, revocability and unlinkability with a security level comparable to a cryptographic system, even with unimodal biometric systems. In this proposal, the privacy of the users is also preserved. In LPN commitments, the biometric data are encoded by using a random linear code, with some noise added to the codeword, \(f_{c}\big{(}b^{R},K^{c}\big{)}=K^{c}\oplus encode\big{(}b^{R}\big{)}\). The unknown noise, \(K^{c}\), should be a low-weight uniformly random vector. At the verification phase, the operation \(decode\big{(}f_{c}\big{(}b^{R},K^{c}\big{)}\oplus f_{c}\big{(}b^{V},K^{c} \big{)}\big{)}\) is performed. A decoding failure detects that \(K^{c}\) at enrollment and verification are not the same, avoiding FAR attacks. The disadvantage of LPN commitments is the slow execution of the decoding algorithm (4.44 and 50.13 s for a security of 128 and 256 bits, respectively, are reported in [15], although no optimization is applied). More recently, homomorphic encryption has been applied to biometric recognition [4; 5; 6; 7; 8; 9; 10; 13]. Several solutions are not resistant to attacks from quantum computers [4; 5]. Most of the quantum-resistant solutions are based on lattice cryptography [6; 7; 8; 9; 10]. Many of them employ a device-centric architecture, where the biometric features \(b^{R}\) and \(b^{V}\) are encrypted at the client site with the public key of the client \(pk^{C}\), resulting in \(E(b^{R},pk^{C})\) and \(E(b^{V},pk^{C})\), respectively. The comparison is performed by the server in the encrypted domain \(E(b^{R},pk^{C})\circ E(b^{V},pk^{C})\) by applying an evaluation operator \(\diamond\). According to the homomorphic properties, \(E(b^{R}\circ b^{V},pk^{C})=E(b^{R},pk^{C})\circ E(b^{V},pk^{C})\), where \(\circ\) is another or the same evaluation operator. From \(D\big{(}E(b^{R}\circ b^{V},pk^{C}),sk^{C}\big{)}\), \(b^{R}\circ b^{V}\) is decrypted at the client site by using the private key of the client, \(sk^{C}\). The server, which stores the encrypted templates and calculates the encrypted distance between protected data, cannot obtain information about biometric data because the private key to decrypt is in the client site [5; 6; 7]. However, as commented in the Introduction, we are interested in non-device-centric architectures, which are required by many applications. Other quantum-resistant solutions employ a non-device-centric architecture with two servers (authentication and computation servers) in addition to the database and the client [8; 9; 10]. The biometric features are encrypted at the client site with the public key of the authentication server. The computation server calculates the encrypted distance between protected data and sends the result to the authentication server. The computation server cannot obtain information about biometric data because the private key to decrypt is in the authentication site and the authentication server only decrypts the distance between the data.