# Post-Quantum Biometric Authentication Based on Homomorphic Encryption and Classic McEliece
## 2 Related Work  
Traditionally, biometric protection schemes have been based on cancelable biometrics and biometric cryptosystems [13]. In cancelable biometrics, feature transformation techniques employ a transformation function \(f_{t}\) to modify the biometric features extracted at the enrollment phase \(b^{R}\) and at the verification phase \(b^{V}\). Therefore, transformed features \(f_{t}\big{(}b^{R}\big{)}\) and \(f_{t}\big{(}b^{V}\big{)}\), respectively, are compared in the transformed domain. Generally, transformed features contain less information than the original ones, which degrades the recognition performance compared to the unprotected scheme. In salting techniques, the recognition performance is increased due to the combination of the biometric information and a user-specific secret key. However, the secret key is usually stored in the user device so that the security does not increase in the stolen-device scenario. In biometric cryptosystems, secure sketches are employed as public data that allow for recovering enrolled biometric data by providing enough similar biometric data at verification. One of the most widely used secure sketches is the fuzzy commitment proposed in [19], which is based on error-correcting codes. In a fuzzy commitment, the public data \(f_{c}\big{(}b^{R},K^{c}\big{)}\) bind the biometric features \(b^{R}\) with a random secret \(K^{c}\). The random secret is encoded with the encoding function of the error-correcting code and the result is XORed with the biometric features \(b^{R}\), \(f_{c}\big{(}b^{R},K^{c}\big{)}=b^{R}\oplus encode(K^{c})\). The result is stored as a template at the enrollment phase. At the verification phase, the operation  
Figure 2: Overview of the proposal with the main contributions indicated. \(decode\big{(}f_{c}\big{(}b^{R},K^{c}\big{)}\oplus b^{V}\big{)}=decode\big{(}b^{R} \oplus encode(K^{c})\oplus b^{V}\big{)}\) is performed. If the differences between the enrollment and verification biometric features \((b^{R}\oplus b^{V})\) are small enough for the error-correcting code to recover the random secret \(K^{c}\), the authentication is successful. In the case of a non-device-centric architecture, if the authentication server recovers the random secret \(K^{c}\) from the public data, it is also able to recover the biometric data \(b^{R}\), which is a problem with honest-but-curious servers. The recognition performance of the biometric cryptosystems depends on the correction capability of the error-correcting codes. Consequently, it can be worse than the recognition performance of the unprotected system. Another problem of fuzzy commitments is to achieve unlinkability. Since any linear combination of codewords is also a codeword if using linear error-correcting codes, two fuzzy commitments derived from the same biometric features using different codewords can be linked. This is known as the decodability-based cross-matching attack [20] and limits the binding property. In addition, the low entropy in biometric characteristics (they are not quite random) limits the hiding property and, hence, irreversibility of the fuzzy commitments. Moreover, considering brute-force attacks, also known as FAR (False-Acceptance Rate) attacks when FAR is not 0, unimodal systems usually provide a security from 17 to 24 bits (for FAR values from \(10^{-5}\) to \(10^{-7}\)), which is very low compared to the security in a cryptographic system [21]. In the PQFC (Post-Quantum Fuzzy Commitment) scheme proposed in [14], a matrix \(A\) generated randomly and a vector \(K^{c}\) chosen randomly are multiplied. The resulting vector, \(random(K^{c})\), is added to the biometric data, \(f_{c}\big{(}b^{R},K^{c}\big{)}=b^{R}+random(K^{c})\), at the enrollment phase. The \(random(K^{c})\) is stored in a smart card for the user and \(f_{c}\big{(}b^{R},K^{c}\big{)}\) is stored in a database server.