Search

Over the past decades a large range of security primitives has been developed to protect digital information. These primitives have solved many traditional security problems and achieved a high level of sophistication. Their security properties are well understood. An intrinsic property, vital for secure operation, is that they are extremely sensitive to small variations in their input. [ABSTRACT FROM AUTHOR]

In this chapter we discuss the hardware that was used to perform experiments on physical unclonable functions (PUFs).We describe the measurement setups and experimental samples in the case of coating PUFs and optical PUFs. These are two vastly different systems-the former based on integrated circuit (IC) technology and the latter on laser optics. [ABSTRACT FROM AUTHOR]

The cryptographic protocols that we use in everyday life rely on the secure storage of keys in consumer devices. Protecting these keys from invasive attackers, who open a device to steal its key, is a challenging problem. We propose controlled physical random functions1 (CPUFs) as an alternative to digital key storage, and we describe the core protocols that are needed to use CPUFs. [ABSTRACT FROM AUTHOR]

Counterfeiting of goods is becoming a very huge problem for our society. It not only has a global economic impact, but it also poses a serious threat to our global safety and health. Currently, global economic damage across all industries due to the counterfeiting of goods is estimated at over $600 billion annually [2]. In the United States, seizure of counterfeit goods has tripled in the last 5 years, and in Europe, over 100 million pirated and counterfeit goods were seized in 2004. Fake products cost businesses in the United Kingdom approximately $17 billion [2]. In India, 15% of fast-moving consumer goods and 38% of auto parts are counterfeit. Other industries in which many goods are being counterfeit are the toy industry, content and software, cosmetics, publishing, food and beverages, tobacco, apparel, sports goods, cards, and so forth. [ABSTRACT FROM AUTHOR]

Nowadays, people carry around devices (cell phones, PDAs, bank passes, etc.) that have a high value. That value is often contained in the data stored in it or lies in the services the device can grant access to (by using secret identification information stored in it). These devices often operate in hostile environments and their protection level is not adequate to deal with that situation. Bank passes and credit cards contain a magnetic stripe where identification information is stored. In the case of bank passes, a PIN is additionally required to withdraw money from an ATM (Automated Teller Machine). At various occasions, it has been shown that by placing a small coil in the reader, the magnetic information stored in the stripe can easily be copied and used to produce a cloned card. Together with eavesdropping the PIN (by listening to the keypad or recording it with a camera), an attacker can easily impersonate the legitimate owner of the bank pass by using the cloned card in combination with the eavesdropped PIN. [ABSTRACT FROM AUTHOR]

The aim of this chapter is to provide an information-theoretic framework for the analysis of physical unclonable function (PUF) security. We set up this framework and then apply it to optical PUFs and coating PUFs. From the description of PUFs in Chapter 1 some obvious questions arise in the context of the security primitives discussed in Part I. [ABSTRACT FROM AUTHOR]

In this chapter we discuss estimation of the secrecy rate of fuzzy sources- more specifically of optical physical unclonable functions (PUFs)-using context-tree weighting (CTW) methods [291]. We show that the entropy of a stationary 2-D source is a limit of a series of conditional entropies [6] and extend this result to the conditional entropy of one 2-D source given another one. Furthermore, we show that the general CTW-method approaches the source entropy also in the 2-D stationary case. Moreover, we generalize Maurer's result [196] to the ergodic case, thus showing that we get realistic estimates of the achievable secrecy rate. Finally, we use these results to estimate the secrecy rate of speckle patterns from optical PUFs. [ABSTRACT FROM AUTHOR]

The field of biometrics is concerned with recognizing individuals by means of unique physiological or behavioral characteristics. In practical systems, several biometric modalities are used, such as fingerprint, face, iris, hand geometry, and so forth. Recently, biometric systems are becoming increasingly popular because they potentially offer more secure solutions than other identification means such as PIN codes and security badges because a biometric is tightly linked to an individual. For the same reason, biometrics can prevent the use of several identities by a single individual. Finally, biometrics are also more convenient because, unlike passwords and PIN codes, they cannot be forgotten and are always at hand. In this chapter we describe how biometrics can be combined with cryptographic techniques described in Part I of this book in order to, for example, derive cryptographic keys from biometric measurements or to protect the privacy of information stored in biometric systems. [ABSTRACT FROM AUTHOR]

Traditional authentication schemes utilize tokens or depend on some secret knowledge possessed by the user for verifying his or her identity. Although these techniques are widely used, they have several limitations. Both tokenand knowledge-based approaches cannot differentiate between an authorized user and an impersonator having access to the tokens or passwords. Biometrics-based authentication schemes overcome these limitations while offering usability advantages in the area of password management. However, despite its obvious advantages, the use of biometrics raises several security and privacy concerns. [ABSTRACT FROM AUTHOR]

In this chapter we discuss authentication techniques involving data such as biometrics, which are assumed to be typical (essentially unique) for a particular person (or physical object). The data are captured by a sensor or measuring device, which is an imperfect process introducing some noise. Upon enrollment of a user, a sample of the noisy data is captured and stored as a template. Later, during authentication, another sample of the noisy data is captured and matched against the stored template. [ABSTRACT FROM AUTHOR]

We introduce a new type of Identity-Based Encryption (IBE) scheme that we call Fuzzy Identity-Based Encryption. In fuzzy IBE, we view an identity as a set of descriptive attributes. A fuzzy IBE scheme allows for a private key for an identity,ωù, to decrypt a ciphertext encrypted with an identity, ùω´, if and only if the identities ùω and ùω´are close to each other as measured by the "set overlap" distance metric. A fuzzy IBE scheme can be applied to enable encryption using biometric inputs as identities; the error-tolerance property of a fuzzy IBE scheme is precisely what allows for the use of biometric identities, which inherently will have some noise each time they are sampled. Additionally, we show that fuzzy IBE can be used for a type of application that we term "attribute-based encryption." [ABSTRACT FROM AUTHOR]

In this chapter, we will only look at the special case of secure function evaluation; that is, every party holds an input to a function, and the output should be computed in a way such that no party has to reveal unnecessary information about her input. [ABSTRACT FROM AUTHOR]

The use of biometric features as key material in security protocols has often been suggested to relieve their owner from the need to remember long cryptographic secrets. The appeal of biometric data as cryptographic secrets stems from their high apparent entropy, their availability to their owner, and their relative immunity to loss. In particular, they constitute a very effective basis for user authentication, especially when combined with complementary credentials such as a short memorized password or a physical token. However, the use of biometrics in cryptography does not come without problems. Some difficulties are technical, such as the lack of uniformity and the imperfect reproducibility of biometrics, but some challenges are more fundamental. [ABSTRACT FROM AUTHOR]

This chapter presents a general approach for handling secret biometric data in cryptographic applications. The generality manifests itself in two ways: We attempt to minimize the assumptions we make about the data and to present techniques that are broadly applicable wherever biometric inputs are used. [ABSTRACT FROM AUTHOR]