ENTROPY OF FINGERPRINT SENSORS STEPHEN ELLIOTT, KEVIN O’CONOOR, ZACH MOORE, JEFF CHUDIK, TORREY HUTCHISON, AND NICK THOMPSON

Do different fingerprint sensors affect the bits of entropy of a fingerprint? RESEARCH QUESTION

Industry has been pushing for biometrics to replace passwords More convenient, but are biometrics still as secure as a traditional password? STATEMENT OF THE PROBLEM

INTRODUCTION

The purpose is to discover whether or not different fingerprint sensors will produce different results for the amount of bits of entropy across the same subjects on the right index finger in all trials STATEMENT OF PURPOSE

When relating entropy and passwords, the higher the entropy, the more secure the password needs to be for equivalency ENTROPY AND PASSWORDS

RANDOMLY SELECTED PASSWORDS

The logic of defining entropy of a user selected password is an estimate The first character is taken to be 4 bits of entropy The entropy of the next 7 characters are 2 bits per character The 9th through the 20th character is 1.5 bits per character For characters 21 and above entropy is 1 bit per character An additional 6 bits of entropy is added for the composition rule. The composition rule requires lower-case, upper-case, and non-alphabetic characters [3] USER SELECTED PASSWORDS 94 CHARACTERS

3 bits of entropy for the first character 2 bits of entropy for the next three characters 1 bit of entropy for the rest of the characters USER SELECTED PASSWORDS 10 CHARACTERS

METHODOLOGY

151 Subjects Each supplied their right index finger 6 times on 8 different sensors All sensors produced consistent image sizes within each sensor DATA COLLECTION

DatarunArea (Pixels)Pixel CountType x428128,400Thermal Swipe x480307,200Optical Touch x357117,810Optical Touch x30090,000Capacitive Touch x480153,600Optical Touch x29272,416Optical Touch x27050,220Capacitive Swipe x36092,160Capacitive Touch SENSOR IMAGE SIZES AND TYPE

VeriFinger SDK V.5 outputted the minutiae data including the x, y, θ, and type of minutiae point x and y are the location of the point in the image Theta is the angle of the minutiae point Theta is classified as either 1, 2, 3, or 4 depending on the angle Type is either ridge ending or bifurcation Ending = 1 Bifurcation = 2 MINUTIAE DATA

Angle 1: 0° - 89° Angle 2: 90° - 179° Angle 3: 180° - 269° Angle 4: 270° - 359° 14 32

Keyspace needs to be determined Based on two parameters Possible pixel locations, denoted by L, which is the surface area of the image (varied between sensors) Possible characteristics about a minutiae point, denoted by C, which is defined by type and angle as defined earlier ENTROPY CALCULATION

RESULTS

SAMPLES FROM EACH SENSOR The same subject across all 8 sensors

DatarunTypeAngle1Angle 2Angle3Angle 4EndBifA1endA1bifA2endA2bifA3endA3bifA4endA4bifAvg MinutiaeEntropy Entropy Per Minutiae 1761 Thermal Swipe Optical Touch Optical Touch Capacitive Touch Optical Touch Optical Touch Capacitive Swipe Capacitive Touch ENTROPY CALCULATIONS TABLE

ENTROPY AND PASSWORD LENGTH User ChosenRandomly Chosen 94 Char. Alphabet10 Char. Alphabet94 Char. Datarun Avg. Minutiae EntropyNo Checks Dict. & Composition Rule

The following graph shows the average quality scores at each minutiae count. AVERAGE QUALITY BY MINUTIAE COUNT

CONCLUSIONS

When analyzing the data there seemed to be some sensors that had low entropy but high minutiae This could have to do with the sensor type specifically or rather a function of other variables such as image quality and minutiae count CONCLUSIONS

Examine all variables that affect entropy to look for a confounding effect Examine joint entropy equation for flaws Examine cause of linear relationship for entropy and whether it should exist or be a bell curve FUTURE WORK