安全存储生物识别信息以进行比较
我正在使用带有 SDK 的生物识别指纹扫描仪，它允许我比较两个指纹图像。我的问题是，如果我想在本地存储其中一张图像以供以后比较，最安全的方法是什么？
我的想法是，当对密码执行相同的操作时，一种简单安全的方法是对原始密码进行哈希存储，然后比较哈希值而不是明文密码。显然，这对于指纹图像来说是不可能的，因为它们每次都会产生略有不同的结果。那么存储原始图像最安全的方式是什么？
提前致谢
I'm using a biometric fingerprint scanner with an SDK that allows me to compare two images of a fingerprint. My question is if I wanted to locally store one of the images for later comparison what is the safest way to do this?
My line of thinking is that when doing the same thing with passwords, an easy safe way would be to hash the original password for storage, and later compare hashes instead of plaintext passwords. Obviously this is impossible with the fingerprint images as they would produce slightly different results each time. So what is the safest way to store the original image?
Thanks in advance
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
生物识别技术依赖于模糊比较。为了实现这一点，您必须拥有原始图像。根据定义，哈希是一种单向操作，因此不适合。
为了安全地存储这些凭据，您应该使用对称密码。具有 CBC 模式和随机 IV 的 AES-256，以及 c加密随机数 作为密钥是非常好的选择。虽然 IV 在这个特定的实现中不太重要，因为 2 个相同的指纹是不可能的，因此 2 个相同的密文永远不会发生，但是我仍然会实现一个随机 IV。对称密码的实施可能会出现很多问题，并且有一些库可以处理它，例如 Jasypt，虽然我不知道你用的是什么平台。
如果攻击者能够检索用于比较的原始指纹，那么他将能够绕过该安全系统。例如，流言终结者能够使用此攻击破坏 2 个现成的指纹读取器。鉴于这种攻击，您可能需要考虑双因素身份验证。
Biometrics rely on a fuzzy comparison. In order for this to happen you must have the original image. A hash is by definition a one way operation, and thus is not suitable.
In order to safely store these credentials you should use a symmetric cipher. AES-256 with CBC mode and a randomized IV, and a cryptographic nonce as a key is a very good choice. Although IV is less important in this specific implementation because 2 identical fingerprints is impossible thus 2 identical cipher texts should never happen, however I would still implement a random IV. A lot can go wrong with a impmamentaiton of a symmetric cipher and there are libraires that take care of it such a Jasypt, although I don't know what platform you are using.
If an attacker is able to retrieve the original finger print used for comparisons then he will be able to bypass this security system. For instance The MythBusters where able to break 2 off the shelf fingerprint readers using this attack. In light of this attack you may want to consider Two-Factor Authentication.