Two-Factor Cancelable Biometric Key Binding via Euclidean Challenge–Response Pair Mechanism

Abstract

This work proposes a lightweight biometric key-binding scheme that adapts a PUF-style challenge–response mechanism to face geometry: a two-factor password and session nonce generate random challenge points, Gray-coded Euclidean distances to facial landmarks form responses, and a random key is bound by discarding selected positions so only a reduced subset, the nonce, and a key hash are stored. At authentication, a fresh response set is compared to the subset with a Hamming-distance tolerance, and bounded local search corrects residual errors; each successful session rotates the nonce and refreshes the ephemeral key. We frame this as a conceptual exploration of an interpretable, on-device, controlled-capture design niche—a per-session nonce-driven cancelable biometric key-binding mechanism—and we quantify the resulting security–usability trade-offs. Empirically, the scheme works under stable capture conditions with carefully tuned thresholds, and it is naturally suited to tightly controlled deployments (e.g., access kiosks) where it can also incorporate user-driven micro-gestures as an extra behavioral factor. While the construction is fragile under broader variability and leans on the second factor for security, it offers an alternative to existing mechanisms and a clear niche, and we present it as a conceptual exploration showing how CRP mechanisms can inform cancelable biometrics with per-session revocability.

1. Introduction

Biometrics offer the convenience of using the body as an identifier, but they come with an uncomfortable property: once compromised, they cannot be replaced. A fingerprint, an iris, or a face image that is leaked is lost forever as a secret. This permanence makes revocability one of the central challenges in biometric system design. Cancelable biometrics were introduced to answer that challenge by applying transformations that turn raw biometric data into renewable templates, such that a compromise can be addressed by issuing a new template instead of discarding the user’s biometric altogether.

In a different domain, PUFs have shown the power of CRPs as an interface for extracting secrets from noisy but differentiable systems. We connect those two ideas by presenting a biometric key-binding scheme that uses facial landmarks as the response mechanism in a PUF-style framework. A password and a session nonce generate random challenge points within a facial image frame, and the responses are defined as the Euclidean distances from these challenges to the detected landmarks. A random key is bound by discarding responses according to the key, and authentication reconstructs the key by comparing a fresh full set of responses against the stored subset. Each successful session generates a new nonce, thereby refreshing the challenges and re-enrolling the user with a new ephemeral key.

1.1. Research Question

Can a PUF-style challenge–response interface applied to facial landmark geometry support a two-factor key-binding protocol under tightly controlled capture conditions, and what security–usability trade-offs does such a design impose?

1.2. Contributions

• We propose a two-factor biometric key-binding construction that adapts a PUF-style challenge–response interface to facial landmark Euclidean geometry, using a password and session nonce to derive challenges and responses.
• We introduce an enrollment/key recovery flow that yields per-session template/key renewal without storing a long-lived similarity template, keeping only a reduced response subset, a nonce, and a key hash.
• We adapt an existing recovery procedure that reconstructs an ephemeral key from noisy responses, and we characterize its computational cost as a function of the uncertainty budget.
• We empirically map operating points induced by protocol parameters (window size/tolerance/uncertainty bounds) to key-recovery reliability and false-accept behavior under controlled capture.

2. Background

2.1. Cancelable Biometrics

The idea of cancelable biometrics arises in response to the awkward truth that you only get a couple of fingers, irises, and a single face, but you might need to revoke and reissue templates more than once in a lifetime. Early framing from the International Business Machines (IBM) group laid out the weak links in end-to-end biometric systems and sketched distort-then-match as a method to address them [1,2].

Faces and fingerprints were the initial focus for transformations, with key-based filtering for faces showing that you could convolve with a user-specific kernel, build a correlation filter, and still match while having something you could reissue if compromised [3], and with biotokens proposing to do matching in a protected space so that a lost template is just a token you can replace rather than your one and only face [4,5,6].

A large branch of the prior literature explores BioHashing and its variants, where you mix a biometric vector with a user token and project, quantize, and hash to obtain a compact and revocable representation; this mechanism was realized in Random Multispace Quantization [7,8]. The multispaces approach introduced diversity by applying different projections based on user-specific keys, while follow-ons tuned robustness and accuracy under less-than-clean conditions [9]. At the same time, the community also put a spotlight on the assumptions, thereby showing, for example, how reported near-perfect accuracy can collapse if the secret token or the specific transformation applied is not actually secret [10].

There is also a recurring theme in the existing body of work of using the protected template as a stepping stone toward a cryptographic key or an anonymous identifier rather than a match-score endpoint. Examples include key generation from noninvertible minutiae transforms, anonymous verification protocols for documents, and e-passport-flavored deployments that keep the template revocable [6,11,12].

Alongside construction papers, the state of the art built a much more thorough security understanding with models, attacks, and evaluation criteria: surveys and analyses catalog what “noninvertibility”, “diversity”, and “unlinkability” should mean and how to test them, and they document inversion, cross-matching, and record multiplicity threats that appear when multiple transformed records of the same user leak across systems [13,14,15,16,17].

Attack-centric works have kept us honest about risks such as pre-image attacks in known-algorithm settings, while theory publications pushed toward provable or even information-theoretic guarantees for noninvertible transforms that still support correlation-style matching, thereby expanding the space of what “matching in a protected space” can look like [18,19,20]. Taken together, recent and ongoing efforts in the field continue to reinforce the same core principle: if a template leaks, then you should not have to worry about the thief stealing your biometric identity, and you should be able to roll a new template without changing the person underneath [21,22,23].

2.2. PUFs and CRPs

PUFs popularized an interface where you do not store a secret so much as you query a noisy but consistent physical system, and read out a response indexed by a challenge [24]. While our setting is biometric rather than silicon, the interface (lots of CRPs, each repeatable with some mild noise) maps well onto a protocol of (1) presenting user plus auxiliary secret; (2) posing a challenge; and (3) harvesting a response, with some additional mechanisms layered on top to cope with the inevitable variation. In spirit, this is close to how biometric cryptosystems and cancelable transforms view the world, specifically that you transform or bind to something you can reissue and you handle noise with helper data, projection, quantization, sparse reconstruction, and/or error correction [14].

In our construction, the “challenge” is a location in the image frame derived from a second-factor password plus a nonce, and the “response” is the vector of quantized Euclidean distances from the challenge to a fixed set of landmarks, so the CRP analogy is literal at the API level even if the physics underneath is a human face rather than delay lines or Static Random Access Memory (SRAM) cells, which puts us in familiar territory with respect to design: you want lots of distinct challenges, you want responses to carry discriminative power while being tolerably noisy, and you want a revocation mechanism to change the challenge space without touching the underlying anatomy, themes consistent with cancelable templates, key-binding, and privacy-aware deployments [7,8,9,15,17,18,25,26,27,28,29,30,31,32].

Because biometrics are not unclonable functions in the strict hardware sense and because the adversary may know a lot about the transformation, security expectations must be stated modestly. In this proposed construction, the biometric itself is not an entropy source, but rather a noisy but reproducible authentication factor required to be present in order to reconstruct the key, while the second-factor password or token bears the burden of security. The point is not to claim that CRP-style indexing magically solves biometric privacy, but rather to suggest that it may offer a clean method to separate revocable indexing (the challenge set) from the variability of the response, and then to lean on an existing subset/key binding and recovery toolbox developed by Cambou and Ghanai et al. for diversity, revocability, and noise management [13,14,16,17,33,34] to design novel constructions worthy of study.

2.3. Positioning and Related Work

Our construction is best viewed as a biometric cryptosystem in the key-binding setting, with an explicit renewability mechanism: the stored binding record is revoked and refreshed on each successful authentication by regenerating the nonce-derived challenge set and re-binding a newly generated key. This differs from work that focuses primarily on improving unconstrained biometric recognition accuracy; here, operating points arise from protocol parameters that trade off key-recovery reliability, false accepts, and bounded ternary recovery cost.

Prior work mostly falls into three overlapping categories. First, biometric cryptosystems and key-binding mechanisms such as fuzzy commitment/helper-data constructions bind a cryptographic key to a noisy biometric and recover it within tolerance [14,35,36]. Second, cancelable biometrics and template-protection methods emphasize non-invertible, renewable transforms to support the revocation and re-issuance of protected templates, a requirement formalized in standards like ISO/IEC 24745 [37]. Third, some systems explicitly combine these ideas and describe cancelable key binding (e.g., via cancelable transforms plus key binding) [38,39], which is the category that best fits the construction proposed herein. Some recent prominent work in these categories is briefly summarized in Table 1.

Table 1. Positioning this work against some existing biometric-crypto mechanisms.

Mechanism	Primitive	What It Uses	Typical Renewal/ Re-Issuance
Fuzzy commitment [40]	Key binding	Biometric	Recommit/reissue helper data
Fuzzy vault [41,42]	Key binding	Biometric	Re-enroll; regenerate vault
Fuzzy extractors [43]	Key generation/ key derivation	Biometric	Rerun Gen to reissue $(R,P)$
Cancelable biometric transforms [1]	Template protection	Biometric + transform parameter	Change transform/ parameters
Cancelable iris key binding [38]	Cancelable key binding	Biometric + transform parameter	Change transform/ parameters
This work	Two-factor CRP-based key binding	Biometric + user-held password/token	Per-authentication key/template refresh

Note: Many constructions optionally add a user secret for hardening; the “What it uses” column lists the base mechanism. Our construction explicitly requires a user secret.

3. Proposed Construction

3.1. System Overview

The system has two stages, enrollment and key recovery, and both rely on a common sequence of operations that take a two-factor password together with a fresh session nonce and a facial frame; it turns them into a response, which is a structured set of bitstrings (Figure 1). The shared steps are as follows:

Figure 1. A face capture is aligned, landmarked, and challenged to produce a complete geometric response set.

• Gather inputs. Collect the auxiliary password P, generate a random session nonce $\nu$, and capture a frame or set of frames $F={\left\{I^{\left(t\right)}\right\}}_{t=1}^q$ of the user’s face (each $I^{\left(t\right)}$ is a $256\times 256$ grayscale image in our implementation).

  $$(P,\nu ,F)⟶\mathrm{pipeline}\mathrm{inputs}.$$
• Challenge generation. Derive N integer pixel challenges in the frame using a PRF $\varphi$ keyed by $(P,\nu )$; each challenge is a coordinate $c_i=(x_i,y_i)$ in a $256\times 256$ grid.

  $$C={\left\{c_i\right\}}_{i=1}^N,c_i=\left({\varphi }_x(i;P,\nu ),{\varphi }_y(i;P,\nu )\right),x_i,y_i\in \{0,\dots ,255\}.$$
• Landmarking. Run a landmark predictor $\mathrm{\Lambda }$ (e.g., Ref. [44]) on F to obtain k facial landmarks in frame coordinates and write the (unshuffled) shape as $S={\left\{{\ell }_j\right\}}_{j=1}^k$ with ${\ell }_j=(u_j,v_j)$.

  $$S=\mathrm{\Lambda }\left(F\right)={\left\{(u_j,v_j)\right\}}_{j=1}^k,u_j,v_j\in \{0,\dots ,255\}.$$
• Landmark shuffle. Use a PRF seeded by $(P,\nu )$ to produce a permutation $\pi$ of $\{1,\dots ,k\}$ and reorder landmarks accordingly (the protocol always operates on the shuffled order).

  $$\pi ={\pi }_{P,\nu }\in S_k,S^{\pi }=\left({\ell }_{\pi \left(1\right)},\dots ,{\ell }_{\pi \left(k\right)}\right).$$
• Compute raw responses. For each challenge $c_i$ and shuffled landmark ${\ell }_{\pi \left(j\right)}$, compute Euclidean distances and assemble the k-response list ${\mathbf{d}}_i$.

  $$d_{i,j}=\parallel c_i-{\ell }_{\pi \left(j\right)}{\parallel }_2=\sqrt{{(x_i-u_{\pi \left(j\right)})}^2+{(y_i-v_{\pi \left(j\right)})}^2},{\mathbf{d}}_i=(d_{i,1},\dots ,d_{i,k})\in {\mathbb{R}}_{+}^k.$$
• Response scaling. Map each distance to $\{0,\dots ,2^l-1\}$ using a fixed, monotone, clipping normalization function $\sigma$.

  $${\tilde{d}}_{i,j}=\sigma \left(d_{i,j};\theta \right)\in \{0,\dots ,2^l-1\},{\tilde{\mathbf{d}}}_i=({\tilde{d}}_{i,1},\dots ,{\tilde{d}}_{i,k}),$$

  where $\theta$ denotes the scaling parameters $\{d_{min}$, $d_{max}\}$ computed from $(C,S^{\pi })$ for the session.
• Gray coding. Convert each ${\tilde{d}}_{i,j}$ to its l-bit Gray code segment ${\mathbf{g}}_{i,j}\in {\{0,1\}}^l$ via $g\left(x\right)=x\oplus (x\gg 1)$.

  $${\mathbf{g}}_{i,j}=g\left({\tilde{d}}_{i,j}\right)\in {\{0,1\}}^l,{\mathbf{G}}_i=\left({\mathbf{g}}_{i,1},\dots ,{\mathbf{g}}_{i,k}\right).$$
• Forming response block set R. Concatenate the k Gray-coded segments to obtain a block $r_i\in {\{0,1\}}^m$ of length $m=l·k$, and collect all N blocks as the response set.

  $$r_i={\mathbf{g}}_{i,1}\parallel {\mathbf{g}}_{i,2}\parallel \cdots \parallel {\mathbf{g}}_{i,k}\in {\{0,1\}}^m,R=\{r_1,\dots ,r_N\}.$$

The two core ideas underlying the enrollment phase (binding by partitioning the response positions based on an ephemeral key) and the recovery phase (reconstructing the key with a guided, ternary recovery algorithm plus bounded local search) follow recent formulations by Ghanai et al. and Cambou et al. in distributed key reconstruction and subset-driven matching; we adopt those patterns here for a new application in a biometric setting while keeping a design that is comparable to prior analyses [33,34].

3.2. Enrollment

Enrollment begins by running the shared sequence with $(P,\nu ,F)$ to produce the full response set R. A random N-bit key is then generated from a custom Key Derivation Function (KDF), which before binding imposes a constraint parameter $\omega$ that limits the maximum run length of consecutive zeros. If the initial random key contains a run longer than $0^{\omega }$, the KDF randomly flips one or more bits within that run to break it. This ensures that the recovery algorithm always knows an upper bound on the size of any consecutive zero segment, which provides an initial window size for aligning responses during key recovery.

Once the key satisfies the $\omega$ constraint, then binding is performed by discarding all responses in positions where the key bits are set, leaving a subset of R (Figure 2). This subset, together with the current nonce, is stored as the user’s template. The key itself is used to encrypt the user’s data and is then discarded. As a correctness oracle for later verification, the system also stores a hash of the key alongside the subset and nonce. As a result, the stored record cannot by itself decrypt the data, and the key cannot be reconstructed without the auxiliary password, the correct nonce, and a matching biometric; the user’s face geometry cannot be easily recovered from the enrollment data alone.

Figure 2. The set bits in the ephemeral key produce a subset of responses from R, which we use later to recover the key.

3.3. Key Recovery

At authentication time, the user again supplies their password and face, and the system uses the stored nonce to regenerate a fresh full set of responses; this new set is compared against the stored subset by the recovery matching algorithm (Algorithm 1, Figure 3), which reconstructs the key position by position, assigning 0 or 1 when a comparison is confident and $-1$ when it is not. Comparisons are made using a normalized Hamming distance on response blocks: for blocks $x,y\in {\{0,1\}}^m$ with $m=l·k$, define ${\delta }_H(x,y)\triangleq d_H(x,y)/m$, and declare a match when ${\delta }_H(x,y)\le T$, where $T\in [0,1]$ is the tolerance (e.g., $T=0.10$ treats ≤ $10\%$ bit differences as a match), with the initial output therefore a ternary vector $\widehat{K}\in {\{-1,0,1\}}^N$, whose $-1$ entries mark unresolved bits.

Figure 3. The recovery algorithm attempts to reconstruct the ephemeral key from the enrollment subset.

The use of the $\omega$-constraint during enrollment ensures that the recovery algorithm has a predictable bound on the maximum run length of zeros, which ensures a fixed search window when aligning responses and reduces the number of positions that may remain uncertain in the first place by limiting how far the alignment can drift before a mismatch must be declared under the same ${\delta }_H\le T$ rule.

The subsequent error correction step is then targeted: rather than brute-forcing over all nearby bitstrings, the search explores only the subset of possible true keys defined by the uncertain ($-1$) positions, flipping them all exhaustively between 0 and 1; the search is bounded by a maximum number of corrections, which acts as the radius of exploration, and each candidate binary key $K^{\prime }$ is checked against the stored hash H (the correctness oracle), after which a passing $K^{\prime }$ is accepted and used to decrypt the protected user data. No candidate within the bound leads to failure, and a successful session triggers a new nonce and a fresh re-enrollment with a new ephemeral key.

3.4. Formal Specification

Let P denote the auxiliary password and F a captured facial frame. For each session, we also generate a random nonce $\nu$. The pair $(P,\nu )$ is used to derive a set of N challenges $C=\{c_1,\dots ,c_N\}$, where each challenge $c_i=(x_i,y_i)$ is an integer coordinate with $x_i,y_i\in \{0,\dots ,255\}$. We also extract a shuffled set of $k=68$ facial landmarks $S=\{{\ell }_1,\dots ,{\ell }_{68}\}$, with each landmark ${\ell }_j=(u_j,v_j)$ an integer coordinate in the same $256\times 256$ frame.

For each challenge $c_i$ and landmark ${\ell }_j$, we define the raw response distance

$$d_{i,j}=\sqrt{{(x_i-u_j)}^2+{(y_i-v_j)}^2}.$$

Each $d_{i,j}$ is normalized to an l-bit integer ${\tilde{d}}_{i,j}\in \{0,\dots ,2^l-1\}$ and then Gray-coded into a bitstring $g_{i,j}\in {\{0,1\}}^l$. For challenge $c_i$, we concatenate across all landmarks to obtain a response block

$$r_i=g_{i,1}\parallel g_{i,2}\parallel \cdots \parallel g_{i,k}.$$

The full response set is

$$R=\{r_1,r_2,\dots ,r_N\}.$$

During enrollment, we sample a random key $K\in {\{0,1\}}^N$ subject to the constraint that no run of more than $\omega$ consecutive zeros appears in K. If a generated key violates this constraint, runs longer than $0^{\omega }$ are broken by randomly flipping one or more bits inside them. Binding is then performed by discarding each block $r_i$ whenever $K_i=1$, producing a stored subset

$$f=\{r_i:K_i=0\}.$$

We then compute $H=h\left(K\right)$ using a cryptographic hash $h(·)$, and the enrollment record for this session is $(f,H,\nu )$. The key K is used once to encrypt user data M, producing ciphertext $C={\mathrm{Enc}}_K\left(M\right)$, and then discarded.

At authentication, the same procedure generates a fresh full response set $R^{\prime }=\{r_1^{\prime },\dots ,r_N^{\prime }\}$; the recovery algorithm compares $R^{\prime }$ with the stored subset f to build a candidate key $\widehat{K}\in {\{-1,0,1\}}^N$, where values 0 and 1 are confident assignments and $-1$ marks “uncertain” positions that could not be decided. We let $m=l·k$ be the block length in bits and define ${\delta }_H(x,y)\triangleq d_H(x,y)/m$, and say that blocks x and y match if ${\delta }_H(x,y)\le T$, with $T\in [0,1]$ a fixed tolerance. The algorithm aligns $R^{\prime }$ to f using an $\omega$-bounded window and applies this ${\delta }_H\le T$ rule to assign bits (unique matches yield $\{0,1\}$, ambiguous or failed matches yield $-1$), after which error correction explores substitutions only at the $-1$ positions and only up to a maximum number of corrections (the search radius), verifying each candidate binary key $K^{\prime }$ via $h\left(K^{\prime }\right)=H$, accepting on success or otherwise failing if no candidate within the radius passes, and upon success generating a new nonce ${\nu }^{\prime }$ and restarting with a fresh enrollment based on $R^{\prime }$. An average modern computer can easily correct a radius of about $10\%$ of a 256-bit key, or about 25 ternary positions, before correction cost starts to become prohibitive.

3.5. Security Implications

This construction is two-factor in the strict sense that successful key recovery requires both (i) the second factor (password or token-derived secret that determines challenges and recovery context) and (ii) a biometric presentation that yields responses within the protocol’s tolerance setting. The biometric factor is not intended to contribute entropy to the session key. Instead, it provides the noisy but reproducible signal needed for key recovery to succeed.

We discuss security implications under the four unique cases of compromise. Throughout, the protocol’s “accept” decision is always a binary outcome: authentication succeeds if and only if the session key is recovered and matches the stored key hash. If the recovery process fails to recover the correct key, authentication fails. There is no “confidence” threshold to set, as we would expect in a traditional classifier; either the exact correct key is recovered or it is not. In all cases below, we assume the attacker can read the currently valid stored enrollment record (the unlabeled response subset, the nonce, and the key hash), and we distinguish whether the attacker also possesses the second factor and/or can present a biometric sample that matches within tolerance.

3.5.1. Case A: Biometric Data Compromised, Second Factor Remains Secret

If an adversary obtains biometric information about a user, but does not obtain the second factor, the adversary cannot derive the correct challenges needed to reproduce the responses corresponding to the enrolled response subset and recover the session key. In this case, biometric leakage alone is insufficient for offline reconstruction because the missing second factor prevents the adversary from even formulating the correct reconstruction attempt. This case captures the intended separation of roles: the biometric constrains reconstruction, while the second factor supplies the secrecy that gates access to the reconstruction procedure.

3.5.2. Case B: Second Factor Compromised, Biometric Remains Secret

If an adversary obtains the second factor but cannot present a biometric sample that yields responses within tolerance, then the adversary can compute the challenge material and can attempt offline key recovery against stored records. The security that remains in this case is governed by the false-accept behavior at the chosen operating point. The adversary succeeds only when a non-matching biometric presentation, or an attempted surrogate, nonetheless causes the recovery procedure to output a key whose hash matches the stored value. This is a stolen-token setting: the relevant limitation is that record multiplicity and repeated trials increase the adversary’s cumulative success probability, so we must treat the measured FAR as the effective risk metric under compromise of the second factor. If the attacker in this case can mount t independent offline attempts against the currently valid record during its lifetime, then the cumulative success probability is $P_{\mathrm{succ}}\left(t\right)=1-{(1-\mathrm{FAR})}^t$.

3.5.3. Case C: Both Biometric and Second Factor Compromised

If an adversary obtains both the second factor and a biometric sufficient to generate responses within tolerance, then the adversary can recover session keys and impersonate the user. In this case, the scheme provides no meaningful cryptographic protection. Mitigation is still possible via the revocation mechanism: the system can restore security by revoking and re-issuing the second factor and re-enrolling with a fresh biometric under a new nonce, subject to the constraints discussed above on record multiplicity and offline checking.

3.5.4. Case D: No Compromise

If neither factor is compromised, an attacker lacks both the second factor and a biometric presentation that yields responses within tolerance, so they cannot carry out a meaningful offline key-recovery attempt. Without the second factor, the attacker cannot reproduce the correct challenge set and recovery context, and, without a matching biometric, they cannot produce responses close enough to the enrolled responses for key recovery to succeed. In this baseline setting, the relevant security question is online impersonation risk under normal, reasonable rate-limiting assumptions and physical security conditions.

These cases clarify the intended interpretation of our empirical results. Under second-factor compromise, security reduces to the false-accept characteristics of the key recovery process given by the chosen protocol parameters (mostly the matching threshold). Under biometric compromise alone, security depends on the secrecy of the second factor and the resulting inability to make correct response reconstruction attempts. Under compromise of both, only revocation and re-issuance can restore security. Under compromise of neither, an adversary lacks both the correct second factor needed to instantiate the enrollment-specific challenges and a biometric sample that matches the enrolled user closely enough to permit key recovery, so they cannot mount a meaningful offline key-recovery attempt in our model and the probability of successful attack is negligible.

3.5.5. Record Lifetime and Refresh Policy

The stored hash of the session key functions as a correctness oracle for offline key-recovery attacks: an attacker who can run the key-recovery procedure can immediately test whether a candidate recovery output is correct by hashing it and comparing. This does not reveal the key itself, but it does mean that key recovery is a verifiable offline decision problem. Accordingly, the attacker’s practical success probability for an offline key-recovery attack with a stolen enrollment is governed by the false-accept behavior of the recovery procedure at the chosen operating point and by the number of independent attempts they can mount before the enrollment they stole is invalidated by a legitimate authentication.

The intended deployment maintains a single active enrollment record per user. Upon successful authentication, the protocol cancels the prior enrollment and immediately creates a fresh one by generating a new nonce (hence new challenges) and a new session key, using the just-captured biometric sample as the basis for the refreshed response set and subset and binding the new session key thereto. This gives the mechanism epoch isolation with respect to the bound session key: an enrollment stolen in one epoch does not remain usable for recovering the current session.

3.5.6. Multi-Epoch Compromise and Biometric Accumulation Risk

The refresh policy limits the lifetime of any one enrollment record and its associated session key, but it does not eliminate the possibility of biometric accumulation if an attacker can exfiltrate enrollment records across many epochs. In that setting, the security question is no longer only whether the session key remains unrecoverable, but whether the repeated exposure of randomized challenge–response information can progressively constrain (and ultimately reveal) the underlying landmark geometry.

Recall that an epoch is defined by the pair $(P,\nu )$: the second factor P together with the nonce $\nu$ deterministically generates (i) the full set of N challenge points $C={\left\{c_i\right\}}_{i=1}^N$ and (ii) the landmark shuffle permutation used to order the k landmarks within each response block. From a captured face frame, the protocol produces the full response set $R={\left\{r_i\right\}}_{i=1}^N$, where each block $r_i\in {\{0,1\}}^m$ is a Gray-coded, quantized encoding of the distance vector from challenge point $c_i$ to all shuffled landmarks (i.e., $r_i$ is a compact representation of $(\parallel c_i-{\ell }_{\pi \left(1\right)}\parallel ,\dots ,\parallel c_i-{\ell }_{\pi \left(k\right)}\parallel )$ after scaling and Gray coding). Enrollment then binds a random N-bit key by subsetting: blocks at positions corresponding to unset key bits are discarded, and the stored template consists of the remaining subset $f\subseteq R$ together with the nonce $\nu$ and a hash of the key.

If an attacker steals records from E epochs, they obtain $({\nu }^{\left(e\right)},f^{\left(e\right)},H^{\left(e\right)})$ for $e=1,\dots ,E$. The biometric accumulation question depends critically on whether the attacker also learns the second factor P:

• Case A: Records Only (no P)

Without P, the attacker cannot regenerate the corresponding challenge coordinates $C^{\left(e\right)}$ or the shuffle ${\pi }^{\left(e\right)}$, so the observed blocks $f^{\left(e\right)}$ are not readily interpretable. In this case, direct geometric reconstruction from $f^{\left(e\right)}$ is substantially impeded because the attacker lacks the coordinate system (the challenges) in which the distances were measured.

• Case B: Records Plus P

If the attacker obtains P (and thus can regenerate $C^{\left(e\right)}$ and ${\pi }^{\left(e\right)}$ for each stolen epoch), then each retained block $r_i\in f^{\left(e\right)}$ becomes a set of quantized distances anchored at a known challenge point $c_i^{\left(e\right)}$ with a known landmark ordering. In this setting, the subset operation does not prevent leakage; it only reduces the number of anchored distances revealed per epoch. Over many epochs, the attacker can aggregate distances from many independent challenge points. Since the stored subset reveals only a fraction of the N blocks each epoch (roughly half for an unbiased key, subject to the $\omega$-constraint), the attacker’s per-epoch geometric information is reduced, but across E epochs the total number of anchored blocks grows approximately as $E·\left|f\right|$. In principle, with sufficiently many anchored distance observations, the landmark geometry can be increasingly revealed (up to the quantization taken by the distance encoding and the operating tolerance), yielding an accumulation risk that is distinct from session-key compromise.

A simple way to view this risk is in terms of how many anchored challenge blocks leak over time. We let N denote the total number of challenge blocks per epoch, and let $s=\left|f\right|$ denote the number of blocks retained in an epoch after subsetting by the key (typically $s\approx N/2$). If an attacker compromises E epochs and (in the worst case) also knows the corresponding second-factor secrets so that the challenge coordinates are known, then the attacker obtains approximately $E·s$ anchored distance blocks in total. If the retained blocks behave approximately like a uniform random subset of size s in each epoch, then repeats occur and the number of distinct anchored blocks observed grows with E, starting near s for small E and approaching N as E becomes large. After observing E epochs, the expected distinct fraction of blocks seen is about

$$1-{\left(1-{\displaystyle \frac{s}{N}}\right)}^E,$$

so the attacker’s geometric information increases steadily with the number of compromised epochs, even though each individual epoch reveals only a fraction of the blocks.

For this reason, we consider multi-epoch compromise a biometric privacy risk distinct from session key compromise. The refreshment policy bounds the window for attacking any single record for key recovery, but it does not substitute for template confidentiality if an attacker can repeatedly steal records over time.

3.5.7. Effect of the Runs Constraint on Key Entropy

The key generation procedure restricts valid N-bit keys to those that never contain more than $\omega$ consecutive zeros. In effect, long uninterrupted runs of zeros are disallowed, giving the recovery algorithm a default window size within which one matching block ought to be. This constraint creates a structured subset of all possible N-bit strings, and the size of this subset affects how much entropy the ephemeral key retains.

To understand how many valid keys exist under this rule, we want to count them. We can define $A_N^{\left(\omega \right)}$ as the number of N-bit strings that satisfy the constraint (i.e., no substrings of $0^{\omega +1}$). The basic observation is that we can build larger valid strings from smaller ones: any valid n-bit string ending in 0, 00, 000, and so on up to $0^{\omega }$ can be extended by either appending a 1 or by appending another 0 (as long as we have not already used $\omega$ zeros in a row). This leads to the Fibonacci-like recurrence

$$A_N^{\left(\omega \right)}=A_{N-1}^{\left(\omega \right)}+A_{N-2}^{\left(\omega \right)}+\cdots +A_{N-\omega -1}^{\left(\omega \right)}.$$

Each term corresponds to choosing how long the final run of zeros is (from 0 zeros up to $\omega$ zeros) before a 1 appears. The initial conditions are

$$A_0^{\left(\omega \right)}=1,A_N^{\left(\omega \right)}=2^N\mathrm{for}1\le N\le \omega ,$$

where $A_0^{\left(\omega \right)}=1$ counts the trivial case, which says that the empty string ($N=0$) does not violate the runs constraint, and is therefore superficially valid, while $A_N^{\left(\omega \right)}=2^N\mathrm{for}1\le N\le \omega$ accounts for the fact that, for string lengths up to $\omega$, the run-length constraint never comes into play because the strings are too short to violate it, so all $2^N$ binary strings are allowed.

So, the complete definition expressing the number of valid N-bit keys for a given $\omega$ is

$$A_N^{\left(\omega \right)}=\left\{\begin{array}{cc}1,\hfill & N=0,\hfill \\ 2^N,\hfill & 1\le N\le \omega ,\hfill \\ A_{N-1}^{\left(\omega \right)}+A_{N-2}^{\left(\omega \right)}+\cdots +A_{N-\omega -1}^{\left(\omega \right)}\hfill & N>\omega .\hfill \end{array}\right.$$

and the total number of valid keys of length N is

$$|{\mathcal{K}}_N^{\left(\omega \right)}|=A_N^{\left(\omega \right)}$$

and the effective entropy of this constrained keyspace is therefore

$$H_{\mathrm{const}}(N,\omega )={log}_2\left|{\mathcal{K}}_N^{\left(\omega \right)}\right|.$$

This quantity answers the question, “How many bits of unpredictability do the bound keys have, once the structural rule is taken into account?” [45]. Evaluating this recurrence with a computer, e.g., for $N=256$ and a fairly restrictive $\omega =5$, gives

$$H_{\mathrm{const}}(256,5)={log}_2\left|{\mathcal{K}}_{256}^{\left(5\right)}\right|=253.0054,$$

indicating that eliminating all 256-bit keys containing runs longer than $0^5$ costs about 2 bits of entropy for the valid keys that remain.

In summary, even though the $\omega$-run rule restricts which binary strings are allowed to be used as cryptographic material in this construction, the number of valid keys is still enormous, and key entropy loss due to the constraint is therefore negligible. This suggests that the keys used by the system retain nearly all of their unpredictability while satisfying the structural property needed for the binding mechanism to be most effective.

4. Materials and Methods

We implemented a unified testing system to make sure that all experiments follow a consistent evaluation protocol (Figure 4). The test runner standardizes dataset access through a generalized interface, applies a fixed configuration, and generates genuine and impostor test cases for enrollment and recovery. It records configurations, outcomes, and other metrics for each trial and aggregates the data for external analysis.

Figure 4. The testing system unifies binding mechanisms with biometric datasets, and applies a set of configuration parameters to generate test cases and log performance data.

To evaluate the fundamental capability of the construction for recovering keys from facial geometric enrollments, we ran a multi-parameter configuration sweep over three protocol parameters: the key-recovery matching threshold T, the max-run parameter $\omega$ (reported as w), and the uncertainty bound $u_{max}$ that gates uncertainty correction. This sweep was chosen to reveal a clear performance envelope for recovery accuracy rates and enrollment and recovery latencies, as well as the computational cost impact of bounded uncertainty correction.

We report results on two datasets. First, we use a proprietary Artificial Intelligence (AI)-generated facial dataset designed to minimize inter-frame variation, which provides a controlled environment for characterizing the mechanism in the absence of excessive confounding biometric noise. Second, we evaluate on the Faces94 dataset [46,47,48], which we selected because it provides comparatively stable frontal face captures and thus aligns most closely with our intended deployment regime of tightly controlled acquisition. While these datasets do not constitute an unconstrained stress test, they support a clearer attribution of effects to specific design choices while still exposing performance limits under real-image capture.

In real-world deployments, higher capture variability due to pose, expression, lighting, and blur—factors that affect both the geometric measurement process and landmarking accuracy—usually necessitates higher matching thresholds T to maintain usability. This, in turn, will raise the average uncertainty $\overline{u}$ for genuine users and may eventually increase False-Accept Rate (FAR) for impostors. The operating points reported in Section 5.1 should therefore be interpreted as optimistic for well-aligned, low-noise capture conditions, with Faces94 providing a more realistic reference for controlled real-image acquisition.

4.1. Configurations/Operating Points

We evaluate the mechanism with sweeps across the three main protocol parameters: tolerance T, the max-run parameter $\omega$, and an uncertainty cutoff $u_{max}$ that bounds the ternary correction step. For each configuration $(T,\omega ,u_{max})$, we measure key-recovery outcomes over genuine trials (enrolled subject equals recovery subject) and impostor trials (different subjects), treating authentication as a binary decision: success if and only if a binary session key is recovered and its hash matches the stored hash of the true key.

4.1.1. Correction Attempt Gating

Uncertainty correction is attempted only when the internal uncertainty score u satisfies $u\le u_{max}$. Otherwisel, the protocol fails immediately. Because this gating can affect observed error rates, we report ternary correction attempt rates separately for genuine and impostor trials:

$${\alpha }_{\mathrm{g}}=Pr[u\le u_{max}\mid \mathrm{genuine}],{\alpha }_{\mathrm{i}}=Pr[u\le u_{max}\mid \mathrm{impostor}].$$

We also report the mean uncertainty $\overline{u}$ for genuine and impostor trials at each operating point.

When $u=0$, recovery reduces to an oracle check of the candidate key from the initial recovery step, and no ternary correction is invoked. More generally, even when $u\le u_{max}$, ternary correction is invoked only if the candidate key from the initial recovery step has $u\ne 0$.

4.1.2. Error Rates and Timing Metrics

We define $\mathrm{FAR}=Pr[\mathrm{accept}\mid \mathrm{impostor}]$, $\mathrm{FRR}=Pr[\mathrm{reject}\mid \mathrm{genuine}]$, $\mathrm{TAR}=1-\mathrm{FRR}$, and $\mathrm{TRR}=1-\mathrm{FAR}$. We report mean enrollment time ${\overline{\tau }}_{\mathrm{enr}}$. We also report mean initial ternary recovery time ${\overline{\tau }}_{\mathrm{rec}}$ and mean correction time ${\overline{\tau }}_{\mathrm{corr}}$, where ${\overline{\tau }}_{\mathrm{corr}}$ is the time spent in the bounded ternary correction step (zero when correction is not invoked). Total key-recovery latency is therefore ${\overline{\tau }}_{\mathrm{rec}}+{\overline{\tau }}_{\mathrm{corr}}$.

5. Results

5.1. Operating-Point Behavior Under the Multi-Parameter Configuration Sweep

We are reporting results using operating-point “slices” that fix $\omega =5$ with $T\in \{0.15,0.20,0.25,0.30,0.35,0.40\}$, and then report outcomes over the uncertainty bound $u_{max}\in \{0,16,28\}$ for both genuine and impostor trials (Table 2, Figure 5 and Table 3, Figure 6). In our evaluation, the second factor is held fixed per trial, so the reported impostor $\mathrm{FAR}$ should be interpreted as conditional on second-factor compromise (i.e., impostors are tested under the same second-factor-derived challenges as the target); we do this intentionally to isolate the core face-geometry mechanism and assess discriminability under a consistent challenge set rather than confounding results with “wrong-challenge” failures. This presentation retains the full structure of the two-parameter sweep that matters most empirically, and it reports separately the two latency components—ternary recovery time ${\overline{\tau }}_{\mathrm{rec}}$ and uncertainty correction time ${\overline{\tau }}_{\mathrm{corr}}$—alongside the corresponding error rates and correction attempt rates.

Table 2. NAUAI dataset operating points for fixed empirically best $\omega =5$. Each panel fixes T and reports metrics across $u_{max}\in \{0,16,28\}$, across $N=96$ samples per trial type for each configuration.

(a) $T=0.15$							(b) $T=0.20$
Genuine							Genuine
$u_{max}$	$\mathrm{FRR}$	${\alpha }_g$	$\overline{u}$	${\overline{\tau }}_{\mathrm{enr}}$	${\overline{\tau }}_{\mathrm{rec}}$	${\overline{\tau }}_{\mathrm{corr}}$	$u_{max}$	$\mathrm{FRR}$	${\alpha }_g$	$\overline{u}$	${\overline{\tau }}_{\mathrm{enr}}$	${\overline{\tau }}_{\mathrm{rec}}$	${\overline{\tau }}_{\mathrm{corr}}$
0	1.00	0.00	90.78	0.46	0.02	0.00	0	1.00	0.00	34.64	0.45	0.02	0.00
16	1.00	0.00	102.68	0.45	0.02	0.00	16	0.61	0.39	33.49	0.45	0.02	0.00
28	0.97	0.03	103.30	0.45	0.02	3.91	28	0.43	0.58	33.67	0.46	0.02	5.39
Impostor							Impostor
$u_{max}$	$\mathrm{FAR}$	${\alpha }_i$	$\overline{u}$	${\overline{\tau }}_{\mathrm{enr}}$	${\overline{\tau }}_{\mathrm{rec}}$	${\overline{\tau }}_{\mathrm{corr}}$	$u_{max}$	$\mathrm{FAR}$	${\alpha }_i$	$\overline{u}$	${\overline{\tau }}_{\mathrm{enr}}$	${\overline{\tau }}_{\mathrm{rec}}$	${\overline{\tau }}_{\mathrm{corr}}$
0	0.00	0.00	255.81	0.46	0.46	0.00	0	0.00	0.00	249.29	0.45	0.29	0.00
16	0.00	0.00	255.86	0.45	0.45	0.00	16	0.00	0.00	250.40	0.45	0.26	0.00
28	0.00	0.00	255.90	0.45	0.46	0.00	28	0.00	0.00	251.20	0.51	0.31	0.00
(c) $T=0.25$							(d) $T=0.30$
Genuine							Genuine
$u_{max}$	$\mathrm{FRR}$	${\alpha }_g$	$\overline{u}$	${\overline{\tau }}_{\mathrm{enr}}$	${\overline{\tau }}_{\mathrm{rec}}$	${\overline{\tau }}_{\mathrm{corr}}$	$u_{max}$	$\mathrm{FRR}$	${\alpha }_g$	$\overline{u}$	${\overline{\tau }}_{\mathrm{enr}}$	${\overline{\tau }}_{\mathrm{rec}}$	${\overline{\tau }}_{\mathrm{corr}}$
0	0.99	0.01	13.55	0.45	0.02	0.00	0	1.00	0.00	17.76	0.45	0.02	0.00
16	0.26	0.74	14.02	0.45	0.02	0.00	16	0.46	0.55	16.92	0.45	0.02	0.00
28	0.12	0.91	14.41	0.46	0.02	0.33	28	0.12	0.93	17.42	0.47	0.02	5.52
Impostor							Impostor
$u_{max}$	$\mathrm{FAR}$	${\alpha }_i$	$\overline{u}$	${\overline{\tau }}_{\mathrm{enr}}$	${\overline{\tau }}_{\mathrm{rec}}$	${\overline{\tau }}_{\mathrm{corr}}$	$u_{max}$	$\mathrm{FAR}$	${\alpha }_i$	$\overline{u}$	${\overline{\tau }}_{\mathrm{enr}}$	${\overline{\tau }}_{\mathrm{rec}}$	${\overline{\tau }}_{\mathrm{corr}}$
0	0.00	0.00	214.08	0.45	0.07	0.00	0	0.00	0.00	130.65	0.45	0.03	0.00
16	0.00	0.00	215.09	0.45	0.07	0.00	16	0.01	0.01	113.60	0.45	0.03	0.00
28	0.00	0.00	206.51	0.48	0.07	0.00	28	0.05	0.06	117.79	0.54	0.03	0.35
(e) $T=0.35$							(f) $T=0.40$
Genuine							Genuine
$u_{max}$	$\mathrm{FRR}$	${\alpha }_g$	$\overline{u}$	${\overline{\tau }}_{\mathrm{enr}}$	${\overline{\tau }}_{\mathrm{rec}}$	${\overline{\tau }}_{\mathrm{corr}}$	$u_{max}$	$\mathrm{FRR}$	${\alpha }_g$	$\overline{u}$	${\overline{\tau }}_{\mathrm{enr}}$	${\overline{\tau }}_{\mathrm{rec}}$	${\overline{\tau }}_{\mathrm{corr}}$
0	1.00	0.00	34.07	0.45	0.02	0.00	0	1.00	0.00	131.61	0.45	0.08	0.00
16	0.99	0.02	35.85	0.45	0.02	0.00	16	1.00	0.00	125.10	0.45	0.08	0.00
28	0.72	0.31	34.03	0.46	0.02	17.92	28	1.00	0.00	128.21	0.45	0.07	0.00
Impostor							Impostor
$u_{max}$	$\mathrm{FAR}$	${\alpha }_i$	$\overline{u}$	${\overline{\tau }}_{\mathrm{enr}}$	${\overline{\tau }}_{\mathrm{rec}}$	${\overline{\tau }}_{\mathrm{corr}}$	$u_{max}$	$\mathrm{FAR}$	${\alpha }_i$	$\overline{u}$	${\overline{\tau }}_{\mathrm{enr}}$	${\overline{\tau }}_{\mathrm{rec}}$	${\overline{\tau }}_{\mathrm{corr}}$
0	0.00	0.00	63.56	0.45	0.02	0.00	0	0.00	0.00	123.67	0.45	0.05	0.00
16	0.00	0.00	64.34	0.45	0.02	0.00	16	0.00	0.00	136.06	0.45	0.07	0.00
28	0.02	0.03	73.04	0.51	0.02	1.85	28	0.00	0.00	126.03	0.45	0.06	0.00

Figure 5. Full data for fixed $\omega =5$ on NAUAI dataset.

Table 3. Faces94 dataset operating points for fixed empirically best $\omega =5$. Each panel fixes T and reports metrics across $u_{max}\in \{0,16,28\}$, across $N=66$ samples per trial type for each configuration.

(a) $T=0.15$							(b) $T=0.20$
Genuine							Genuine
$u_{max}$	$\mathrm{FRR}$	${\alpha }_g$	$\overline{u}$	${\overline{\tau }}_{\mathrm{enr}}$	${\overline{\tau }}_{\mathrm{rec}}$	${\overline{\tau }}_{\mathrm{corr}}$	$u_{max}$	$\mathrm{FRR}$	${\alpha }_g$	$\overline{u}$	${\overline{\tau }}_{\mathrm{enr}}$	${\overline{\tau }}_{\mathrm{rec}}$	${\overline{\tau }}_{\mathrm{corr}}$
0	1.00	0.00	197.09	0.08	0.08	0.00	0	1.00	0.00	98.79	0.09	0.03	0.00
16	1.00	0.00	206.00	0.08	0.10	0.00	16	0.94	0.06	99.20	0.09	0.03	0.00
28	1.00	0.00	200.52	0.08	0.09	0.00	28	0.91	0.09	129.20	0.09	0.04	0.38
Impostor							Impostor
$u_{max}$	$\mathrm{FAR}$	${\alpha }_i$	$\overline{u}$	${\overline{\tau }}_{\mathrm{enr}}$	${\overline{\tau }}_{\mathrm{rec}}$	${\overline{\tau }}_{\mathrm{corr}}$	$u_{max}$	$\mathrm{FAR}$	${\alpha }_i$	$\overline{u}$	${\overline{\tau }}_{\mathrm{enr}}$	${\overline{\tau }}_{\mathrm{rec}}$	${\overline{\tau }}_{\mathrm{corr}}$
0	0.00	0.00	256.00	0.09	0.47	0.00	0	0.00	0.00	253.27	0.09	0.37	0.00
16	0.00	0.00	255.98	0.08	0.47	0.00	16	0.00	0.00	254.48	0.09	0.37	0.00
28	0.00	0.00	256.00	0.08	0.47	0.00	28	0.00	0.00	254.45	0.09	0.40	0.00
(c) $T=0.25$							(d) $T=0.30$
Genuine							Genuine
$u_{max}$	$\mathrm{FRR}$	${\alpha }_g$	$\overline{u}$	${\overline{\tau }}_{\mathrm{enr}}$	${\overline{\tau }}_{\mathrm{rec}}$	${\overline{\tau }}_{\mathrm{corr}}$	$u_{max}$	$\mathrm{FRR}$	${\alpha }_g$	$\overline{u}$	${\overline{\tau }}_{\mathrm{enr}}$	${\overline{\tau }}_{\mathrm{rec}}$	${\overline{\tau }}_{\mathrm{corr}}$
0	1.00	0.00	33.42	0.11	0.02	0.00	0	1.00	0.00	28.92	0.09	0.02	0.00
16	0.76	0.24	43.91	0.13	0.03	0.00	16	0.70	0.32	32.11	0.09	0.02	0.00
28	0.59	0.41	52.64	0.11	0.03	2.52	28	0.29	0.73	25.86	0.11	0.02	12.96
Impostor							Impostor
$u_{max}$	$\mathrm{FAR}$	${\alpha }_i$	$\overline{u}$	${\overline{\tau }}_{\mathrm{enr}}$	${\overline{\tau }}_{\mathrm{rec}}$	${\overline{\tau }}_{\mathrm{corr}}$	$u_{max}$	$\mathrm{FAR}$	${\alpha }_i$	$\overline{u}$	${\overline{\tau }}_{\mathrm{enr}}$	${\overline{\tau }}_{\mathrm{rec}}$	${\overline{\tau }}_{\mathrm{corr}}$
0	0.00	0.00	230.35	0.11	0.14	0.00	0	0.00	0.00	179.02	0.09	0.04	0.00
16	0.00	0.00	234.94	0.13	0.17	0.00	16	0.00	0.00	173.79	0.09	0.04	0.00
28	0.00	0.00	233.91	0.11	0.14	0.00	28	0.00	0.00	174.02	0.13	0.05	0.00
(e) $T=0.35$							(f) $T=0.40$
Genuine							Genuine
$u_{max}$	$\mathrm{FRR}$	${\alpha }_g$	$\overline{u}$	${\overline{\tau }}_{\mathrm{enr}}$	${\overline{\tau }}_{\mathrm{rec}}$	${\overline{\tau }}_{\mathrm{corr}}$	$u_{max}$	$\mathrm{FRR}$	${\alpha }_g$	$\overline{u}$	${\overline{\tau }}_{\mathrm{enr}}$	${\overline{\tau }}_{\mathrm{rec}}$	${\overline{\tau }}_{\mathrm{corr}}$
0	1.00	0.00	37.24	0.09	0.02	0.00	0	1.00	0.00	124.68	0.09	0.07	0.00
16	0.95	0.05	39.36	0.09	0.02	0.00	16	1.00	0.00	128.73	0.09	0.08	0.00
28	0.74	0.27	35.95	0.11	0.02	8.59	28	1.00	0.00	127.23	0.09	0.08	0.00
Impostor							Impostor
$u_{max}$	$\mathrm{FAR}$	${\alpha }_i$	$\overline{u}$	${\overline{\tau }}_{\mathrm{enr}}$	${\overline{\tau }}_{\mathrm{rec}}$	${\overline{\tau }}_{\mathrm{corr}}$	$u_{max}$	$\mathrm{FAR}$	${\alpha }_i$	$\overline{u}$	${\overline{\tau }}_{\mathrm{enr}}$	${\overline{\tau }}_{\mathrm{rec}}$	${\overline{\tau }}_{\mathrm{corr}}$
0	0.00	0.00	112.48	0.09	0.02	0.00	0	0.00	0.00	122.92	0.09	0.04	0.00
16	0.00	0.00	87.15	0.09	0.02	0.00	16	0.00	0.00	127.89	0.09	0.05	0.00
28	0.02	0.02	110.56	0.11	0.03	0.03	28	0.00	0.00	122.38	0.09	0.05	0.00

Figure 6. Full data for fixed $\omega =5$ on Faces94 dataset.

5.1.1. The Role of Matching Tolerance

Across both datasets, very small tolerances yield a “no-recovery” regime: genuine trials exhibit $\mathrm{FRR}\approx 1$ and ${\alpha }_g\approx 0$, accompanied by large mean uncertainty $\overline{u}$. On NAUAI at $T=0.15$, $\mathrm{FRR}=1.00$ for $u_{max}\in \{0,16\}$ with ${\alpha }_g=0$ and $\overline{u}\approx 90$–103; even at $u_{max}=28$, the system remains in a failure area with $\mathrm{FRR}=0.97$, ${\alpha }_g=0.03$, and $\overline{u}=103.30$ (Table 2, Figure 5). Faces94 fails even more clearly here, at $T=0.15$, where $\mathrm{FRR}=1.00$ and ${\alpha }_g=0$ for all three $u_{max}$ values, with $\overline{u}\approx 197$–206 (Table 3, Figure 6). It is interesting to note that the level of uncertainty is still significantly higher for impostors than it is for genuine users, suggesting that the mechanism is still reasonably discriminative in principle, but in this particular construction still contains too much error at such tight tolerance to successfully recover keys.

As T increases into the midrange, genuine error rates improve sharply, but only when correction is permitted. On NAUAI at $T=0.25$, raising $u_{max}$ from $0\to 16\to 28$ reduces $\mathrm{FRR}$ from $0.99\to 0.26\to 0.12$ and increases ${\alpha }_g$ from $0.01\to 0.74\to 0.91$, while keeping $\overline{u}$ in a low regime (about 13–14) (Table 2, Figure 5). At $T=0.30$, NAUAI shows a similar pattern: $\mathrm{FRR}=1.00$ at $u_{max}=0$ versus $\mathrm{FRR}=0.46$ at $u_{max}=16$ and $\mathrm{FRR}=0.12$ at $u_{max}=28$ (Table 2, Figure 5). This is evidence that the error correction phase of the construction is a significant help.

Faces94 exhibits the same transition but at generally worse error rates for comparable T. For example, at $T=0.30$, $\mathrm{FRR}=1.00$ for $u_{max}=0$, it improves to $\mathrm{FRR}=0.70$ at $u_{max}=16$, and reaches $\mathrm{FRR}=0.29$ at $u_{max}=28$ (Table 3, Figure 6). This reinforces the expected sensitivity of facial-geometry recovery to capture variability: a real-people dataset moves the usable envelope toward requiring more permissive correction (larger $u_{max}$) at a given T.

Finally, at large T (here, $T=0.40$), both datasets return to a failure regime on the genuine side: $\mathrm{FRR}=1.00$ and ${\alpha }_g=0$ for all $u_{max}$, with $\overline{u}\approx 125$–132 (NAUAI) and $\overline{u}\approx 124$–129 (Faces94) (Table 2, Figure 5 and Table 3, Figure 6). We observe that, within the explored range, usable performance occurs only in a midrange band of T, and the band is narrower on Faces94 than on the tightly controlled AI dataset.

5.1.2. The Role of Maximum Uncertainty

For fixed T (and here fixed $\omega =5$), $u_{max}$ primarily determines how often the protocol is allowed to proceed beyond gating (higher ${\alpha }_g$), which in turn largely controls the observed genuine error rate. The NAUAI slice at $T=0.25$ shows the intended behavior cleanly: $u_{max}=0$ produces essentially complete failure ($\mathrm{FRR}=0.99$, ${\alpha }_g=0.01$), while $u_{max}=16$ yields usable behavior ($\mathrm{FRR}=0.26$, ${\alpha }_g=0.74$) and $u_{max}=28$ improves further ($\mathrm{FRR}=0.12$, ${\alpha }_g=0.91$) (Table 2, Figure 5). Similar improvements appear at $T=0.20$ and $T=0.30$.

Raising $u_{max}$, however, clearly shifts work into uncertainty correction and substantially increases ${\overline{\tau }}_{\mathrm{corr}}$. On NAUAI, this cost is visible but generally modest in the best midrange slices: at $T=0.25$, $u_{max}=28$ increases correction cost to ${\overline{\tau }}_{\mathrm{corr}}=0.33$ relative to ${\overline{\tau }}_{\mathrm{corr}}=0.00$ at $u_{max}=16$ (Table 2, Figure 5). In contrast, on Faces94, the correction-time penalty at $u_{max}=28$ strongly dominates: at $T=0.30$, going from $u_{max}=16$ to $u_{max}=28$ improves $\mathrm{FRR}$ from $0.70$ to $0.29$ and increases ${\alpha }_g$ from $0.32$ to $0.73$, but raises ${\overline{\tau }}_{\mathrm{corr}}$ from $0.00$ to $12.96$ (Table 3, Figure 6). We acknowledge that 12 s is a long time to wait for a successful recovery. At $T=0.35$, the same trade-off persists ($\mathrm{FRR}=0.95\to 0.74$ and ${\alpha }_g=0.05\to 0.27$, while ${\overline{\tau }}_{\mathrm{corr}}$ jumps to $8.59$ at $u_{max}=28$) (Table 3, Figure 6). Empirically, $u_{max}$ therefore acts as the main usability–latency trade-off knob, which is not surprising given the exponential nature of the search problem.

5.1.3. Impostor Behavior and Nonzero FAR

False accepts do occur for some operating points. On NAUAI, impostor error remains essentially absent through $T\le 0.25$ for all $u_{max}$ (all listed $\mathrm{FAR}=0.00$), but becomes nonzero at higher T when correction is more permissive: at $T=0.30$, $\mathrm{FAR}=0.01$ for $u_{max}=16$ and $\mathrm{FAR}=0.05$ for $u_{max}=28$; at $T=0.35$, $\mathrm{FAR}=0.02$ for $u_{max}=28$ (Table 2, Figure 5). In these same cells, the impostor attempt rate is also nonzero (${\alpha }_i=0.01$ at $(T,u_{max})=(0.30,16)$ and ${\alpha }_i=0.06$ at $(0.30,28)$), indicating that the gating condition is met often enough for impostors that recovery can sometimes succeed (Table 2, Figure 5). This is an unfortunate weakness of the uncertainty gating mechanism: larger T increases inter-subject overlap and reduces uncertainty, making it easier for impostors to stay under the uncertainty bound and increasing the chance of a successful fraudulent recovery.

On Faces94, the impostor slices remain almost entirely at $\mathrm{FAR}=0.00$ across this T range, with the lone exception at $T=0.35,u_{max}=28$, where $\mathrm{FAR}=0.02$ and ${\alpha }_i=0.02$ (Table 3, Figure 6). We observe that, within these slices, Faces94’s primary limitation is usability (high $\mathrm{FRR}$ unless correction is permissive), whereas NAUAI’s limitation at higher T becomes security (nonzero $\mathrm{FAR}$) when $u_{max}$ is large enough to admit impostor attempts.

5.1.4. Timing and Latency Decomposition

Across both datasets, ternary recovery time ${\overline{\tau }}_{\mathrm{rec}}$ remains small and comparatively stable in the midrange where genuine outcomes are nontrivial (typically $\approx 0.02$ on NAUAI and $\approx 0.02$–$0.03$ on Faces94), while uncertainty correction time ${\overline{\tau }}_{\mathrm{corr}}$ is the dominant contributor when correction is frequently invoked (Table 2, Figure 5 and Table 3, Figure 6). This separation is clearest on Faces94: at $T=0.30,u_{max}=28$, ${\overline{\tau }}_{\mathrm{rec}}=0.02$ but ${\overline{\tau }}_{\mathrm{corr}}=12.96$; at $T=0.35,u_{max}=28$, ${\overline{\tau }}_{\mathrm{rec}}=0.02$ but ${\overline{\tau }}_{\mathrm{corr}}=8.59$ (Table 3, Figure 6). On NAUAI, correction time is usually near-zero except in the same cells where ${\alpha }_g$ is high and correction is permissive (e.g., ${\overline{\tau }}_{\mathrm{corr}}=5.39$ at $T=0.20,u_{max}=28$ and ${\overline{\tau }}_{\mathrm{corr}}=5.52$ at $T=0.30,$ $u_{max}=28$) (Table 2, Figure 5). This suggests unsurprisingly that ternary recovery is “cheap,” uncertainty correction is the bottleneck, and the bottleneck activates mainly when $u_{max}$ is set to admit borderline samples.

Enrollment time differs by dataset and is relatively stable within each dataset’s slices: on NAUAI, ${\overline{\tau }}_{\mathrm{enr}}\approx 0.45$ across most listed operating points; on Faces94, it is smaller (roughly $0.08$–$0.13$) (Table 2, Figure 5 and Table 3, Figure 6). This effect is probably attributable to implementation-level differences such as image dimensions and preprocessing cost rather than protocol parameters (a result of misplaced timing measurements), since the data collection sweeps affect recovery/correction much more than enrollment.

5.1.5. Practical Operating Regions Within the $\omega =5$ Slices

The slice tables suggest a concise picture of the usable region and its trade-offs. On NAUAI, the most attractive region for usability and security lies around $T=0.25$ with $u_{max}\in \{16,28\}$. At $T=0.25$, $u_{max}=16$ achieves $\mathrm{FRR}=0.26$ with negligible correction cost (${\overline{\tau }}_{\mathrm{corr}}=0.00$) and $\mathrm{FAR}=0.00$; $u_{max}=28$ improves usability ($\mathrm{FRR}=0.12$) at a modest correction penalty (${\overline{\tau }}_{\mathrm{corr}}=0.33$) while still maintaining $\mathrm{FAR}=0.00$ in this slice (Table 2, Figure 5). Moving to $T=0.30$, it continues to perform well with genuine $\mathrm{FRR}$ at $u_{max}=28$ ($0.12$) but introduces small impostor error ($\mathrm{FAR}=0.05$) and nonzero impostor correction attempt rate (${\alpha }_i=0.06$), making $T=0.30$ materially less attractive from a security perspective in this dataset (Table 2, Figure 5).

On Faces94, the only slice exhibiting meaningfully usable genuine error rates is $T=0.30$ with $u_{max}=28$, but this setting carries substantial correction cost (${\overline{\tau }}_{\mathrm{corr}}=12.96$) (Table 3, Figure 6). Reducing $u_{max}$ to 16 eliminates the correction-time overhead but leaves the system in a high-error regime ($\mathrm{FRR}=0.70$) (Table 3, Figure 6). It appears that, on a much less tightly-controlled real-face dataset, the mechanism can be driven to usable error rates only by permitting correction on a larger fraction of trials, and the practical constraint becomes correction latency rather than impostor error (which remains near-zero in these areas).

Overall, the results are fairly clear to summarize: T and $u_{max}$ jointly determine whether the mechanism operates in a (i) no-recovery regime (high $\overline{u}$, ${\alpha }_g\approx 0$), (ii) usable regime (moderate $\overline{u}$, large ${\alpha }_g$, low $\mathrm{FRR}$), or (iii) permissive regime where impostor attempts can pass gating and $\mathrm{FAR}$ becomes non-negligible. In general, empirical results on both datasets suggested the theoretical potential for such a mechanism to work, but exhibited relatively low overall usability, especially as capture conditions moved outside of extremely tight controls.

6. Discussion

The system proposed herein was designed as an illustration of how a PUF-style challenge–response mechanism can be mapped onto a biometric setting. It demonstrates that one can take random challenges, tie them to a biometric structure such as facial landmarks, and then bind a key by discarding responses, all while keeping revocability through a second factor and an automatically refreshed nonce. This gives us an interesting platform for thinking about key binding, revocation, and noise correction in biometrics, even if this particular construction by itself is somewhat fragile.

It is important to recognize that the security of the scheme as defined here really sits on the shoulders of the auxiliary password. If an attacker steals the enrollment record, what they receive is the reduced subset of responses, the hash of the bound key, and indirectly the Hamming weight of that key. The entropy of the key itself remains largely intact: for a sufficiently long key, knowing the Hamming weight and/or the $\omega$ parameter does not meaningfully help an attacker mount a feasible brute-force search (see Section 3.5.7 [33,34]). The subset of responses is harder to interpret because each response is a concatenation of Gray-coded distances from a randomly chosen challenge point to the set of landmarks. Without the password and nonce, the challenge points cannot be regenerated and the landmark order remains unknown, so reconstructing the facial geometry from the stored template is not straightforward. In this sense, the subset alone is not an obvious privacy leak.

The situation changes if the password is compromised. With the second factor in hand, an attacker can regenerate the challenge points and recover the landmark permutation, which makes the stored responses directly interpretable. At that point, reconstructing the underlying face geometry becomes trivial. This highlights an imbalance in the design: there is revocability, but it comes exclusively from leaning on the password as the revocation lever. The biometric portion of the scheme adds complexity but not much security on its own.

There are other limitations worth noting. The noise in landmark detection and capture conditions makes the reconstruction problem brittle, which is why bounded local search is necessary in the first place. That bounded search grows more expensive as noise increases, and at some point the cost becomes intolerable. The nonce refresh prevents long-lived template reuse, but it does not eliminate cross-matching risk entirely, since the repeated compromise of different session records for the same user could eventually leak correlations. Finally, the system has not been analyzed against modern attack models that are well-documented in the cancelable biometrics literature, and it is not therefore immediately clear how it would hold up under adversarial scrutiny.

Beyond limitations, there are several contexts where a geometric and CRP-based system is a feature rather than a liability. In tightly controlled capture regimes (e.g., badge-and-gate building access, lab cleanrooms, kiosk check-ins, or operator consoles) pose, distance, and lighting can realistically be constrained, at which point the deterministic geometry becomes a stable signal, the tolerance T can be tuned once and held fixed, and the nonce-driven refresh gives you per-session revocability without model retraining or cross-site template reuse. Unlike a learned embedding that generalizes “who you are” across many appearances, our response pipeline is deliberately narrow: it performs best when the environment is predictable, which is exactly what many access-control deployments can guarantee.

A second, more interesting advantage is that geometry makes it easy to incorporate user-driven micro-gestures (most simply, a facial expression) as a private factor that is never written down and cannot be brute-forced in the classical sense. In this scenario, the enrollment can capture a neutral pose plus a user-chosen expression (or subtle muscle pattern), and the same expression is required at authentication, so the matcher’s responses are tied not only to who the user is but to what the user intentionally does in that moment, which is closer to a password than to a passive biometric. A conventional modern neural feature extractor will usually recognize “you” whether you are smiling or not, but a geometric CRP mechanism can be parameterized to make that expression matter, effectively turning an otherwise static trait into a reproducible, revocable behavior that raises the bar for lookalike spoofing.

There are also pragmatic advantages: the whole pipeline is interpretable end-to-end (challenge points, landmark shuffle, distances, bit-level masks), which makes failure triage easier; it has a small computational footprint with no large models to store, no training data to curate; it can run comfortably on-device, it avoids retaining raw images, and the nonce guarantees that a successful recovery yields a short-lived key that is replaced automatically at session close, allowing per-door or per-session keys and straightforward revocation. Taken together, these traits sketch a viable niche for the construction: controlled capture, minimal infrastructure, interpretable security posture, and a simple, human-in-the-loop “gesture factor” that other templates typically do not exploit.

Our empirical FAR/FRR results should be interpreted in the context of the specific evaluation protocol and datasets we used. First, the reported operating points are conditional on the evaluated datasets and their capture conditions; we make no claim that the same error rates will hold under substantially different capture conditions. Second, the reported error rates are specific to the particular genuine/impostor pairings sampled from the datasets; different pairing or sampling strategies could certainly yield different empirical FAR/FRR. Third, our threat model is limited to the impostor setting evaluated in this study; we did not experimentally assess the ability of stronger adversaries to invert the templates or fraudulently recover the ephemeral keys (e.g., presentation attacks, deepfakes, adaptive attacks, or attackers with additional knowledge).

In summary, the contribution here is broadly conceptual rather than immediately practical, but it carves out a clean design point that is useful to consider. The construction shows that CRP-style interfaces can be adapted to biometrics, that revocability can still be achieved by mixing in a second factor and discarding parts of the response, that keys can be refreshed on every session via the nonce, and that key recovery is possible even under noisy conditions. At the same time, the design as specified carries clear weaknesses: privacy and security rest almost entirely on the second factor, error tolerance is limited, and revocation is only as strong as the secrecy of the second factor. Still, the pipeline is functional, lightweight, and easy to deploy in controlled capture environments, and it naturally accommodates user-driven factors (e.g., expressions) that conventional learned embeddings tend to ignore. These trade-offs should temper expectations of robustness, but they do not diminish the value of the idea as a practical niche solution in constrained settings and as a seed for further exploration.

7. Future Work

While the CRP-style feature extraction mechanism is an interesting notion, its performance as a purely geometric feature is inevitably limited in discriminative power. The feature representation used here is highly sensitive to capture conditions and provides only very modest intra-subject consistency and inter-subject separability, which constrains our achievable FAR/FRR even when the binding mechanism behaves very well and as-intended. A natural extension of this work is therefore to replace the proposed geometric CRP feature extraction mechanism with more discriminative and capture-robust feature extractors (e.g., learned embeddings). It would also be informative and valuable to study the same binding protocol with alternative biometric modalities (e.g., fingerprint, iris, vascular patterns). Such future analyses would better isolate the security and usability properties of the binding mechanism from the limitations of a less-than-ideal feature extractor, and would likely lead to a more accurate and practical technology.

8. Conclusions

We presented a conceptual exploration of a two-factor, per-session refreshable cancelable biometric key-binding scheme that borrows a PUF-style challenge–response interface and applies it to facial landmark geometry, binding and recovering a key according to recently proposed novel cryptographic constructions. The scheme works, in principle, as follows: given a second factor, a session nonce, and a cooperating user, it is possible to bind a key to the biometric, discard the key, and later recover the key reliably enough to decrypt protected data from a matching biometric from a genuine subject. Our experiments confirm that the mechanism can function reasonably well under well-controlled capture conditions. The addition of a nonce ensures that every successful session produces a fresh enrollment and a new ephemeral key, so the system is continually refreshed rather than relying on a long-lived template. At the same time, the trade-off between usability and security remains somewhat severe. To make the system tolerant enough to handle natural biometric noise, one must accept error margins wide enough that false acceptances can become uncomfortably likely. The contribution here should therefore be understood as a conceptual demonstration that PUF-style challenge–response mechanisms, combined with the subset key binding and recovery mechanisms previously proposed in the literature, can in principle be ported into biometrics, with the hope that the idea itself may inspire stronger constructions that do not suffer from the same security and practicality constraints. Overall, the paper’s contribution is the articulation and empirical characterization of this design niche, together with a clear accounting of the security constraints and where the approach degrades as capture conditions loosen.

9. Patents

This article describes research related to subject matter disclosed in the following U.S. patent applications. These disclosures are acknowledged as relevant prior art and to clarify the relationship between this manuscript and the disclosed inventions; nothing herein should be interpreted as claiming or assigning rights to any intellectual property.

• U.S. Patent Application Publication No. US 2026/0005876 A1 (published 1 January 2026), Pseudo-Homomorphic Authentication of Users with Biometry (filed 5 September 2025) [49].
• U.S. Patent Application Publication No. US 2025/0167997 A1 (published 22 May 2025), Protocols with Noisy Response-Based Cryptographic Subkeys (filed 13 September 2024) [50].