4 ms·

Putting all the TouchID sucks / TouchID is great questions aside, can somebody help me understand how Apple (supposedly) is calculating a hash of a fingerprint

Putting all the TouchID sucks / TouchID is great questions aside, can somebody help me understand how Apple (supposedly) is calculating a hash of a fingerprint and storing that hash in the phone, not the real fingerprint? As I understand correctly, the purpose of a hashing function is to create totally different output even on a very minor change in the input data, which wouldn't work that great with fingerprints... or are they just using a clever hashing function which tries to somehow normalise the data before hashing them?

DannoHung 13y ago
My guess is that they break the fingerprint into very small subsections and use those hashes to compare against. If they get matches in enough consecutive areas, then the phone unlocks.
dnautics 13y ago
i think the fingerprint reader extracts consistent data from the image of the fingerprint no matter how distorted it is, by say, looking at the relative position and translating the pattern of whorls into numbers, then that number is hashed.
signa11 13y ago
> can somebody help me understand how Apple (supposedly) is calculating a hash of a fingerprint this might provide some information: 'Symmetric hash functions for secure fingerprint biometric systems' (http://www.researchgate.net/publication/222570842_Symmetric_hash_functions_for_secure_fingerprint_biometric_systems/file/79e4150d06419e02ec.pdf http://www.researchgate.net/publication/222570842_Symmetric_...). also this: https://www.schneier.com/blog/archives/2013/09/iphone_fingerpr.html https://www.schneier.com/blog/archives/2013/09/iphone_finger... (for some general overview)
modernerd 13y ago
There is a lot of detail in Authentec's 'Spot-based finger biometric processing method' patent application here if you're interested: http://www.patentgenius.com/patent/7787667.html http://www.patentgenius.com/patent/7787667.html In short, they store a number of unique sub-regions of each 'enrollment' (a reading resulting in pixel data). These sub-regions – called 'spots' – can then be hashed and matched against future enrollments to provide a correlation score.
sp332 13y ago
Some hash functions are designed to produce very different outputs for very minor changes in input. (This is known as "cascade".) Others are designed to produce the same output for similar inputs.

DannoHung 13y ago

My guess is that they break the fingerprint into very small subsections and use those hashes to compare against. If they get matches in enough consecutive areas, then the phone unlocks.

dnautics 13y ago

i think the fingerprint reader extracts consistent data from the image of the fingerprint no matter how distorted it is, by say, looking at the relative position and translating the pattern of whorls into numbers, then that number is hashed.

signa11 13y ago

> can somebody help me understand how Apple (supposedly) is calculating a hash of a fingerprint this might provide some information: 'Symmetric hash functions for secure fingerprint biometric systems' (http://www.researchgate.net/publication/222570842_Symmetric_hash_functions_for_secure_fingerprint_biometric_systems/file/79e4150d06419e02ec.pdf http://www.researchgate.net/publication/222570842_Symmetric_...). also this: https://www.schneier.com/blog/archives/2013/09/iphone_fingerpr.html https://www.schneier.com/blog/archives/2013/09/iphone_finger... (for some general overview)

modernerd 13y ago

There is a lot of detail in Authentec's 'Spot-based finger biometric processing method' patent application here if you're interested: http://www.patentgenius.com/patent/7787667.html http://www.patentgenius.com/patent/7787667.html In short, they store a number of unique sub-regions of each 'enrollment' (a reading resulting in pixel data). These sub-regions – called 'spots' – can then be hashed and matched against future enrollments to provide a correlation score.

sp332 13y ago

Some hash functions are designed to produce very different outputs for very minor changes in input. (This is known as "cascade".) Others are designed to produce the same output for similar inputs.