This thesis aims to identify vulnerabilities in biometric systems and propose solutions to enhance their security.
A biometric system authenticates or identifies an individual using physical or behavioral characteristics,
such as fingerprints. For security reasons, these data are transformed into templates, making it difficult to
reconstruct the original data. This transformation ensures privacy while enabling accurate authentication and
identification. Due to their similar usage, we studied biometric data similarly to cryptographic passwords.
First, we examined the probability of near-collisions, where two templates from different users are similar.
Near-collisions are problematic as they degrade system recognition and can be exploited by attackers to
impersonate multiple users. To mitigate this, we established a database size limit to prevent near-collisions
and introduced a score to help configure biometric recognition algorithms.
Next, we studied exhaustive search attacks on biometric data. We first focused on targeted attacks, which
aim at a specific user, analyzing the probability of an attacker successfully impersonating a chosen user
under various scenarios. This allowed us to define security bounds for template databases and provide
recommendations for biometric system security parameters. We also investigated untargeted attacks, where
the attacker does not aim at any specific user, to evaluate the probability of one or more attackers successfully
impersonating someone in a database. Even if the probability of impersonating a specific individual is low, it
can be easier to impersonate someone in a large database, similar to how "0000" is likely to be someone’s PIN
in a large dataset. This analysis completed our investigation of biometric data security and the characterization
of their limitations.
The attacks described above are primarily offline. Online, these attacks are generally detected or countermea-
sures are implemented to slow down attackers, such as increasing the waiting time between two attempts. To
address offline attack issues, we developed two new biometric authentication protocols resistant to offline
attacks. The first protocol uses a zero-knowledge proof to ensure that a malicious client, even with unlimited
computational resources, cannot obtain useful information from the server to perform an offline exhaustive
search. The second protocol allows for the correction of biometric data provided by the client, designed so
that a malicious client with polynomial computational capacity cannot obtain useful information.

Jury:
    Referees:
        Patrick LACHARME hdr Associate Professor at GREYC
        Geoffroy COUTEAU hdr Junior Researcher at CNRS
    Examiners:
        Reihaneh SAFAVI-NAINI Professor at University of Calgary
        Alexis BONNECAZE Professor at I2M
        Sonia BEN MOKHTAR Senior Researcher at CNRS
    Supervisors:
        Pascal LAFOURCADE Professor at LIMOS
        Kévin THIRY-ATIGHEHCHI Associate Professor at LIMOS
        Paul-Marie GROLLEMUND Associate Professor at LMBP