Facial KeyGen
Python-based biometric authentication system that generates cryptographic keys from facial biometrics using computer vision and ML for post-quantum security research.
Overview
A Python-based biometric authentication system that explores generating cryptographic keys from facial biometrics using computer vision and machine learning, motivated by future authentication challenges in a post-quantum computing landscape.
Explored biometric-derived key generation as a novel authentication approach.
The Problem
Traditional password-based authentication relies on stored credentials that remain vulnerable to theft, leaks, brute force, and future advances in computing. Post-quantum threats make long-term security of stored secrets increasingly uncertain.
Why I Built It
To explore whether facial biometrics could contribute to cryptographic key generation as an alternative authentication approach — producing keys that are derived rather than stored, making them theoretically impossible to steal from a database.
Objectives
- Extract stable, repeatable biometric feature vectors from facial images
- Derive cryptographic keys deterministically from those features
- Explore fuzzy commitment schemes for handling biometric variability
- Research applicability as a complementary post-quantum authentication layer
My Role
Developed the entire computer vision pipeline, implemented biometric feature extraction using MobileNetV2 and Vision Transformer models, designed the key derivation workflow, and conducted security analysis of the approach.
Architecture
Face detection via OpenCV locates and normalizes the face region. MobileNetV2 and Vision Transformer extract high-dimensional feature embeddings. A fuzzy commitment scheme maps variable biometric features to a stable key space. PBKDF2 hardens the derived key for cryptographic use.
Tech Stack
Computer Vision
Machine Learning
Cryptography
Engineering Challenges
Biometric Variability
Facial features vary with lighting, angle, and expression. The key derivation must produce the same output despite this natural variance — solved with fuzzy commitment schemes.
Feature Stability
Getting consistent feature embeddings across captures required careful normalization, alignment, and model selection.
Security vs Usability
Increasing fuzzy tolerance for usability reduces cryptographic security. Finding the right threshold required extensive testing.
Development Process
- 01Researched biometric key derivation literature and fuzzy commitment schemes
- 02Built face detection and normalization pipeline with OpenCV
- 03Evaluated multiple ML models for feature embedding quality
- 04Selected MobileNetV2 + Vision Transformer for embedding extraction
- 05Implemented fuzzy commitment scheme for variable-to-stable key mapping
- 06Applied PBKDF2 key hardening on derived values
- 07Tested recognition accuracy and key consistency across varied conditions
Key Features
Face Detection & Normalization
OpenCV detects and aligns face regions to a canonical orientation before feature extraction.
Deep Feature Extraction
MobileNetV2 and Vision Transformer produce rich, high-dimensional embeddings capturing unique facial geometry.
Fuzzy Key Derivation
Fuzzy commitment scheme bridges the gap between variable biometrics and deterministic cryptographic keys.
Key Hardening
PBKDF2 applies cryptographic hardening to the derived key before use.
Implementation Details
The pipeline processes captured face images through alignment, embedding extraction, and commitment scheme stages. The fuzzy commitment maps the high-dimensional embedding to a fixed error-correcting code space, producing a stable binary string from which PBKDF2 derives the final key. Enrollment stores only the commitment, not the raw biometric.
Future Improvements
- Explore liveness detection to prevent spoofing attacks
- Test with larger biometric datasets for robustness validation
- Research integration with hardware security modules
- Evaluate as a second factor alongside traditional authentication
Lessons Learned
Biometric systems must be designed for revocability — if a key is compromised, you need a way to re-enroll
The gap between research-quality accuracy and production-quality reliability is enormous
Fuzzy cryptography is a fascinating field with real practical applications beyond biometrics