New research in the Netherlands uses cameraphone images to generate biometric data, in order to authenticate users on ad-hoc mobile networks. If you want to use a PDA or other device, just take a couple pictures, the system scans your face and you’re set to go.

Biometric data is generally regarded as being ill-suited for cryptography: each measurement, even when taken by the same device, of the same feature on the same person will differ slightly. This noise in the data makes it difficult to extract a cryptographic key in the traditional sense. Other recent work has shown that it’s possible to use just the noise in a biometric measurement to generate a cryptographic key—the new method relies on this principle.

Researchers put together a system that can be implemented on any device equipped with a camera. Facial recognition software is then used to produce biometric measurements of a person’s face, which should stay constant through changes in hairstyle, makeup, etc. Users take a picture of themselves, then uses a random string that, combined with the biometric information, forms the equivalent of a public key.

When two people need to establish a connection between their devices, they exchange these public keys, and each then takes a picture of the other device’s owner. The biometric data from this new picture is used to try to extract the random string from the public key.

It sounds a little like social networking in the cryptography world — and a bit hairier than just using a password. Do you think it’s a good idea?

Read the full article here.