Alexandra Boldyreva
Georgia Institute of Technology, GA·Computer Science
Most cryptography rests on a secret key that an attacker cannot guess, because trying every possible key would take millions of years. That assumption breaks when the key is derived from something human for convenience: a password, or a biometric such as a fingerprint or facial features.
- Fields
Computer Science
Mathematics & Statistics
- Topics
cryptography
biometric authentication
brute-force attacks
- Grants
- 1 known grant, through Jun 2028
What they work on
- Design a biometric-based authentication and key reconstruction protocol that is highly resistant to brute-force (exhaustive search) attacks on fingerprint or facial data.
- Specify a formal security model capturing strong adversarial capabilities and prove the proposed biometric protocol secure within that model.
- Implement the protocol on concrete biometric datasets and tune its parameters to achieve acceptable recognition precision alongside target security levels.
- Extend the approach to a brute-force-resistant, biometric-based authenticated key exchange protocol that lets two parties establish a shared key while verifying identity.
More about the research
The set of possibilities is small enough that an attacker can simply test them all, a brute-force or exhaustive search attack; fingerprints used to unlock phones have been brute-forced in minutes. Passwords have partial defenses, but adapting them to biometrics is not straightforward, and biometrics matter more because, unlike a password, a fingerprint cannot be changed after it leaks.
Why it matters
Biometric authentication is now widespread in phones and other systems, yet fingerprints and facial data cannot be reissued once compromised. Protocols with proven resistance to brute-force attacks, implemented and tuned on real biometric datasets, could make biometric login and key management substantially harder to break, benefiting anyone whose devices or accounts rely on biometric security.
Known grants
From NIH and NSF research grants. Labs often have other funding we can't see.
Closest labs
Jiayu Xu
Oregon State University, OR·Computer Science
Re-analyze real-world asymmetric password-authenticated key exchange (aPAKE) protocols, which let a client prove a password without the server storing it, to test whether their contrived security definitions are necessary or whether standard notions suffice.
Michael Collins
University of Southern California, CA·Computer Science
Develop an intrusion detection approach in which organizations diagnose suspicious events by posing targeted queries about other organizations' operational state.
Jason LeGrow
Virginia Polytechnic Institute and State University, VA·Computer Science
Construct post-quantum blind signatures, threshold signatures and multisignatures based on lattices, error-correcting codes and group actions such as isogenies, maps between elliptic curves.
The school
Georgia Institute of Technology: 50 labs on PI Pages, $1.5B a year on research, 572 research doctorates a year.
Reach out
A start for your email. Fill in the brackets.