Biometric authentication offers enhanced usability for digital payments, but traditional centralized architectures suffer from single points of failure. While blockchain integration promises decentralized trust, existing solutions often store biometric helper data (e.g., fuzzy commitments) directly on-chain. We demonstrate that such transparency, even in permissioned settings, exposes low-entropy biometric inputs to offline brute-force attacks and identity-linkage risks if the immutable ledger is accessed by malicious nodes. To resolve this transparency–privacy paradox, we propose a threshold-based decentralized authentication framework. Unlike prior works, our protocol keeps all sensitive Biometric-Enhanced Key Derivation (BEKD) tokens entirely off-chain, using the blockchain solely for freshness enforcement. We provide a game-based security analysis of brute-force resistance, unforgeability, and unlinkability. Our experimental results demonstrate that our scheme’s gas cost is acceptable, offering a robust solution for self-sovereign biometric identity.
- Open Access
- Article
Decentralized Biometric Authentication via Threshold-Based Key Derivation †
Author Information
Received: 01 May 2026 | Revised: 20 Jul 2026 | Accepted: 04 Aug 2026 | Published: 11 Aug 2026
Abstract
Keywords
biometric authentication | blockchain | smart contracts | decentralization | brute-force attacks
References
- 1.
Ogbanufe, O.; Kim, D.J. Comparing fingerprint-based biometrics authentication versus traditional authentication methods for e-payment. Decis. Support Syst. 2018, 106, 1–14. https://doi.org/10.1016/j.dss.2017.11.003.
- 2.
Nasution, M.I.P.; Nurbaiti, N.; Nurlaila, N.; et al. Face Recognition Login Authentication for Digital Payment Solution at COVID-19 Pandemic. In Proceedings of the 2020 3rd International Conference on Computer and Informatics Engineering (IC2IE), Depok, Indonesia, 15–16 September 2020; pp. 48–51.
- 3.
Ryu, R.; Yeom, S.; Kim, S.H.; et al. Continuous Multimodal Biometric Authentication Schemes: A Systematic Review. IEEE Access 2021, 9, 34541–34557. https://doi.org/10.1109/ACCESS.2021.3061589.
- 4.
Abo Alzahab, N.; Rafaiani, G.; Battaglioni, M.; et al. BiometricIdentity dApp: Decentralized Biometric Authentication Based on Fuzzy Commitment and Blockchain. SoftwareX 2024, 28, 101932. https://doi.org/10.1016/j.softx.2024.101932.
- 5.
Sharma, S.; Saini, A.; Chaudhury, S. Multimodal Biometric User Authentication Using Improved Decentralized Fuzzy Vault Scheme Based on Blockchain Network. J. Inf. Secur. Appl. 2024, 82, 103740. https://doi.org/10.1016/j.jisa.2024.103740.
- 6.
Haleem, A.; Ben Jabra, S.; Meddeb, A. Survey on IoT Security Using Biometrics and Blockchain Technology. Multimed. Tools Appl. 2026, 85, 15. https://doi.org/10.1007/s11042-026-21279-6.
- 7.
Bernabe, J.B.; Canovas, J.L.; Hernandez-Ramos, J.L.; et al. Privacy-preserving solutions for blockchain: Review and challenges. IEEE Access 2019, 7, 164908–164940.
- 8.
Aggarwal, S.; Kumar, N. Chapter Twenty—Attacks on Blockchain. In The Blockchain Technology for Secure and Smart Applications across Industry Verticals; Advances in Computers; Aggarwal, S., Kumar, N., Raj, P., Eds.; Elsevier: Amsterdam, The Netherlands, 2021; Vol. 121, pp. 399–410.
- 9.
Rathgeb, C.; Uhl, A. Statistical attack against iris-biometric fuzzy commitment schemes. In Proceedings of the 2011 IEEE Computer Society Conference on Computer Vision and Pattern Recognition Workshops (CVPR Workshops), Colorado Springs, CO, USA, 20–25 June 2011; pp. 23–30.
- 10.
Politou, E.; Casino, F.; Alepis, E.; et al. Blockchain mutability: Challenges and proposed solutions. IEEE Trans. Emerg. Top. Comput. 2019, 9, 1972–1986.
- 11.
Zhang, S.; Yan, Z.; Liang,W.; et al. BAKA: Biometric Authentication and Key Agreement Scheme Based on Fuzzy Extractor forWireless Body Area Networks. IEEE Internet Things J. 2024, 11, 5118–5128. https://doi.org/10.1109/JIOT.2023.3302620.
- 12.
Boldyreva, A.; Mohan, D.I.; Tang, T. May the Force Not Be With You: Brute-Force Resistant Biometric Authentication and Key Reconstruction. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security (CCS ’25), Taipei, Taiwan, 13–17 October 2025; pp. 3620–3634.
- 13.
Cui, H.; Yang, X.; Yang, W.; et al. Token-Based Biometric Enhanced Key Derivation for Authentication Over Wireless Networks. IEEE Trans. Netw. Sci. Eng. 2023, 10, 2347–2357. https://doi.org/10.1109/TNSE.2023.3246439.
- 14.
Zhang, S.; Yan, Z.; Liang, W.; et al. BCAE: A Blockchain-Based cross Domain Authentication Scheme for Edge Computing. IEEE Internet Things J. 2024, 11, 24035–24048. https://doi.org/10.1109/JIOT.2024.3387934.
- 15.
Ferrag, M.A.; Derdour, M.; Mukherjee, M.; et al. Blockchain Technologies for the Internet of Things: Research Issues and Challenges. IEEE Internet Things J. 2019, 6, 2188–2204. https://doi.org/10.1109/JIOT.2018.2882794.
- 16.
Gennaro, R.; Goldfeder, S. Fast Multiparty Threshold ECDSA with Fast Trustless Setup. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security (CCS ’18), Toronto, ON, Canada, 15–19 October 2018; pp. 1179–1194.
- 17.
ISO/IEC 24745:2022; Information Security, Cybersecurity and Privacy Protection—Biometric Information Protection, Ed. 2. ISO/IEC JTC 1/SC 27. ISO: Geneva, Switzerland, 2022; 63 pages.
- 18.
Simoens, K.; Bringer, J.; Chabanne, H.; et al. A Framework for Analyzing Template Security and Privacy in Biometric Authentication Systems. IEEE Trans. Inf. Forensics Secur. 2012, 7, 833–841. https://doi.org/10.1109/TIFS.2012.2184092.
- 19.
Wang, M.; Rui, L.; Yang, Y.; et al. A Blockchain-Based Multi-CA Cross-Domain Authentication Scheme in Decentralized Autonomous Network. IEEE Trans. Netw. Serv. Manage. 2022, 19, 2664–2676. https://doi.org/10.1109/TNSM.2022.3180357.
- 20.
Mehrabi, M.A.; Doche, C.; Jolfaei, A. Elliptic Curve Cryptography Point Multiplication Core for Hardware Security Module. IEEE Trans. Comput. 2020, 69, 1707–1718. https://doi.org/10.1109/TC.2020.3013266.
- 21.
Kanth, V.; Hale, B. Blockchain-Based Authenticated Stego-Channels and Application to Ethereum. IEEE Trans. Dependable Secure Comput. 2025, 22, 373–387. https://doi.org/10.1109/TDSC.2024.3399696.
- 22.
Wang, C.; Chen, Y.; Liu, F.; et al. Mixture of Gaussian-Distributed Prototypes with Generative Modelling for Interpretable and Trustworthy Image Recognition. IEEE Trans. Pattern Anal. Mach. Intell. 2025, 47, 6974–6989. https://doi.org/10.1109/TPAMI.2025.3566425.
This work is licensed under a Creative Commons Attribution 4.0 International License.
Suite 4002 Level 4, 447 Collins Street, Melbourne, Victoria 3000, Australia
General Inquiries: info@sciltp.com