Expert claims government could share school fingerprint data

Many of the discussions on this subject mention "hashing" the biometric. That is not what manufacturers claim, and security folks often presume biometrics systems are more advanced than they are.

The article says the data cannot be used to reconstruct the fingerprint. This obscure phrasing is common among biometric vendors. It is almost certainly means its using fingerprint minutiae, i.e. the critical features. This is the core representation used in AFIS and many other finger-print matching systems (matching images is too slow).

These minutiae cannot use be used to uniquely reconstruct the original fingerprint, though infinitely many consistent fingerprints can be generated, any one of which would match the original in a minutiae-based matcher.

In general, you cannot hash biometrics because the natural variations mean they are not exactly alike and a traditional hash would take the minor variations and make them impossible to match. My research team at work at the University of Colorado at Colorado Springs is developing revocable fingerprint transforms, but they won't be in commercial products until the autumn.

The library spokesman was probably just repeating the line passed on from the vendor, indented to make people feel its more private and/or safer. Minutiae-based templates can be easily reused by the government, and there is an official interchange standard (M1) to help ensure systems can share and inter-operate on these forms. Cross system exchange tests are currently being done at NIST, to ensure one company's templates work well in other peoples' matching.

Terrance Boult, University of Colorado, Colorado Springs
(posting on Bruce Schneier's security website).