Bitcoin Forum

Hello,

I was wondering if there is any way for me to create a private key using only my fingerprint and a password. Do you guys know if there is already a website to do so ?

Thanks.

i wouldnt create my private key on any kind of website because most likely i would get scammed

That is a pretty cool idea, I have not heard of anyone doing this yet. The biggest thing is how much Entropy a Fingerprint actually has. Some quick research shows that it should be possible to generate a series of numbers from a fingerprint 'reproducibly'. If you set a specific % matching thresholds 'noise' in the software capturing the fingerprint, lowering the threshold to generate a number from a fingerprint does reduce the amount of entropy available. Some estimates 40 - 80 Bits of Entropy. Kind of a wide range, but should still be large enough source for private key generation.

Here is some information posted a year ago by someone that is relevant:
http://www.reddit.com/r/crypto/comments/1fpobr/how_many_bits_of_security_in_a_fingerprint_as_in/
Enhancing security and privacy in biometrics-based authentication systems - http://www.cedar.buffalo.edu/~govind/CSE717/papers/CancelableBiometrics.pdf
How to Generate Strong Keys from Biometrics and Other Noisy Data - http://www.cs.bu.edu/~reyzin/fuzzy.html

Edit: Fixed Spelling

It's not really an useful way to do this. Any website that offers this could scam you (anyone that knows your priv key can steal from you). A vanity gen based on fingerprint and password would have to run on a computer. And then you'll have to rely on a 3rd party app (prolly on your phone / tablet) that will read the fingerprint, then transfer that data on the computer where another program will take that data to generate the "private key". Who would use that?!

I mean, of course we cant rely on a website. I just would like to know if there is someone already working on this idea.

I doubt there is any serious work beeing done in that direction. The main problem with fingerprints is that you leave them literally everywhere. Every glass you use could be used to gather your fingerprints. You would end up with a private key which is only protected by a password. We already got that, its called a brainwallet.

The idea would be to create the private key using the fingerprint associated with a small paraphrase, so we can achieve a good  entropy without needing to remember 12 random words.

That makes sense, it definitely isnt a safe way to store a private key. I was trying to think about someway to store a private key without the need of writing things somewhere(that can get lost) or of remembering long paraphrases.

Are you asking about a PGP fingerprint or the print that one of your fingers leaves behind? If it was the former then sure, but I would just make sure that the password is very strong as you would essentially be creating a brain wallet with a bunch of random numbers/letters in the beginning. I would think the risk of a brain wallet farmer trying to hack a brainwallet with a PGP fingerprint in the prefix is somewhat small because there are so many PGP keys out there, and you wouldn't even need to necessarily need to use one that is found on a keys sever anywhere.

If you wanted to use the print that your finger leaves behind then there would be a number of risks and would probably not be a good idea. The primary drawback is that you will need some kind of specialized hardware to convert a portion of your fingerprint into a number, and if the manufacturer of such hardware were to go out of business then there would be a good chance that you would lose access to your Bitcoin.

If the people behind, say armory, or electrum were to disappear then as long as you have the unencrypted seed and the formula (code) that armory uses to calculate each new private key then you can still calculate your private keys and access your Bitcoin.

I don't think that people realize that this is actually a very bad idea. You could get amnesia, some form of dementia e.g. early onset Alzheimer's.
As for OP using a fingerprint is not safe. You leave so many fingerprints everywhere. One could easily follow you and extract one (if you live in a crowded city) without you noticing it.

I would be worried not only about creating it online, but the inherent security of finger print scanners. I bought one to experiment with security for my laptop. It was cool. But once it was working properly the hacker in me set out to defeat it. Unfortunately it was easy. I lifted my print from a drinking glass with Scotch tape and pencil lead dust (not even superglue vapor). I placed the tape on a different finger and scanned it. It was far too easy.  :-\

I burnt my finger on a wood stove... my lappy reader had difficulty reading the print.

I don't see how could this be useful. I only see fingerprints useful to access funds, and we already have that (things like TouchID).

For key generation it would probably be more useful to use things that aren't easily accessible, such as a retina scan. Now that would be nice, either for generation or accessing funds :)

Oh creating a private key with your fingerprint is an awesome idea! I wonder if it will be possible one day?

using fingerprint as a private key is a very bad idea for bitcoin users. there's more than one way for someone to "steal" your fingerprints, and staying anonymous will be very hard as you can be identified with your fingerprint alone.

it would be a very bad idea to use a site to secure or create private keys via the internet. that's asking for problems. finger print security is not as secure as many think. you can easily get around it. search on youtube and you'll find out how.

Starbug only needs a picture of your finger[1][2]. Its incredible that this is still a "security" mechanism in passports.


See above or here[3], thats no better.


I think the point was to find something that can not be lost and not be forgotten easily. Both is true for the finger, even though you might lose the prints you still have the original finger as long as you dont burn or cut yourself. I think OPs idea was the reduce the strength of the passphrase (e.g. a HD wallet seed) and make up for the loss of security with the finger print. Thus its easier to remember than a seed alone, but still as secure.


[1] sorry german -> http://media.ccc.de/browse/congress/2014/31c3_-_6450_-_de_-_saal_1_-_201412272030_-_ich_sehe_also_bin_ich_du_-_starbug.html#video
[2] english article -> http://arstechnica.com/security/2014/12/politicians-fingerprint-reproduced-using-photos-of-her-hands/
[3] http://www.forbes.com/sites/thomasbrewster/2015/03/05/clone-putins-eyes-using-google-images/

Im waiting to see this type of integration with the software launchkey https://launchkey.com/

My favorite fingerprint hack is the fake finger made out of gummy bears.

http://www.theregister.co.uk/2002/05/16/gummi_bears_defeat_fingerprint_sensors/

That's exactly my point, thanks for explaining it better.

Then you will need to wear private key gloves which would make it even cooler  8)

Well, why only finger prints? ..... What about retina scanners? or something linked to our DNA? There are some very cool biometric scanners out there.  ;D

Do not shoot down a idea, because of the flaws in the current technology.  ;) .... If you carry your Trezor {hardware wallet} with your built in finger print scanner with you... and it generates your private key from one of your fingers and use that finger to authenticate the device... you might have something special.  ;D

I think it's a cool idea, but the implementation should be rock solid and preffably offline on a hardware wallet.  8)

IIRC urine samples are unique and unlike gloves can not be forgotten or lost. Youd have a similar problem as with the fingerprints though, people need to urinate and the circumstances might not be secure for "dumping" your private key seed into the wilderness. Seed reminds me, sperm samples probably also work. The need to spread them in public or unintentional is usually limited. To keep the system available for everyone, how about blood samples?


I think it would certainly be possible, the question is whether someone actually wants to pay with their blood in order to keep their coins safe. A typical problem with biometrics still stands and that is: you cant change it. Once your fingerprint/retina scan/sperm/vaginal fluid/blood sample is leaked you cant get a new one. I still think passwords stored in memory or a password database (which in turns needs a password stored in memory) is the way to go. Keep backups digital and physical in secure locations and even if you should have problems with your memory you have a place where you can look. Well unless you forget about that place as well...

Not secure! A hacker named starburg from chaos computer club in Germany showed last year on a hacker congress how easy it is to obtain Iris pics (with normal digital camera) and fingerprints of politicians for instance and to misuse it and to break security barriers.

http://www.theregister.co.uk/2014/12/29/german_minister_fingered_as_hackers_steal_her_thumbprint_from_a_photo/ (http://www.theregister.co.uk/2014/12/29/german_minister_fingered_as_hackers_steal_her_thumbprint_from_a_photo/)

And in german if you like: http://www.heise.de/security/meldung/31C3-CCC-Tueftler-hackt-Merkels-Iris-und-von-der-Leyens-Fingerabdruck-2506929.html (http://www.heise.de/security/meldung/31C3-CCC-Tueftler-hackt-Merkels-Iris-und-von-der-Leyens-Fingerabdruck-2506929.html)

Keep in mind that your biometric data is not necessarily private. For example, my former employer already has one of my thumbprints and my retina scans of both eyes on file because I needed access to an area secured by biometric scanners. I am not sure what their data retention policies are for employee records, but I am not trusting them 100% that they won't share or leak this data at some point in time.

The idea is actually pretty cool. I could see it being used as one of the factors of authentication. Fun to think about ... maybe hopefully some work will be done in this direction. Nice one!

Exactly what I was thinking. Some people even lose some fingers or thumb in accidents. I won't risk my Bitcoins with this.

Just make it as simple as possible. I was thinking why not store your private key in a word file and then use a fingerprint security locking program on that file meaning that the file can only be accessed once it has scanned your fingerprint and confirm it is you. Much safer than using a program written specifically to calculate and determine private key based on a set of formula derived from your fingerprint image.

I agree with all the points against the idea of the fingerprint. However, I am still interested in finding a solution for me main problem:

How to store a safe private key without the need of writing or remembering anything ?

I believe both the fingerprint and iris scanner could achieve the conditions above if it wasn't so easy for other people to access. I would love to see some other suggestions.

Thanks.

You could use it as a seed to generate a private key, yeah. The question is: Is the entropy high enough (most likely yes), is the function creating a seed from your characteristics safe (could be)? Oh and pay attention not to get your fingerprint stolen. Biometrics generally are pretty bad security tokens.

You leave your fingerprints everywhere so it wouldn't be very secure.

Discussion on creating keys using fingerprints:

http://crypto.stackexchange.com/questions/16370/generating-encryption-keys-from-biometric-fingerprint-templates

i could see biometric security taking place in the future side by side with bitcoin

retina scanning for private key, would be pretty cool indeed and better than fingerprint