Biometrics

19.0 What this chapter gives you#

1. You will be able to explain what a fingerprint reader actually stores, why it is not a picture, and what is in the small file it keeps instead.
2. You will be able to name the two features every fingerprint system is built on, say exactly where on the ridge each one sits, and name the standard that defines that placement and the units it uses for the angle.
3. You will be able to explain why a biometric comparison produces a number rather than a decision, draw the two overlapping distributions of numbers that result, and point to the single value that turns one into the other.
4. You will be able to read a detection error trade-off curve from a real published report and explain why moving along it trades one person’s inconvenience for another person’s break-in.
5. You will be able to define false match rate, false non-match rate, equal error rate, failure to enrol and failure to acquire without confusing any of them, and say which one quietly excludes people.
6. You will be able to say what a presentation attack is, what ISO/IEC 30107-3 measures, and what a laboratory certificate does and does not promise.
7. You will be able to say why a stolen fingerprint template differs from a stolen password, what the 2015 United States Office of Personnel Management disclosure means for the people in it, and what cancellable biometrics is trying to fix.
8. You will be able to describe a fuzzy commitment, a fuzzy vault and a fuzzy extractor in plain terms, and name the published attack that broke the most popular of them.
9. You will be able to explain the difference between matching on a card, on a device and in a central database, and argue for one of them on the grounds of what an attacker gets when the store is breached.
10. You will be able to set a threshold for a real deployment and defend the choice with arithmetic rather than with a feeling.

A password is a secret you can change. That single property does more work than almost anything else in this book: it is why a breach is survivable, why rotation is possible, why a leak has an end date. Take it away and everything downstream changes. A fingerprint cannot be changed. Neither can an iris, a face, the shape of a hand, the ridges on a palm or the pattern of veins in a finger. You get ten fingers, two eyes and one face, and when the data taken from them leaks, it stays leaked for the rest of your life.

That is the first of three things this chapter is about. The second is that a biometric is not read, it is measured. A password either is or is not the right password: the comparison is exact and the answer is a bit. A finger placed on a sensor produces a slightly different image every single time, because the finger is wet or dry or cold, because it was rolled a few degrees further to the left, because there is a new cut across the second joint, because the platen has yesterday’s grease on it. The system is not looking things up. It is estimating, from two noisy measurements, whether they came from the same piece of skin.

The third thing is what follows from the second. Because the comparison is an estimate, its output is a number, and because it is a number, somebody has to decide how big the number must be. That person is not a mathematician discovering a truth. That person is an engineer, a product manager or a procurement officer choosing a point on a curve, and every point on that curve buys security for one group of people at the direct cost of exclusion for another. The curve is public and published. The choice is usually not.

Put the three together and you have the sentence this chapter defends: a biometric is a password you cannot change, measured by a sensor that is guessing, compared by a threshold someone chose. The chapter before this one, “The Second Factor That Is Not”, dealt with second factors that fail against a live attacker. Faces and voices have their own chapter, chapter 20, “Face and Voice”, because face recognition has two entirely different modes with entirely different error behaviour and deserves the room. Here we work almost entirely with fingerprints, because fingerprints are the oldest, the best measured, the most standardized and the most honestly documented biometric there is, and every lesson from them transfers.

The plain version#

A fingerprint is a map of where the lines stop and split#

Look at the pad of your index finger under a bright light. You will see raised lines, called ridges, running in curves and loops, with valleys between them. Two things happen to those lines. Sometimes a line simply stops, the way a country lane comes to a dead end at a field. Sometimes a line splits into two, the way a lane forks around a church.

Those two events, the stop and the fork, are the whole basis of fingerprint matching. There are roughly a hundred of them on a typical finger, scattered in no pattern anybody can predict. Where they sit, and which direction the line was pointing when it stopped or forked, is the thing a fingerprint reader records.

So imagine drawing a map of a small district and, instead of drawing the roads, writing a list like this: “dead end at 117 metres east, 241 metres north, road pointing north-east; fork at 212 east, 90 north, pointing west; dead end at 88 east, 340 north, pointing south.” Thirty or forty lines of that, and you have described the district well enough that nobody could mistake it for another district, without ever drawing the roads.

That list is what your phone or the office door keeps. Not the picture. The list.

Why nobody keeps the picture#

There are three reasons, and they are worth having straight because people get them backwards.

The first is size. A picture of a finger at the resolution the police use is a few hundred thousand dots. A list of forty stops and forks is a few hundred numbers. On a small chip inside a door lock or a bank card, that difference decides whether the thing is possible at all.

The second is speed. Comparing two pictures dot by dot is slow and, worse, useless, because the second picture is never lined up with the first. Comparing two lists of points is a geometry problem a small computer can do thousands of times a second.

The third reason is the one everybody repeats, and it is the one that needs care. People say the list is kept “because you cannot get the picture back from it”. That is partly true and it is not a guarantee, and we will come back to it properly, because the difference between “hard to reverse” and “impossible to reverse” is the difference between a comfortable slogan and an actual security property.

The machine does not answer yes or no, it answers a number#

Here is the part almost nobody is told.

When you put your finger on the reader, it makes a fresh list of stops and forks, takes the list stored when you enrolled, and tries to lay the two on top of each other. It slides one list sideways and up and down, and turns it, hunting for the arrangement in which the most points from one land close to points from the other. Then it counts how many landed close, weighs them by how confident it is about each, and produces a single number.

That number is called a score. A high score means the two lists agree well; a low one means they do not. The system does not know whether it is the same finger. It knows a number.

Now think about what scores look like across many comparisons. Compare a person’s finger with their own stored list a thousand times and the thousand scores are scattered: mostly high, some middling because the finger was damp that day, a few surprisingly low because it was placed half off the edge of the sensor. Compare a thousand strangers’ fingers against that same stored list and you get a thousand more, mostly low, but a few uncomfortably high, because some strangers happen to have a run of stops and forks in similar places.

Two piles of numbers, then. The genuine pile, centred high. The impostor pile, centred low. And here is the whole problem in one sentence: the two piles overlap.

Somebody has to choose where to draw the line#

Because they overlap, no line you draw separates them cleanly.

Draw the line low, so that any modest score counts as a match, and every genuine person gets in easily. So do a handful of strangers whose scores happened to land high.

Draw the line high, so that only very strong agreement counts, and no stranger ever gets in. So the man with the damp finger, the woman whose thumb is scarred from a kitchen accident, the fitter whose fingertips are worn smooth from forty years of metal, all get refused, again and again, at a door they are entitled to walk through.

There is no setting that avoids both. There is only a dial, and turning it moves error from one group of people onto another group of people. The whole engineering discipline of biometrics is the study of that dial.

Two words for the two mistakes. When a stranger’s score lands above the line and the system lets them in, that is a false match. When a genuine person’s score lands below the line and the system refuses them, that is a false non-match. Notice that these are opposite failures and that they are measured in completely different places: false matches show up in a fraud report, and false non-matches show up as a person standing outside a door.

The same finger is never the same finger twice#

The reason the genuine pile is scattered rather than a single value deserves its own moment, because it is the difference between this and a password.

Press your thumb on a window, then press it again beside the first mark. The two marks are not the same. You pressed slightly harder the second time, so more of the ridge touched the glass and the lines look fatter. You rolled a few degrees. There was more moisture on your skin the first time. A fold of skin at the edge flattened out differently.

A sensor sees all of that. It is trying to find where ridges stop and fork in a grey, smudged, partial image of a curved object squashed against a flat surface. On a wet finger two neighbouring ridges can blur into one and the machine reports a fork that is not there; on a dry finger a ridge can break where it does not really end and the machine reports a stop that is not there. These are not bugs. They are what measurement is.

So the list is different every time. Not wildly, but enough that “does the new list equal the old list” always has the answer no, for everybody, which is exactly why the answer has to be a score.

There is a slower version of the same problem. Skin changes. Manual work wears ridges down, some medicines and illnesses affect the skin of the fingertips, and a child’s fingers grow. The list made five years ago describes a finger that no longer exists in quite that form, and the scores drift down.

A worked example: one door, five thousand people#

Let us carry one example all the way through, and keep it for the rest of the chapter.

A manufacturing company in Ludhiana has one entrance with a fingerprint reader. Five thousand people work there across three shifts, each pressing a finger on arrival and on leaving, so about ten thousand comparisons happen every working day. One of those people is Anwar, who has run a metal lathe for twenty-two years and whose fingertips are worn almost smooth.

The supplier gives them a dial, and says that at the middle setting a stranger has about one chance in ten thousand of being accepted, and a genuine worker about one chance in two hundred of being wrongly refused.

Take the second number first, because it is the one nobody costs. One in two hundred across ten thousand presses a day is fifty refusals a day: fifty people standing at a door pressing again. Most get in on the second try, so the pain is small, spread thin, and never appears in any report. But it is not spread evenly. It falls overwhelmingly on the same few hundred people, the ones with worn or scarred or dry hands, who are refused not once a month but several times a week, and who learn to arrive early and bring a supervisor. Anwar is one of them.

Now the first number. One chance in ten thousand sounds alarming next to ten thousand presses a day, and people conclude a stranger walks in daily. That is wrong, and the reason matters. The reader is not comparing each press against five thousand records. Anwar taps his employee card first, so the reader compares his finger against Anwar’s record only. The one-in-ten-thousand figure describes what happens when somebody who is not Anwar deliberately presents a finger while claiming to be Anwar, and that happens as often as somebody actually tries it, which might be never in a year. The distinction between comparing against one record and comparing against all of them changes the arithmetic completely, and for faces it is the whole subject of chapter 20.

Now the company turns the dial. Under pressure after a theft they set it stricter: a stranger’s chance drops to one in a hundred thousand, and the genuine refusal rate rises from one in two hundred to about one in a hundred, which is a hundred refusals a day instead of fifty. For most staff it is invisible. For Anwar it means being refused most mornings. Within a month the supervisor is waving him through on sight, and the reader has stopped protecting that door at all.

That is the shape of the thing. The dial does not remove error. It moves error onto somebody else, and if you move it far enough, people route around it, and then the system is theatre.

The one thing you cannot do#

Everything so far applies to any measuring system. Here is what makes biometrics different from every other credential in this book.

Suppose the company’s computer is broken into and the file of five thousand stored lists is taken. With passwords, the response is unpleasant but bounded: everyone changes their password, and the stolen file becomes worthless. With door keys, you rekey the locks. With bank cards, you reissue.

With fingerprints there is nothing to reissue. Anwar has ten fingers. If his index finger’s record is stolen he can enrol a different finger, and he can do that nine more times, and then he is finished, permanently, for every fingerprint system on earth, for the rest of his life. He is fifty-one years old. He will be dealing with this at eighty.

And unlike a password, he was leaving copies of the credential itself on every glass, doorknob and tool handle he touched, long before anybody broke into anything.

That is the sentence to carry away from the plain half. A password is a secret you can change. A biometric is a measurement of your body that you cannot change, cannot hide, and did not choose.

Where the plain version stops being true#

“You cannot get the picture back” is a claim, not a theorem#

The plain version said the stored list is not a picture. True. It then said, and people always say, that you cannot get the picture back from the list. That is where the comfort runs ahead of the mathematics.

The honest version: a minutiae list is a lossy summary, but it summarizes exactly the features the ridges are organized around, and reconstructing a plausible fingerprint image from one is published work, not an open impossibility. Raffaele Cappelli, Dario Maio, Alessandra Lumini and Davide Maltoni published “Fingerprint Image Reconstruction from Standard Templates” in IEEE Transactions on Pattern Analysis and Machine Intelligence, volume 29, number 9, September 2007, pages 1489 to 1503. Their reconstructions are not photographs of the original finger. They do not need to be. They need only to score above a threshold.

So the correct statement is narrower and more useful: a standard minutiae template does not let you print a picture of somebody’s finger, but it can let you build something a matcher will accept as that finger. That is why ISO/IEC 24745, the standard on protecting this data, treats irreversibility as a property a system must be engineered to have, not one templates naturally possess.

The score is not a probability#

The plain version called the output a score and left it there. People then treat the score as a percentage of confidence, and vendors encourage it by printing scores out of a hundred.

The honest version: a comparison score is an arbitrary number on an arbitrary scale, defined only by the algorithm that produced it, and it is not comparable between two products, between two versions of one product, or in some cases between two data sets run through the same product. In the public NIST evaluation we will meet shortly, the threshold values printed alongside the curve for one submission are negative numbers running from about minus one half to about minus seven, and they mean nothing outside that submission. A score of 60 from one supplier is not better than a score of 40 from another, and no score is the chance that this is the right person.

The consequence is that the only way to know what a threshold buys you is to measure it on data that resembles your population, because the same threshold on the same product gives different error rates on different data. We will see exactly that, with published numbers, in the technical half.

“One in fifty thousand” is not the chance a stranger opens your phone#

Apple states that the probability of a random person’s fingerprint matching a Touch ID enrolment is 1 in 50,000 with a single enrolled finger, and that the probability of a random person unlocking a device by Face ID is less than 1 in 1,000,000. Those figures are honest and they are routinely misread.

The honest version: they are figures for a random person, not for a determined attacker, and they are per comparison at a fixed number of attempts. Apple’s own documentation notes that Touch ID allows only five unsuccessful attempts before a passcode is required, and it is that limit, not the one in fifty thousand, that does most of the work. An attacker who is not random, who has your finger on a glass, who has a photograph of your face, or who is your sibling, is outside what the number describes entirely.

There is a second misreading. Enrol two fingers instead of one and the chance that a random person matches either of them roughly doubles. Every convenience that widens the acceptance set widens the attack surface by the same amount.

The two errors in the plain version are not the only two#

The plain version gave you false match and false non-match, which are the errors of comparison. There are two more, they happen before any comparison at all, and between them they cause more real-world harm than either of the first two.

Failure to acquire is when the sensor cannot get a usable image at this attempt: the finger is too dry, too wet, too lightly placed, too dirty, or the sensor surface is scratched. Failure to enrol is when the system cannot make a usable record from a person at all, at any attempt, on any day. Anwar with his worn fingertips is a failure-to-enrol candidate, and so is a person with certain skin conditions, an elderly person with shallow ridges, a bricklayer, a hairdresser who handles chemicals, a person who has lost a hand.

The honest version: the failure-to-enrol rate is the number that determines who the system excludes, and it is the number most often left out of vendor literature and out of procurement. In India’s Aadhaar programme, the National Economic Survey for 2016 to 2017 recorded, on page 202, biometric authentication failure rates that included 49 per cent in Jharkhand and 37 per cent in Rajasthan, alongside 6 per cent in Gujarat and 5 per cent in Krishna district in Andhra Pradesh, and observed that failure to identify genuine beneficiaries results in exclusion errors. Whatever one thinks of the programme, and its governance is the business of Volume V of this book, the arithmetic there is the arithmetic of every biometric system, only visible because the population is a billion people rather than five thousand.

The threshold is not one number, it is a policy with a business behind it#

The plain version said somebody chooses the threshold. It is worth being blunt about who and why.

The honest version: in most products the threshold is set by the supplier, shipped as a default, described in marketing as “high security” or “convenience”, and almost never re-measured against the buyer’s actual population. The supplier’s incentive is not neutral. A product that refuses genuine users generates support calls, returns and bad reviews within days. A product that accepts the occasional impostor generates a report in eighteen months, if ever, and probably not one that names the product. The pressure on the dial is one-directional and it points at looser.

Standards bodies push back by writing floors. As of August 2026, the FIDO Alliance’s biometric certification requirements version 4.1, dated 6 January 2025, define levels with explicit numbers: a laboratory-tested false accept rate of 1 per cent at BioLevel 1 and 0.01 per cent at BioLevel 1 plus, with false reject rates of 7 and 5 per cent respectively. NIST’s Special Publication 800-63B revision 4, published 31 July 2025, requires that a biometric system used for authentication “operate with an FMR of one in 10000 or better for all demographic groups”. Those are floors chosen by committees, which is better than floors chosen by nobody, and they are still choices.

Liveness is not solved, and “certified” is not “unspoofable”#

The plain version did not mention fakes at all. Introduce them and a new question appears: is the thing on the sensor a finger?

The honest version: detecting that is a separate problem with its own standard, its own metrics and its own arms race, and it has never been finished. The Chaos Computer Club published a working defeat of Apple’s Touch ID on 22 September 2013, days after the iPhone 5s went on sale, using a fingerprint photographed from a glass surface at 2400 dots per inch, printed onto a transparent sheet at 1200 dots per inch with heavy toner, and cast in latex or wood glue. Their spokesman Frank Rieger’s comment was that “it is plain stupid to use something that you can not change and that you leave everywhere every day as a security token”. The specific method has been mitigated many times over since; the class of attack has not gone away.

A laboratory certificate against ISO/IEC 30107-3 says that a named laboratory presented a named set of fake-finger types to a named product under named conditions on a named date and measured how often they were accepted. It does not say the product cannot be fooled. It says the product resisted those artefacts. A new material, a new printer or a new technique is a new experiment.

Cancelling a biometric cancels a template, not a finger#

The plain version ended by saying you cannot reissue a finger. People who have heard of cancellable biometrics sometimes think the problem is therefore solved.

The honest version: cancellable biometrics does not give you a new finger. It gives you a scheme in which what gets stored is a deliberately distorted version of your features, distorted by a parameter that can be thrown away and replaced. If the store leaks, you re-enrol with a fresh parameter, and the old stored value stops matching anything. That is genuinely valuable and it is not the same as revocability in the password sense, because the underlying finger is unchanged, because every enrolment across every system still comes from the same ridges, and because the distortion has to be reversible enough to still allow matching, which is precisely the property attackers work on. We will look at the real schemes, and at the published attack that broke the most popular one, in the technical half.

The technical version#

The vocabulary, stated exactly#

Almost every argument about biometrics that goes in circles is a vocabulary problem, so we start there. The controlled vocabulary is ISO/IEC 2382-37, Information technology - Vocabulary - Part 37: Biometrics. As of August 2026 the current edition is the third, published 29 March 2022, 34 pages, from ISO/IEC JTC 1/SC 37, and it is free of charge. It was marked for revision in January 2025 and a draft is in progress.

A biometric characteristic is the thing about the body: the friction ridge pattern on a finger. A biometric sample is a captured representation of it: the image the sensor produced. A biometric feature is a value extracted from a sample for comparison: the position and angle of one minutia. A biometric reference is what is stored against a person, which is what everybody in practice calls a template. A biometric probe is the freshly captured thing being compared against the reference.

Then two error families, and this distinction is the one practitioners insist on. False match rate and false non-match rate, FMR and FNMR, are properties of the comparison subsystem: given that a comparison happened, how often did it decide wrongly. False accept rate and false reject rate, FAR and FRR, are properties of the whole system as the user meets it, and therefore include failures to acquire, retry policies, multiple attempts and any fallback. A system with an FMR of one in ten thousand that allows five attempts has an FAR considerably worse than one in ten thousand. ISO/IEC 19794-2 still lists FAR and FRR among its abbreviated terms, a reminder that even the standards have drifted.

Two more, from ISO/IEC 30107-1, Biometric presentation attack detection - Part 1: Framework, second edition published 10 August 2023, 11 pages, also free. A presentation attack is a presentation to the capture device intended to interfere with the operation of the system. A presentation attack instrument, or PAI, is the object used: the gelatine finger, the printed photograph, the silicone mask. Presentation attack detection, PAD, is the automated determination of such an attack. Note that the scope is the capture device, at presentation. An attacker who injects a manufactured image directly into the software, bypassing the sensor, is outside the scope of the entire 30107 series, and that is the attack class that has grown fastest since about 2023. Chapter 20 handles injection attacks, because the camera pipeline is where they happen.

Finally the measurement standard, ISO/IEC 19795-1, Biometric performance testing and reporting - Part 1: Principles and framework, second edition of 27 May 2021 with a corrected version in September 2024, 76 pages, at stage 90.92 and marked to be revised as of August 2026. Its scope statement contains a sentence worth memorizing: measuring error rates for people deliberately trying to subvert the system is explicitly not within its scope. Performance testing and attack testing are different disciplines with different standards, and a supplier who answers a security question with a performance number has changed the subject.

What a template actually is: ISO/IEC 19794-2 in detail#

The interchange format for fingerprint minutiae is ISO/IEC 19794-2, Information technology - Biometric data interchange formats - Part 2: Finger minutiae data. The current edition is the second, dated 15 December 2011, 93 pages, from JTC 1/SC 37. It carries a technical corrigendum from 2012 and two amendments: Amendment 1 of 2013 on conformance testing methodology and clarification of defects, and Amendment 2 of 2015 adding XML encoding. It was reviewed and confirmed on 6 September 2024, so it remains current. One unusual note on the ISO catalogue entry deserves mention because it explains a great deal of field confusion: the previous edition, ISO/IEC 19794-2:2005, exceptionally remains valid until 2033. Two incompatible editions of the same format are both live, and a large amount of deployed equipment speaks the older one.

Clause 6 defines minutiae extraction, and it is where a physical fact becomes a data structure.

Clause 6.3 defines the types. There are exactly three: ridge ending, ridge bifurcation, and other. The standard is explicit that “other” shall not be used for points that are in fact ridge endings or bifurcations, and clause 6.3.3 rules that a trifurcation, where a ridge splits into three, shall be encoded as two bifurcations with identical coordinates and different orientation angles. Clause 6.3.2 requires each minutia to be encoded once, identified uniquely by location and angle.

Clause 6.4 defines location by way of skeletons. The ridge skeleton is the ridge area thinned to lines one pixel wide; the valley skeleton is the valley area thinned the same way. Clause 6.4.3 places a ridge ending where the valley in front of it forks, that is, where three thinned valley lines meet. Clause 6.4.4 places a bifurcation where three thinned ridge lines meet. Clause 6.4.5 offers an alternative, the ridge skeleton endpoint, being the skeleton pixel with only one neighbour. Clause 6.4.6 then permits both formats to use either valley skeleton bifurcations or ridge skeleton endpoints for ridge endings, and that is not a detail: two conforming extractors can legitimately place the same minutia in two different spots, which is why interoperability has to be tested rather than assumed.

Clause 6.4.2 sets the coordinate system: Cartesian, origin at the upper left corner of the original image, X increasing to the right, Y increasing downward, all values non-negative. It notes drily that when viewed on the finger, X increases from right to left. The same clause sets the units, and here the two formats part company. In the record format X and Y are in pixels, with the spatial sampling rate carried separately in the header at clauses 8.4.11 and 8.4.12 so a reader can convert; in the on-card comparison format, clause 9.2.3, they are in fixed units of one tenth of a millimetre per bit, because a card cannot be expected to do the conversion.

Clause 6.5.1 sets the angles the same way. Both measure counter-clockwise from the horizontal axis to the right. The record format scales the angle to 1.40625 degrees per least significant bit, which is 360 divided by 256, so it fits in one byte. The on-card format uses 5.625 degrees per bit, which is 360 divided by 64, so it fits in six.

Clause 6.7 settles endianness: all multibyte quantities are big-endian and all numeric values are fixed-length unsigned integers. Clause 6.6 adds cores and deltas, which are singular points of the ridge flow rather than minutiae, and clause 8.5 defines the optional extended data areas: ridge counts between neighbouring minutiae, core and delta positions, and vendor-defined blocks.

Here is one representation decoded. The coordinates are invented for illustration; the field definitions and units are exactly those of the standard.

ISO/IEC 19794-2:2011 record format, decoded
finger position : 2 (right index)
impression type : 0 (live-scan plain)
sampling rate   : 197 px/cm both axes
image size      : 300 x 400 px

 #     x(px)   y(px)  angle  type
 1       117     241     34  ridge ending
 2       212      90    181  ridge bifurcation
 3        88     340    247  ridge ending
 4       165     158     12  ridge bifurcation
 ...
36       249     305    203  ridge ending

angle unit = 1.40625 deg = 360/256, one byte
angle 34 -> 34 x 1.40625 = 47.8 degrees
all values unsigned, big-endian, clause 6.7

Thirty-six minutiae, each carrying two coordinates, one angle, one type and one quality value, is a few hundred bytes. That is the whole credential.

The on-card comparison format, and why it exists#

Clause 9 of the same standard defines a second, smaller encoding, and clause 7.3 names it the on-card comparison format. Its whole purpose is that the comparison happens inside a smart card, on a processor with a few kilobytes of memory, which never releases the stored template to anything.

Three design consequences follow, all visible in the clause structure. Clause 9.2.5 coarsens the angle to 5.625 degrees, as above. Clause 9.2.3 fixes the coordinate units at a tenth of a millimetre so the card does no arithmetic on sampling rates. Clauses 9.3 and 9.4 govern truncation and ordering: the number of minutiae is capped, the excess is discarded, and the surviving minutiae are written in a defined order so that the card can process them predictably. Table 18 of the standard enumerates the permitted ordering indications.

The architecture around this is ISO/IEC 24787-1, On-card biometric comparison - Part 1: General principles and specifications, first edition of 4 June 2024, 35 pages, from JTC 1/SC 17 rather than SC 37. It replaced ISO/IEC 24787:2018 and, as of August 2026, is already at stage 90.92, marked to be revised. Its scope covers architectures for comparison using an integrated circuit card, on-card comparison in sensor-off-card systems and within a biometric system-on-card, and security policies for both. Work-sharing arrangements, where card and terminal split the comparison, live in part 2; systems where the sensor is on the card itself are the ISO/IEC 17839 series.

NIST Special Publication 800-76-2, Biometric Specifications for Personal Identity Verification, of 11 July 2013, ties this to the United States federal card. Section 4.4.1 requires the PIV card template to conform to the INCITS 378-2004 minutiae standard. Section 4.4.2, table 6, sets the bounds: record length from 26 up to 1,574 bytes, number of minutiae from 0 up to 128, with the note that if only 10 or fewer minutiae are found, re-enrolment should be attempted. The record holds two finger views under one general record header, wrapped in the PIV multi-field CBEFF header, and section 5 specifies the separate on-card template in ISO/IEC 19794-2:2011 format, derived from the INCITS 378 one by pruning minutiae, re-encoding angles and sorting.

Two numbers are worth holding: a whole two-finger PIV fingerprint record fits in under 1.6 kilobytes, and a card is expected to work with at most 128 minutiae per finger.

Proprietary templates, and how much bigger they really are#

Interchange formats are not what most systems use internally. A supplier’s own template can hold anything it likes, and in practice it holds a great deal more than minutiae: ridge flow maps, texture descriptors, learned feature vectors, quality maps.

NIST measures these in the Proprietary Fingerprint Template evaluation. The first PFT ran from 2003 to 2010, documented in NIST Interagency Report 7221 of 2005; PFT II was announced in 2010, documented in NIST Interagency Report 7821 of 2011, and enlarged the data sets so that lower false match rates could be measured; PFT III was released on 30 October 2019 and is ongoing, its test plan last updated on 28 August 2025.

PFT III is the cleanest public window onto real fingerprint accuracy. Participants submit a shared library implementing a fixed C++ interface, and NIST runs it on operational data that participants never see, protected under the Privacy Act, 5 U.S.C. section 552a. The two calls that matter are these.

/* Feature extraction: image in, opaque template out. */
std::tuple<FingerImageStatus,
           CreateProprietaryTemplateResult>
createProprietaryTemplate(
    const FingerImage &fingerImage);

/* Comparison: two templates in, one score out. */
std::tuple<CompareProprietaryTemplatesStatus, double>
compareProprietaryTemplates(
    const std::vector<uint8_t> &probeTemplate,
    const std::vector<uint8_t> &referenceTemplate);

Three things in that interface carry the whole argument of this chapter. The template is a std::vector<uint8_t>, an opaque bag of bytes whose meaning only its creator knows. The comparison returns a double, a bare number with no units and no scale. And the test plan is explicit that any failure to produce a template, for any reason, is categorized as a failure to enrol, which is its way of insisting that a system which cannot read you has failed, whatever the reason.

The test plan also imposes timing floors: template creation shall return in 0.5 seconds on average and comparison in 0.01 seconds, measured on a dedicated timing sample on an Intel Xeon Gold 6524. Libraries link against a NIST-built shared object under Ubuntu Server 24.04.3 LTS and must be single-threaded, stateless, deterministic, and must not touch the filesystem or the network.

How big is a real proprietary template? The report card for idemia+0008, completed 16 June 2026, gives the distribution over the fixed timing sample, in bytes.

A median of 14,816 bytes against a PIV interchange record’s ceiling of 1,574 bytes for two fingers. The proprietary template is roughly twenty times the size of the standard one for a single finger, and that extra content, rather than any cleverness in the matching, accounts for most of the accuracy difference between proprietary and interoperable systems.

NIST states the trade plainly. The MINEX III evaluation, which tests interoperable templates, permits a template to contain only “minutia type (ridge ending, bifurcation, or unknown), angle, location, and quality, as well as finger position and image quality”. PFT III templates have no restrictions at all. Same fingers, same matchers, twenty times the data, and the difference shows up as accuracy.

Enrolment, failure to enrol, and template ageing#

Enrolment is where a person becomes a record, and it is the least engineered step in most deployments.

The sequence is: capture one or more samples, assess quality, extract features, decide whether the result is good enough to store, store it, bind it to an identity. Each step can fail. Failure to acquire is a failed capture at this attempt; failure to enrol is the person’s inability to produce a usable reference at all. ISO/IEC 19795-1 sets out how both should be measured and reported, and honest reporting of failure to enrol is the single clearest signal of whether a supplier is being straight with you.

The physical causes are unglamorous: worn ridges from manual work or from handling chemicals; dry skin, especially in cold weather and in older people; excessively moist skin; scarring; skin conditions such as eczema or psoriasis on the fingertips; certain chemotherapy agents, documented to cause loss of fingerprint detail; amputation and congenital absence of ridges. No algorithm fixes a finger with no ridges on it.

Aadhaar again supplies the scale. UIDAI’s own position, reported in 2018, was that slightly higher authentication failure rates were observed for fingerprints among citizens above the age of 70, while the Economic Survey figures quoted earlier put state-level failure far higher. The technical point that survives every argument about that programme is this: the people most likely to fail enrolment and authentication are disproportionately old, poor and manual workers, which is to say the people least able to absorb being turned away.

Template ageing is the slower cousin. The best evidence is the longitudinal study by Soweon Yoon and Anil Jain in the Proceedings of the National Academy of Sciences, volume 112, from page 8555, in the issue dated 14 July 2015, covering 15,597 subjects each with at least five ten-print records over a minimum span of five years, drawn from an operational database. Their findings are precise and are misquoted in both directions.

First, genuine match scores decrease significantly as the interval between the two fingerprints increases, while impostor scores barely change: the genuine distribution slides towards the impostor distribution over time. Second, and this is the part that gets left out, recognition accuracy at operational settings nevertheless tends to be stable as the interval increases up to 12 years, the maximum span in their data. The scores drift but, at a sensibly chosen threshold, the decisions do not.

There is a third finding, and it is the one that matters for Anwar: the uncertainty of that temporal stability becomes substantially larger if either of the two fingerprints being compared is of poor quality. Ageing is not a problem for good fingers. It is a problem for bad ones, which is the same population as failure to enrol, which is the same population as everything else in this chapter.

The two distributions and the threshold between them#

Now the core mechanism, stated exactly.

Run a large evaluation. Every mated comparison, meaning two samples from the same finger, produces a genuine score. Every non-mated comparison, meaning samples from different fingers, produces an impostor score. Plot both as distributions on the same axis.

count
  |         impostor scores        genuine scores
  |            .-''-.                  .-''-.
  |           /      \                /      \
  |          /        \              /        \
  |        _/          \_          _/          \_
  |     __/              \___   __/              \__
  +--------------------------|----------------------
                             T                 score

  left of T  -> system says "no match"
  right of T -> system says "match"

  genuine area left of T   = false non-matches (FNMR)
  impostor area right of T = false matches     (FMR)
  move T right: FMR falls, FNMR rises
  move T left : FMR rises, FNMR falls

Everything follows from that picture.

The two distributions overlap because fingers are measured, not read. The threshold T is a scalar you choose. Sliding T does not shrink the overlap; it only decides which half of the overlap you pay for. The overlap itself is shrunk only by better sensors, better algorithms, better images, or more fingers.

That last point is the one lever that actually works, and the published numbers are dramatic. Take the same IDEMIA submission on the MINEX III data set. On a single index finger, the false non-match rate at a false match rate of 0.0001 is 0.0015. Fuse two index fingers by summing the scores, and the false non-match rate at the same false match rate falls to 0.000006. That is six in a million against fifteen in ten thousand: a factor of 250, obtained not by turning a dial but by asking for a second finger.

FMR, FNMR, EER and the detection error trade-off curve#

The conventional way to present the whole family of choices at once is the detection error trade-off curve, or DET curve, introduced by Alvin Martin, George Doddington, Terri Kamm, Mark Ordowski and Mark Przybocki in “The DET curve in assessment of detection task performance” at Eurospeech in September 1997. Plot false non-match rate on one axis against false match rate on the other, both on a scale where equal ratios take equal distances, and let each point on the line be one possible threshold.

Here is a real one, described from the published report card for idemia+0008, figure 4, generated on 16 June 2026 at 11:23:40 Eastern Daylight Time, over all comparisons of all fingers in the Arizona Department of Public Safety data set.

FNMR
0.2   +
      |
0.1   +
      |
0.05  +
      |
0.02  +   \
      |     \  -0.4
0.01  +       \
      |         \____  -2.2
0.005 +               \_____  -3.2
      |                      \______
0.002 +                             \____  -5.4
      |                                   \__ -6.6
0.0001+---+------+------+------+------+------+
    0.0001 0.001  0.005  0.01   0.05   0.2   FMR

grey numbers on the curve are that submission's
own similarity thresholds; they have no meaning
outside this submission

Read it as a menu. Each point is a threshold you could ship: the horizontal coordinate is what a stranger’s chance of being accepted becomes, the vertical coordinate is what a genuine user’s chance of being refused becomes. You cannot pick a point off the curve. You can only pick a point on it, or buy a better curve.

The published table beneath that figure gives three of those points exactly, and the same three for the other data sets.

Two things jump out of that table and both matter more than the headline accuracy.

First, look along a row. The same algorithm, at the same threshold, on the same day, gives a false non-match rate of 0.0030 on Arizona data and 0.0050 on Los Angeles County data. That is a 67 per cent difference caused entirely by the data: the Los Angeles set is described in the report as plain and rolled impressions captured with a mixture of ink and optical devices, the Arizona set as live-scan. Accuracy is not a property of an algorithm. It is a property of an algorithm applied to a population through a sensor.

Second, look down a column. Loosening the threshold by a factor of a hundred, from one in ten thousand to one in a hundred, improves the Arizona refusal rate only from 0.0030 to 0.0020, and on the Port of Entry data only from 0.0044 to 0.0040. The security cost is enormous and the usability gain is a third of the refusals, because the curve is flat in that region. Anyone who loosens a threshold to reduce complaints without looking at the curve is very likely giving away a hundredfold in security for almost nothing.

Now compare three submissions at one threshold, from the published PFT III results table as it stood on 17 August 2026, listing 67 completed submissions.

The two leading submissions, from 2025 and 2026, are within a whisker of each other. The Startek submission completed on 14 July 2020 refuses genuine users on the Los Angeles data 27.73 per cent of the time at the same operating point. Both were tested by the same organization on the same data. “Fingerprint recognition is 99 per cent accurate” is not a sentence with a meaning.

One more term, the one most often quoted and least often useful. The equal error rate, EER, is the single point on the curve where the false match rate and the false non-match rate are equal. It is a convenient scalar for ranking algorithms in a paper and close to useless for a deployment, because no real system is operated there: nobody wants a door whose chance of admitting a stranger equals its chance of refusing an employee. When a data sheet quotes only an EER, it is describing a research benchmark, not your door.

Speed matters too, and the same table shows how differently suppliers weigh it. Mean comparison time ranged from 0.6 microseconds for one submission to over 8,500 microseconds for another, a factor of more than ten thousand, among submissions whose accuracy differed by far less. A door doing one-to-one verification does not care. A system searching a gallery of fifty million does.

Presentation attack detection in practice#

ISO/IEC 30107-3, Biometric presentation attack detection - Part 3: Testing and reporting, second edition published 10 January 2023, 39 pages, defines how to measure resistance to fakes; the 2017 first edition is withdrawn, and Annex A of the current edition classifies known attack types.

The two headline metrics are deliberately parallel to FMR and FNMR. APCER, attack presentation classification error rate, is the proportion of attack presentations using a given presentation attack instrument species that were wrongly classified as genuine; a high APCER means the fakes get through. BPCER, bona fide presentation classification error rate, is the proportion of genuine presentations wrongly classified as attacks; a high BPCER means real people are accused of holding a rubber finger. For full systems rather than PAD subsystems, the metric is IAPMR, impostor attack presentation match rate: the proportion of attack presentations that produced a match against the targeted identity. That last is the number a buyer actually wants, because it folds the PAD decision and the comparison decision together.

The same trade-off appears again, one level up. A PAD mechanism that never lets a fake through, by rejecting anything slightly unusual, has an APCER of zero and a BPCER that makes the product unusable. It is the same dial.

Testing is done by accredited laboratories, of which iBeta and BixeLab are the two most often named in commercial claims. iBeta’s published methodology grades tests by level, and the level fixes the effort, the attacker’s skill and the materials permitted: at Level 3 the schedule allows seven days per attack instrument species and four days per subject, an evaluator with significant dedicated research experience, and extensive equipment including hyper-realistic facial masks with specialized environments, with a 5 per cent penetration or match rate allowed. iBeta also limits BPCER and FNMR to 15 per cent for a pass, and to no more than 10 per cent to qualify for Level 3. Those are a commercial laboratory’s operating policy, not clauses of the ISO standard, and it is worth knowing which is which when reading a certificate.

For mobile devices there is a dedicated profile, ISO/IEC 30107-4, Profile for testing of mobile devices, second edition published 7 February 2024, 14 pages. It exists because a mobile device is a closed system: the tester cannot see internal PAD results, only whether the phone unlocked.

Two floors from elsewhere belong beside those. NIST SP 800-63B revision 4, of 31 July 2025, states that a biometric system “SHOULD implement PAD for iris and fingerprint modalities and SHALL implement PAD for facial recognition”, and that testing “SHOULD demonstrate an impostor attack presentation accept rate (IAPAR) of less than 0.07”. The FIDO Alliance’s biometric certification requirements version 4.1, of 6 January 2025, are more prescriptive.

Read the top-left cell again. A false accept rate of 1 per cent satisfies FIDO BioLevel 1. One in a hundred. That is a certification floor for a real, shipping, widely used certification programme, and it exists because that is where the industry actually is at the low end. The same document requires 245 test subjects for the plus levels, requires each subject to conduct 10 mated verification transactions, requires self-reported demographic information for age, gender and skin tone, and adds a system-level rule that the number of impostor attack transactions accepted across all species shall be under 4 per cent of the total conducted.

NIST’s SP 800-63B revision 4 also settles the retry question that the “one in fifty thousand” argument turns on. It permits no more than five consecutive failed authentication attempts, or 10 if PAD is implemented and meets its requirements; after that, a delay of at least 30 seconds before each subsequent attempt, with an overall limit of 50 consecutive failures, or 100 with PAD, after which biometric authentication must be disabled and another factor offered. And it states the constraint that most people find surprising: “Biometrics SHALL only be used as part of multi-factor authentication with a physical authenticator”, and “An alternative non-biometric authentication option SHALL always be provided to the subscriber”. In the American federal guidance, as of August 2026, a fingerprint is never a factor on its own. It is a way of unlocking a factor.

Irrevocability, and what a leaked template is worth#

Now the property that makes all of this different in kind.

On 4 June 2015 the United States Office of Personnel Management announced a breach of personnel records. On 9 July 2015 it announced a second, larger incident affecting background investigation records for 21.5 million people, and stated at the time that about 1.1 million of them had had fingerprints taken. On 23 September 2015, OPM revised that figure: the number of individuals whose fingerprints had been stolen was 5.6 million.

Look at what that number is. It is not a count of passwords, which were changed within a week. It is a count of people, and by the nature of a background investigation they are disproportionately holders of security clearances. The federal statement at the time downplayed the immediate risk on the grounds that the ability to misuse fingerprint data was limited, and added, correctly, that this could change as technology evolves. Eleven years later the technology has evolved and the fingerprints have not.

That asymmetry is the whole point. Every other credential in this book puts a clock on the attacker: the certificate expires, the password is rotated, the card is reissued, the token is replaced. A stolen fingerprint template has no clock. It is as useful in 2045 as it was in 2015, and the person it belongs to has no move available.

What can an attacker do with a stolen template? Four things, in increasing order of difficulty.

The first is cross-matching. If two organizations both store templates of the same finger, an attacker holding both files can link the two accounts even if names and numbers differ. It is a privacy harm, it needs no clever mathematics, and it is why ISO/IEC 24745 names unlinkability as a required property.

The second is replay against a system that accepts templates. Any system whose comparison subsystem takes a template over a network, rather than an image from its own sensor, will happily compare a submitted one. If the attacker can put bytes on that wire, the sensor is irrelevant.

The third is reconstruction, discussed earlier: building a synthetic image from a minutiae set that a matcher will accept, which is what makes “the template is not a picture” an insufficient defence.

The fourth is fabrication of a physical artefact from a reconstructed image, which returns us to the Chaos Computer Club’s 2013 recipe. The club’s own note predates the OPM disclosure by two years: you leave your fingerprints everywhere, every day. A determined attacker need not breach a database at all. At the club’s 31st Chaos Communication Congress in Hamburg in late December 2014, Jan Krissler, the same researcher who broke Touch ID under the name Starbug, reported reconstructing the fingerprint of the German defence minister Ursula von der Leyen from high-resolution photographs of her hands taken with a standard camera, one of them issued by a government press office.

Cancellable biometrics and ISO/IEC 24745#

The response to irrevocability is to stop storing anything that is worth stealing.

The governing standard is ISO/IEC 24745, Information security, cybersecurity and privacy protection - Biometric information protection, second edition of 8 February 2022, 63 pages, from JTC 1/SC 27, the information security subcommittee, rather than SC 37. That committee assignment is itself a statement: this is a security problem, not a biometrics problem.

It sets out three requirements a protected biometric reference must satisfy, and it is worth having all three because implementers routinely deliver one and claim all of them.

Irreversibility. Given the stored protected reference, it must be computationally infeasible to recover the original biometric features. This stops a leak becoming a permanent physical compromise.

Unlinkability. Two protected references derived from the same characteristic, in two different applications, must not be identifiable as coming from the same person. This stops the leak becoming a cross-database join.

Renewability, or revocability. It must be possible to issue a fresh protected reference from the same characteristic, such that the old one no longer matches. This restores the change-your-password property at the level of the record rather than the body.

The idea predates the standard. The founding paper is Nalini Ratha, Jonathan Connell and Ruud Bolle, “Enhancing security and privacy in biometrics-based authentication systems”, IBM Systems Journal, volume 40, number 3, 2001, pages 614 to 634. Their proposal: before storing anything, apply a deliberate, repeatable, non-invertible distortion to the signal or its features, using a transform chosen per application; store the distorted version and compare in the distorted domain. If the store is compromised, change the transform and re-enrol, and the stolen file is dead. Ratha, Chikkerur, Connell and Bolle, “Generating Cancelable Fingerprint Templates”, in IEEE Transactions on Pattern Analysis and Machine Intelligence in 2007, gives concrete constructions for fingerprints, including a surface folding transform on the minutiae positions.

The tension in every such scheme fits in one sentence: the distortion must destroy enough information to be irreversible and preserve enough structure that two noisy readings of the same finger still land close together. Those pull in opposite directions, and every published scheme sits somewhere on that line, usually paying for its security properties with a worse false non-match rate.

A related family is biometric hashing, of which BioHashing, introduced by Teoh, Ngo and Goh in Pattern Recognition in 2004, is the best known. It combines the feature vector with a token-held random number by repeated inner products, producing a compact binary code. Its published error rates were spectacular, and the reason turned out to be that much of the performance came from the token rather than the finger: in the stolen-token scenario, where the attacker holds the token and not the finger, the accuracy collapses. That is the standing warning in this field. Any two-factor scheme must be evaluated with each factor assumed stolen in turn.

Fuzzy commitments, fuzzy vaults and fuzzy extractors#

The cryptographic branch of the same problem asks a harder question: can we derive an actual cryptographic key from a finger, so that nothing secret is stored at all?

The difficulty is stated exactly. Cryptographic keys must be reproduced bit for bit and should be uniformly random. Biometric readings are neither. So you need machinery that turns a noisy, non-uniform input into a stable, uniform output, while any public data it leaves behind reveals nothing useful. Three constructions, in historical order.

The fuzzy commitment scheme, by Ari Juels and Martin Wattenberg, presented at the ACM Conference on Computer and Communications Security in 1999, works when the biometric can be turned into a fixed-length bit string. Pick a random codeword from an error-correcting code, exclusive-or it with the biometric string, and store the result together with a hash of the codeword. At verification, exclusive-or the fresh string with the stored value and run error correction: if the new reading was close enough, the original codeword pops out and its hash matches. Nothing stored reveals the biometric on its own. Iris codes fit this model well because they are naturally fixed-length bit strings; fingerprints do not.

The fuzzy vault, by Ari Juels and Madhu Sudan, presented at the IEEE International Symposium on Information Theory in 2002 with a journal version in Designs, Codes and Cryptography in 2006, handles unordered sets, which is what a minutiae list is. Encode a secret as the coefficients of a polynomial, evaluate it at the points corresponding to your real minutiae, and store those pairs. Then add a large number of chaff points, random pairs that do not lie on the polynomial, and shuffle everything together. Somebody with the right finger identifies enough genuine points to interpolate the polynomial and recover the secret. Somebody without it faces a haystack.

It is an elegant idea and it has a documented failure. Alisher Kholmatov and Berrin Yanikoglu implemented it with fingerprints and published “Realization of correlation attack against the fuzzy vault scheme” on 14 February 2008 at SPIE Electronic Imaging. Their attack assumes only what any real deployment guarantees, that the same finger has been enrolled twice. Overlay the two vaults: genuine points appear in both, because they come from the same finger, while chaff points are independently random and do not. Against 400 fuzzy vaults comprising 200 matching pairs, they unlocked 59 per cent of the pairs in a short time, and for 41 per cent of all vaults they could link an unknown vault to a shortlist containing its partner. That second number is a direct violation of unlinkability, one of ISO/IEC 24745’s three requirements, by the scheme most often proposed to deliver it. Walter Scheirer and Terrance Boult had raised the general class of problem the year before, in “Cracking Fuzzy Vaults and Biometric Encryption” at the 2007 Biometrics Symposium.

The fuzzy extractor, the general and rigorous version, is due to Yevgeniy Dodis, Rafail Ostrovsky, Leonid Reyzin and Adam Smith, at Eurocrypt 2004, Springer Lecture Notes in Computer Science volume 3027, pages 523 to 540, with the full version in SIAM Journal on Computing, volume 38, number 1, 2008, pages 97 to 139. They define two primitives, and their own words are the clearest available:

A fuzzy extractor “reliably extracts nearly uniform randomness R from its input; the extraction is error-tolerant in the sense that R will be the same even if the input changes, as long as it remains reasonably close to the original. Thus, R can be used as a key in a cryptographic application.”

A secure sketch “produces public information about its input w that does not reveal w, and yet allows exact recovery of w given another value that is close to w. Thus, it can be used to reliably reproduce error-prone biometric inputs without incurring the security risk inherent in storing them.”

That is the right abstraction and the theory is solid. The practical difficulty is not the cryptography but the assumption underneath it. A fuzzy extractor’s security is quantified in terms of the min-entropy of the source, roughly a measure of how unpredictable the input really is. Real fingerprints have far less entropy than their bit-length suggests, minutiae are spatially correlated rather than independent, and the distributions are not precisely known. The proofs are therefore conditional on parameters nobody can measure well for real skin. The honest position as of August 2026 is that the constructions are established mathematics, their application to fingerprints is active research, and any product claiming to derive a key from your finger at a stated security level is making an entropy assumption you should ask to see.

Where the comparison happens, and why it is the biggest decision#

Everything above concerned the data. This concerns the architecture, and if you have one decision to get right, this is it.

There are three places the comparison can happen.

(1) CENTRAL MATCHING
 sensor -> [network] -> server holding N templates
                        compare, return yes/no
 breach of server yields: N templates

(2) MATCH-ON-DEVICE
 sensor -> secure area of the phone/laptop
           holds 1 template, compares locally
           releases a key or unlocks a credential
 breach of one device yields: 1 template

(3) MATCH-ON-CARD
 sensor -> terminal -> card (ISO/IEC 7816)
           card holds 1 template, compares on chip
           template never leaves the chip
 breach of one card yields: 1 template, if extractable

The security difference is not a matter of degree. In the first architecture a single compromise yields every template in the system, permanently, for every enrolled person. In the second and third it yields one person’s template, and only if the attacker also defeats the hardware protecting it.

Match-on-device is what phones do. Apple’s documentation states that Touch ID stores “only this mathematical representation of your fingerprint... never images of your finger itself”, that the data is protected by a key available only to the Secure Enclave, and that Face ID data “doesn’t leave your device and is never backed up to iCloud or anywhere else”. The comparison happens in a separate hardware domain, and the result of a successful comparison is not a message saying “yes”; it is the release of a key that unlocks a credential. That distinction matters, because a message saying “yes” can be forged by anything able to write to the channel, while a key either exists or does not.

Match-on-card is what the smart-card world does, and it is why clause 9 of ISO/IEC 19794-2 exists at all. The card holds the reference, receives a probe template from the terminal, compares on its own chip and answers; the reference never leaves. ISO/IEC 24787-1:2024 sets out the architectures and security policies, ISO/IEC 7816-11 defines the card commands for personal verification by biometric methods, and NIST SP 800-76-2 section 5 specifies the PIV on-card template, derived from the interchange template by pruning, re-encoding and sorting precisely because the card format is deliberately smaller and coarser.

There is a real cost and it should be stated. On-card comparison runs on a constrained processor with a truncated, coarsened template, so it is less accurate than a server-side proprietary matcher. You are trading measurable accuracy for structural containment, and in almost every deployment that trade is correct, because accuracy failures are recoverable and a stolen national template database is not.

Central matching is not always avoidable. Deduplication, which is checking that a person is not already enrolled under another name, is inherently a one-to-many search and cannot be done on the person’s own card or phone. That is the honest argument for a central store and it is the one every national identity scheme makes. The answer is not to pretend otherwise but to be exact about which operations genuinely need it, to protect it under ISO/IEC 24745 with irreversibility, unlinkability and renewability actually implemented rather than claimed, and to be clear that a one-to-many search has entirely different error behaviour from a one-to-one check. Chapter 20 works that arithmetic through for faces.

Setting the threshold: the worked example, finished#

Return to the factory in Ludhiana, and do it properly this time.

The company is buying a system. Five thousand staff, about ten thousand one-to-one verifications per working day, roughly 250 working days a year. The door protects a stores area, and the realistic threat is a former employee, or an employee’s relative, presenting somebody else’s identity card and their own finger. Assume, generously, 50 such attempts a year.

Step one: measure, do not assume. Ask the supplier for the DET curve for the exact submission being sold, and if they offer only an equal error rate, ask again. If the product appears in PFT III, look it up. Notice that the Arizona and Los Angeles County figures for one product differ by 67 per cent, and conclude that your own workforce is a third data set nobody has measured.

Step two: price both errors in the same currency. Fifty attack attempts a year at a false match rate of one in ten thousand gives an expected 0.005 successful break-ins per year, which is one every two hundred years. At one in a hundred it is one every two years.

Step three: price the other side. From the Arizona column above, a false match rate of one in ten thousand gives a false non-match rate of 0.0030, which is 30 refusals a day out of 10,000 presses. At one in a hundred it is 0.0020, or 20. You would be buying a hundredfold worse security to remove ten annoyances a day.

Step four: find out where those refusals land. This is the step that is always skipped. Instrument the reader to record, per employee, how many attempts each verification took. After a month a small group will account for most of the retries; in this factory, the lathe and press operators. That is the failure-to-enrol and failure-to-acquire population, and no threshold setting will fix it, because their problem is upstream of the comparison.

Step five: fix the actual problem. Enrol multiple fingers, since fusing two gave a 250-fold improvement in the MINEX III figures quoted earlier. Provide a documented, dignified fallback that does not require finding a supervisor: a card plus a personal identification number, at the same door, at the same speed. Record how often it is used, because that number is the true exclusion rate of the biometric.

Step six: write down the numbers and the date, and re-measure annually, because fingers age, sensors wear, and the supplier will ship a new algorithm version with a different curve behind the same threshold number.

That is what “a threshold someone chose” looks like when it is done responsibly: not a default left in place, but a documented, measured, revisited decision that names the people it costs.

What none of this fixes#

Two closing technical points, because a chapter that ends on good practice would be dishonest.

The first is that everything above concerns the sensor and the comparison. It says nothing about an attacker who never touches the sensor. If the pipeline between the camera and the matcher can be fed manufactured data, the entire 30107 series is out of scope by its own words, since it addresses attacks at the capture device during presentation. That is now the dominant attack class in remote identity verification, and chapter 20 handles it.

The second is that a biometric authenticates a body, not an intention. A key can be withheld and a password can be refused, but a finger can be pressed to a sensor by somebody holding your wrist. The Chaos Computer Club raised this in the same 2013 statement, noting that you can easily be forced to unlock a phone against your will, and that compelling a long passcode is harder under most jurisdictions than swiping a phone across handcuffed hands. The comparative legal position varies by country and is Volume V’s subject. The engineering point stands on its own: a biometric proves that a body was present. It does not prove that a person agreed.

19.98 Common wrong ideas#

Wrong: My fingerprint is stored as an image on the device. Right: What is stored is a template, a derived record of features; in the ISO/IEC 19794-2:2011 interchange format that means the type, coordinates and angle of each minutia with the angle quantized to 1.40625 degrees per bit, and in a proprietary format it means an opaque blob whose median size in NIST’s June 2026 report card for one leading submission was 14,816 bytes.

Wrong: A template cannot be reversed, so a leaked template is harmless. Right: Irreversibility is a property a system must be engineered to have, not one templates possess automatically; published research reconstructs images from standard minutiae templates that matchers accept, which is exactly why ISO/IEC 24745:2022 lists irreversibility as a requirement alongside unlinkability and renewability.

Wrong: A fingerprint reader decides whether it is you. Right: It computes a similarity score on an arbitrary scale defined only by that algorithm, and a threshold chosen by a human turns that score into a decision; in NIST’s report cards the thresholds printed on the curve are negative numbers with no meaning outside that one submission.

Wrong: Fingerprint recognition is about 99 per cent accurate, and the equal error rate proves it. Right: Accuracy is a property of an algorithm applied to a population through a sensor at a chosen threshold, no deployment is ever operated at its equal error rate, and in PFT III one submission gave a false non-match rate of 0.0030 on Arizona data and 0.0050 on Los Angeles County data at the same operating point on the same day, while a 2020 submission gave 0.2773 on that Los Angeles data.

Wrong: Setting a stricter threshold makes the system better. Right: It moves error from false matches onto false non-matches without shrinking the overlap between the two score distributions, and because the curve is often flat, loosening the false match rate by a factor of a hundred removed only a third of the genuine refusals on the Arizona data, from 0.0030 to 0.0020.

Wrong: The two errors that matter are false accepts and false rejects. Right: Failure to acquire and failure to enrol happen before any comparison, they fall on manual workers, older people and those with skin conditions, and they are the errors that exclude people; India’s Economic Survey for 2016 to 2017 recorded biometric authentication failure of 49 per cent in Jharkhand and 37 per cent in Rajasthan on page 202.

Wrong: Liveness detection means fake fingers cannot get in. Right: ISO/IEC 30107-3:2023 measures how often a named laboratory’s named set of artefacts was accepted on a named date, using APCER and BPCER, and a certificate is a record of an experiment rather than a proof; the Chaos Computer Club defeated Touch ID on 22 September 2013 with a photograph of a glass and wood glue.

Wrong: Cancellable biometrics or a fuzzy vault means I can revoke my fingerprint. Right: Such schemes replace the stored value with a distorted or chaff-padded one whose parameter can be reissued, leaving your finger unchanged and still enrolling identically elsewhere; and Kholmatov and Yanikoglu’s correlation attack of 14 February 2008, assuming only that the same finger had been enrolled twice, unlocked 59 per cent of 200 matching vault pairs and linked 41 per cent of all 400 vaults to a shortlist containing their partner.

Wrong: Storing everyone’s templates centrally is fine if the database is encrypted. Right: The architecture decides what a single compromise costs, and central matching means one breach yields every template permanently, which is why match-on-card under ISO/IEC 24787-1:2024 and match-on-device accept a measurable accuracy penalty in exchange for containing the blast radius to one person.

Wrong: A biometric is a strong single factor. Right: NIST SP 800-63B revision 4 of 31 July 2025 states that biometrics shall only be used as part of multi-factor authentication with a physical authenticator, requires a false match rate of one in ten thousand or better for all demographic groups, and requires that a non-biometric alternative always be offered.

19.99 Chapter summary in 20 lines#

1. A biometric system does not store a picture of your finger; it stores a template, a derived record of features, and the template is the credential.
2. The features are minutiae, and ISO/IEC 19794-2:2011 recognizes exactly three types: ridge ending, ridge bifurcation and other, with trifurcations encoded as two bifurcations sharing coordinates.
3. That standard places a ridge ending at the fork of the thinned valley in front of it and a bifurcation at the fork of the thinned ridge, and permits an alternative placement, so two conforming extractors can legitimately disagree.
4. The record format stores coordinates in pixels with the sampling rate in the header and angles at 1.40625 degrees per bit, while the on-card format stores tenths of a millimetre and 5.625 degrees per bit, all big-endian and unsigned.
5. A whole two-finger PIV interchange record fits in 1,574 bytes under NIST SP 800-76-2 with at most 128 minutiae per finger, while one proprietary template in NIST’s June 2026 report card had a median size of 14,816 bytes.
6. Every comparison produces a similarity score on an arbitrary scale, not a probability and not a decision, and scores are not comparable between products, versions or data sets.
7. Genuine and impostor scores form two overlapping distributions, and a threshold chosen by a person decides which half of the overlap gets paid for and by whom.
8. Moving the threshold trades false matches against false non-matches without shrinking the overlap; only better sensors, better algorithms, better images or more fingers shrink it.
9. Fusing two index fingers took one submission’s false non-match rate on the MINEX III data from 0.0015 to 0.000006 at a false match rate of one in ten thousand, a 250-fold gain from asking for a second finger.
10. The detection error trade-off curve plots false non-match rate against false match rate on logarithmic axes, and each point on it is one threshold you could ship.
11. In PFT III as of August 2026, with 67 completed submissions, the same leading algorithm scored 0.0030 on Arizona data and 0.0050 on Los Angeles County data at the same operating point, so accuracy is a property of algorithm plus population plus sensor.
12. The equal error rate is the point where the two error rates meet, no deployment operates there, and quoting it alone tells a buyer nothing useful.
13. Failure to acquire and failure to enrol happen before any comparison and fall disproportionately on manual workers, older people and those with skin conditions, and they are the errors that exclude rather than admit.
14. Yoon and Jain’s study of 15,597 subjects, published in PNAS on 14 July 2015, found genuine scores decline significantly with elapsed time while impostor scores do not, yet operational accuracy stayed stable to 12 years except where image quality was poor.
15. Presentation attack detection is standardized in the ISO/IEC 30107 series and measured by APCER and BPCER, with IAPMR for whole systems, and its scope stops at the capture device, so injection attacks are outside it entirely.
16. The Chaos Computer Club defeated Apple’s Touch ID on 22 September 2013 using a print photographed at 2400 dots per inch and cast in latex or wood glue, and the class of attack has never been eliminated.
17. On 23 September 2015 the United States Office of Personnel Management revised its estimate of stolen fingerprints from about 1.1 million to 5.6 million people, and unlike a password those records have no expiry.
18. ISO/IEC 24745:2022 requires a protected biometric reference to be irreversible, unlinkable and renewable, three properties that implementers routinely deliver one of and claim all three.
19. Fuzzy commitments, fuzzy vaults and fuzzy extractors are the cryptographic attempts at those properties, and the fuzzy vault fell to a correlation attack published in 2008 that needed only two enrolments of the same finger.
20. Where the comparison happens decides what one breach costs: central matching loses every template permanently, while match-on-card under ISO/IEC 24787-1:2024 and match-on-device lose one, and that containment is worth the accuracy it costs.

Chapter sources: ISO/IEC 19794-2:2011, “Biometric data interchange formats - Part 2: Finger minutiae data”, second edition of 15 December 2011, 93 pages, JTC 1/SC 37, especially clauses 6.2 to 6.7, 7.2, 7.3, 8.4.11, 8.4.12, 8.4.19.1.4, 8.5, 9.2.3, 9.2.5, 9.3 and 9.4 with annexes B, C and F, plus Corrigendum 1 of 2012, Amendment 1 of 2013 on conformance testing and Amendment 2 of 2015 on XML encoding, confirmed 6 September 2024, its 2005 first edition exceptionally valid until 2033, and its normative references ISO/IEC 7816-11:2004 and ISO/IEC 19785-3:2007; ISO/IEC 2382-37:2022, third edition of 29 March 2022, 34 pages, free of charge; ISO/IEC 19795-1:2021, second edition of 27 May 2021 with corrected version of September 2024, 76 pages; ISO/IEC 30107-1:2023, second edition of 10 August 2023, 11 pages, free of charge; ISO/IEC 30107-3:2023, second edition of 10 January 2023, 39 pages, with Annex A; ISO/IEC 30107-4:2024, second edition of 7 February 2024, 14 pages; ISO/IEC 24745:2022, second edition of 8 February 2022, 63 pages, JTC 1/SC 27; ISO/IEC 24787-1:2024, first edition of 4 June 2024, 35 pages, JTC 1/SC 17, superseding ISO/IEC 24787:2018. NIST Proprietary Fingerprint Template Evaluation III, test plan and application programming interface last updated 28 August 2025 from an initial release of 30 October 2019, its results table listing 67 completed submissions as of 17 August 2026, and the report card for idemia+0008 completed 16 June 2026, source of detection error trade-off figures 4, 7 and 10, tables 3, 6, 9, 12, 30 and 31; NIST Interagency Reports 7221 of 2005 and 7821 of 2011; the MINEX III results tables and compliance criteria published 17 August 2026, listing 268 MINEX III and 107 Ongoing MINEX entries; NIST Interagency Report 8034, Watson, Fiumara, Tabassi, Cheng, Flanagan and Salamon, December 2014; NIST Special Publication 500-290e3; NIST Special Publication 800-76-2 of 11 July 2013, sections 4.4.1, 4.4.2 with table 6, and 5; NIST Special Publication 800-63B revision 4 of 31 July 2025 on multi-factor use, the false match rate of one in 10,000 across demographic groups, presentation attack detection with an impostor attack presentation accept rate under 0.07, and the five, ten, 50 and 100 attempt limits with a 30-second delay. FIDO Alliance Biometric Certification Requirements version 4.1 of 6 January 2025, with the BioLevel error tables, 245 subjects, 10 mated transactions each, self-reported age, gender and skin tone, and the 4 per cent limit on accepted attack transactions, with Biometric Component Certification Policy version 1.5 of 22 May 2024; iBeta’s published ISO/IEC 30107-3 methodology and level definitions. Chaos Computer Club, “Chaos Computer Club breaks Apple TouchID”, 22 September 2013, and Jan Krissler’s demonstration at the 31st Chaos Communication Congress, Hamburg, late December 2014; Apple support documentation on Touch ID and Face ID; United States Office of Personnel Management statements of 4 June, 9 July and 23 September 2015. Yoon and Jain, PNAS volume 112 from page 8555, 14 July 2015; Cappelli, Maio, Lumini and Maltoni, IEEE TPAMI volume 29 number 9, September 2007, pages 1489 to 1503; Ratha, Connell and Bolle, IBM Systems Journal volume 40 number 3, 2001, pages 614 to 634, and Ratha, Chikkerur, Connell and Bolle, IEEE TPAMI 2007; Teoh, Ngo and Goh, Pattern Recognition 2004; Juels and Wattenberg, ACM CCS 1999; Juels and Sudan, IEEE ISIT 2002 with the 2006 journal version; Dodis, Ostrovsky, Reyzin and Smith, Eurocrypt 2004, LNCS 3027, pages 523 to 540, and SIAM Journal on Computing volume 38 number 1, 2008, pages 97 to 139; Kholmatov and Yanikoglu, SPIE Electronic Imaging, 14 February 2008; Scheirer and Boult, 2007 Biometrics Symposium; Martin, Doddington, Kamm, Ordowski and Przybocki, “The DET curve in assessment of detection task performance”, Eurospeech, September 1997; Cappelli, Ferrara, Franco and Maltoni, Biometric Technology Today volume 15 numbers 7 and 8, pages 7 to 9, August 2007. Government of India, Economic Survey 2016-17, page 202, and UIDAI’s 2018 statement on failure above age 70; Henry Faulds, “On the Skin-Furrows of the Hand”, Nature volume 22, page 605, October 1880.