Biometrics, match-on-card and template privacy
All AmbiSecure engineering content tagged Biometrics, newest first. Newer entries reflect current thinking; earlier entries come from the engineering archive.
Biometrics authenticate a person by a physical or behavioural trait — fingerprint, face, palm vein, or iris — rather than something they know or carry. In hardware-rooted identity systems the decisive engineering question is where the match happens: match-on-device (or match-on-card) compares the live sample against a template that never leaves a secure element, whereas match-on-server centralises templates and creates a high-value breach target.
This category collects AmbiSecure engineering writing on biometric modalities, template protection, liveness and presentation-attack detection, and the privacy trade-offs of consumer biometric deployments. The recurring theme is that a biometric is an identifier, not a secret: it cannot be rotated if leaked, so the template store and the matcher must be protected in tamper-resistant hardware.
Frequently asked questions
Is match-on-device more secure than match-on-server?
Generally yes for privacy and breach exposure: match-on-device keeps the enrolled template inside a secure element and returns only a yes/no decision, so a server compromise never exposes raw biometric data. Match-on-server centralises templates, which simplifies large fleets but concentrates risk.
Can a biometric replace a cryptographic key?
No. A biometric is best used to unlock or gate access to a hardware-held key, not to replace it. Biometrics are non-secret and non-revocable, so the actual authentication secret should remain a key inside a secure element that the biometric merely releases.
What is presentation-attack detection?
Presentation-attack detection (liveness) checks that the sample comes from a live person rather than a photo, mould, or replay. It is a distinct problem from matching accuracy and is essential wherever unsupervised capture is possible.
Can a biometric be revoked if it is compromised?
Not the trait itself, which is why systems bind a revocable cryptographic credential to the biometric rather than treating the biometric as the secret. Revocation cancels the credential; the fingerprint stays yours.
Where does the biometric template actually live?
In a well-designed deployment it stays inside the secure element on the card or device and is compared there. Nothing usable leaves the chip, so there is no central template database to breach.