A Privacy-Preserving RLWE-Based Remote Biometric Authentication Scheme for Single and Multi-Server Environments

Lwamo <italic>et al.</italic> recently proposed a robust and efficient remote single and multi-server biometric authentication scheme using smart card and <italic>RSA</italic>. The scheme is vulnerable to the smart card lost attacks; therefore, the scheme cannot resist offline guessing attacks and user impersonation attacks, and cannot provide forward security and user anonymity. To address these issues, we propose a new privacy-preserving ring learning with errors (<italic>RLWE</italic>)-based remote biometric authentication scheme (<italic>RRBAS</italic>) for single and multi-server environments. <italic>RRBAS</italic> is the first lattice-based remote biometric authentication scheme for multi-server environments. Security analysis show that <italic>RRBAS</italic> can satisfy the authenticated key exchange (<italic>AKE</italic>) security in the random oracle model, resist known security attacks, and provide post-quantum security. The experimental evaluation and comparative analysis show that <italic>RRBAS</italic>’s computational efficiency is better than that of Lwamo <italic>et al.</italic>, while the communication efficiency is slightly lower than traditional schemes because of the large-size ciphertext of the lattice-based cryptosystem, but it is fully capable of session key agreement in single and multi-server environments.