  Biometric authentication is one of the promising alternatives to standard
password-based authentication offering better usability and security. In this
work, we revisit the biometric authentication based on "fuzzy signatures"
introduced by Takahashi et al. (ACNS'15, IJIS'19). These are special types of
digital signatures where the secret signing key can be a "fuzzy" data such as
user's biometrics. Compared to other cryptographically secure biometric
authentications as those relying on fuzzy extractors, the fuzzy signature-based
scheme provides a more attractive security guarantee. However, despite their
potential values, fuzzy signatures have not attracted much attention owing to
their theory-oriented presentations in all prior works. For instance, the
discussion on the practical feasibility of the assumptions (such as the entropy
of user biometrics), which the security of fuzzy signatures hinges on, is
completely missing.
  In this work, we revisit fuzzy signatures and show that we can indeed
efficiently and securely implement them in practice. At a high level, our
contribution is threefold: (i) we provide a much simpler, more efficient, and
direct construction of fuzzy signature compared to prior works; (ii) we
establish novel statistical techniques to experimentally evaluate the
conditions on biometrics that are required to securely instantiate fuzzy
signatures; and (iii) we provide experimental results using a real-world
finger-vein dataset to show that finger-veins from a single hand are sufficient
to construct efficient and secure fuzzy signatures.
  Our performance analysis shows that in a practical scenario with 112-bits of
security, the size of the signature is 1256 bytes, and the running time for
signing/verification is only a few milliseconds.
