Is there a feasible and secure way that this physical image could be used as cryptographic key, functionally equivalent to an AES key or RSA private key, without "accompanying² other digital data" beyond the physical image? We'll assume a scanner digitizes the physical image at each use, and all the rest is handled digitally.
We may want to distinguish 4 use cases
- Symmetric message encryption and decryption
- Symmetric message authentication and verification
- Asymmetric decryption of a ciphertext for a secret message, encrypted using a previously made public key
- Asymmetric/Digital signature of a message, publicly verifiable using a public key assumed authentic.
For asymmetric, there is the issue that contrary to traditional private keys, the physical image can't contain the public key, which needs to be prepared separately (from an independent scan).
Assume we want at least³ CPA security and EUF-CMA signature security; and we are ready to tolerate that cryptograms and public keys are large, the algorithms slow, and that legitimate decryption or signature verification fails with some low yet noticeable probability.
If that's not possible (I don't know a method⁴), can the necessary "accompanying² other digital data" be public? Does it's integrity need to be trusted? How large does it needs to be for various kinds of physical image, perhaps including biometric data (assumed private)? What standard name(s) does this "other data" have?
Late update (2021-09-08): I now wonder if for symmetric crypto we could use the combination of
- image preprocessing as in this answer;
- Ran Canetti, Benjamin Fuller, Omer Paneth, Leonid Reyzin, Adam Smith: Reusable Fuzzy Extractors for Low-Entropy Distributions, originally in proceedings of EuroCrypt 2016;
- AES-GCM with the "helper" in the above passed as associated data, and key the "extract".
¹ The question was initially asked for biometric data assumed private and acquired in a socially acceptable way. Say, a retina scan, and there's an unfalsifiable method to recognize safe retina scanners from those that will keep a copy of the scan or burn the user blind, and eye doctors did not keep archives, and key rotation was unnecessary. The main reason I mentioned biometry was to repel it for use as straight replacement of a cryptographic key, with hard security argument rather than just poorly meeting the functional goals.
² By "accompanying" I mean kept along the image, with the same secrecy and integrity. The question is thus excluding e.g. making marks on the physical image. But embedding in the ciphertext some data generated from a scan of the physical image would be game.
³ We'd additionally like that encryption remains secure under the assumption that an adversary can submit arbitrary ciphertexts to a decryption oracle, and gain knowledge of if the decryption was successful or not. This is tantamount to CCA security.
⁴ Main problem is that the outcome of a scan varies, and no algorithm can fix (in both senses of the term) it (at least, for all arbitrary images) into something directly usable as key in a standard cryptosystem, without some "other data". I suspect (robust?)fuzzy extractors may help to a degree, but I admit that my knowledge about them is itself fuzzy. It thus seems impossible to define a function that turn scans into a key for a standard unmodified symmetric cryptosystem like AES-CTR or AES-GCM, and have it secure and working acceptably reliably. To illustrate the difficulty I scanned a photo (not the one above), 5 times, using the same scanner with same setting (B&W 8-bit), just moving the image at each scan and manually moving a selection rectangle of constant size. Here are the scans. I believe that any deterministic algorithm that turns these scans into a stable key will either need to contain data extracted from one of the scans in order to get stable output for the others (and won't work reliably for most other set of scans made from different images), or will have insufficient entropy in it's output.