Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

ISO/IEC-Compliant Match-on-Card Face Verification with Short Binary Templates

Abdelilah Ganmati, Karim Afdel, Lahcen Koutti

TL;DR

This work designs an ISO/IEC-compliant match-on-card face verification system that uses short binary templates of length $L\in\{64,128\}$ produced by PCA–ITQ and matched on-card with constant-time Hamming distance. It specifies fixed-length APDUs and decision-only status words, enabling transport-bound end-to-end latency dominated by link speed rather than card computation. On a CelebA subset (55 identities, 412 images), both template lengths achieve TPR = 0.836 at FAR = 1%, with 128 b offering a modest reduction in EER at the cost of extra storage. The approach preserves privacy (non-invertibility, unlinkability, revocability via RotationIDs) and demonstrates practical end-to-end latency well within ISO/IEC transport constraints, making it suitable for implementation in SE/JavaCard environments. Limitations include single-dataset evaluation and pre-hardware timing, with planned extensions to broader benchmarks, microbenchmarks, and deeper unlinkability analyses.

Abstract

We present a practical match-on-card design for face verification in which compact 64/128-bit templates are produced off-card by PCA-ITQ and compared on-card via constant-time Hamming distance. We specify ISO/IEC 7816-4 and 14443-4 command APDUs with fixed-length payloads and decision-only status words (no score leakage), together with a minimal per-identity EEPROM map. Using real binary codes from a CelebA working set (55 identities, 412 images), we (i) derive operating thresholds from ROC/DET, (ii) replay enroll->verify transactions at those thresholds, and (iii) bound end-to-end time by pure link latency plus a small constant on-card budget. Even at the slowest contact rate (9.6 kbps), total verification time is 43.9 ms (64 b) and 52.3 ms (128 b); at 38.4 kbps both are <14 ms. At FAR = 1%, both code lengths reach TPR = 0.836, while 128 b lowers EER relative to 64 b. An optional +6 B helper (targeted symbol-level parity over empirically unstable bits) is latency-negligible. Overall, short binary templates, fixed-payload decision-only APDUs, and constant-time matching satisfy ISO/IEC transport constraints with wide timing margin and align with ISO/IEC 24745 privacy goals. Limitations: single-dataset evaluation and design-level (pre-hardware) timing; we outline AgeDB/CFP-FP and on-card microbenchmarks as next steps.

ISO/IEC-Compliant Match-on-Card Face Verification with Short Binary Templates

TL;DR

This work designs an ISO/IEC-compliant match-on-card face verification system that uses short binary templates of length produced by PCA–ITQ and matched on-card with constant-time Hamming distance. It specifies fixed-length APDUs and decision-only status words, enabling transport-bound end-to-end latency dominated by link speed rather than card computation. On a CelebA subset (55 identities, 412 images), both template lengths achieve TPR = 0.836 at FAR = 1%, with 128 b offering a modest reduction in EER at the cost of extra storage. The approach preserves privacy (non-invertibility, unlinkability, revocability via RotationIDs) and demonstrates practical end-to-end latency well within ISO/IEC transport constraints, making it suitable for implementation in SE/JavaCard environments. Limitations include single-dataset evaluation and pre-hardware timing, with planned extensions to broader benchmarks, microbenchmarks, and deeper unlinkability analyses.

Abstract

We present a practical match-on-card design for face verification in which compact 64/128-bit templates are produced off-card by PCA-ITQ and compared on-card via constant-time Hamming distance. We specify ISO/IEC 7816-4 and 14443-4 command APDUs with fixed-length payloads and decision-only status words (no score leakage), together with a minimal per-identity EEPROM map. Using real binary codes from a CelebA working set (55 identities, 412 images), we (i) derive operating thresholds from ROC/DET, (ii) replay enroll->verify transactions at those thresholds, and (iii) bound end-to-end time by pure link latency plus a small constant on-card budget. Even at the slowest contact rate (9.6 kbps), total verification time is 43.9 ms (64 b) and 52.3 ms (128 b); at 38.4 kbps both are <14 ms. At FAR = 1%, both code lengths reach TPR = 0.836, while 128 b lowers EER relative to 64 b. An optional +6 B helper (targeted symbol-level parity over empirically unstable bits) is latency-negligible. Overall, short binary templates, fixed-payload decision-only APDUs, and constant-time matching satisfy ISO/IEC transport constraints with wide timing margin and align with ISO/IEC 24745 privacy goals. Limitations: single-dataset evaluation and design-level (pre-hardware) timing; we outline AgeDB/CFP-FP and on-card microbenchmarks as next steps.
Paper Structure (23 sections, 3 equations, 5 figures, 7 tables)

This paper contains 23 sections, 3 equations, 5 figures, 7 tables.

Table of Contents

  1. Introduction
  2. Challenge.
  3. Contributions.
  4. Related Work
  5. System Overview
  6. Binary template generation (off-card)
  7. Bit packing and transport.
  8. On-card matching (constant time)
  9. Memory and timing footprint.
  10. Revocation and renewal.
  11. Threat model and compliance posture
  12. Engineering notes (on-card hygiene)
  13. APDUs, Memory Map, and Policies
  14. Policies and hygiene.
  15. Security, Privacy, and Compliance
  16. ...and 8 more sections

Figures (5)

  • Figure 1: End-to-end pipeline. Off-card: detection/alignment, backbone encoder, PCA--ITQ hashing to $L\!\in\!\{64,128\}$ bits. On-card: constant-time XOR+popcount, decision-only APDUs. Transport uses ISO/IEC 7816-4 (contact) and ISO/IEC 14443-4 (contactless).
  • Figure 2: APDU flows for ENROLL_TEMPLATE, VERIFY_BINARY, and REKEY_ROTATION over ISO/IEC 7816-4 (contact) and 14443-4 (contactless). Fixed payloads, strict Lc, decision-only status words.
  • Figure 3: Confusion matrices for streamed enrol$\rightarrow$verify at ROC thresholds.
  • Figure 4: ISO/IEC 7816-4 and 14443-4 transport $+$ constant-time match. 64 b, 128 b, and 64 b$+6$ B parity. All points $<100ms$; contactless regimes are $\ll20ms$.
  • Figure 5: Operating points on the CelebA working set. Bars show EER and $\mathrm{TPR}@\mathrm{FAR}{=}1\%$ for 64 b and 128 b PCA--ITQ templates.