2026.
T.14.
№ 3.
id 2125
DOI: 10.26102/2310-6018/2026.54.3.003
A method is proposed for locally recovering a reproducible biometric secret key within a trusted execution environment using an error-tolerant key-extraction construction, followed by deriving a local session key. The protocol architecture explicitly distinguishes: (I) a shared secure-channel key computed by both parties solely from the outcome of a hybrid authenticated shared-secret establishment procedure with a post-quantum component and the handshake transcript; and (II) a local session key computed only on the client device within the trusted execution environment based on the result of local biometric verification. The local session key is used to protect local artifacts and to perform critical on-device operations; it is neither transmitted to the server nor required for server-side verification. The method ensures reproducibility under intra-class variability of biometric measurements, minimizes server-side handling of biometric-derived key material within the organization’s information system, and provides cryptographically sound separation of key-material domains. The object of study is the external communication channel between the user terminal and the company’s remote server; inter-server links between the company server, the cryptobiometric system, and the remote database of the Unified Biometric System are assumed to be protected using certified cryptographic mechanisms compliant with national standards and are not analyzed.
Keywords:
trusted execution environment, biometrics, key recovery, noise-tolerant recovery, key derivation function, hybrid authenticated key establishment, post-quantum shared-secret establishment, secure communication channel, handshake transcript, remote identification