TY - GEN
T1 - India’s “Aadhaar” Biometric ID
T2 - Financial Cryptography and Data Security
AU - Tiwari, Pratyush Ranjan
AU - Agarwal, Dhruv
AU - Jain, Prakhar
AU - Dasgupta, Swagam
AU - Datta, Preetha
AU - Reddy, Vineet
AU - Gupta, Debayan
N1 - Publisher Copyright:
© 2022, International Financial Cryptography Association.
PY - 2022
Y1 - 2022
N2 - India’s Aadhaar is the largest biometric identity system in history, designed to help deliver subsidies, benefits, and services to India’s 1.4 billion residents. The Unique Identification Authority of India (UIDAI) is responsible for providing each resident (not each citizen) with a distinct identity—a 12-digit Aadhaar number—using their biometric and demographic details. We provide the first comprehensive description of the Aadhaar infrastructure, collating information across thousands of pages of public documents and releases, as well as direct discussions with Aadhaar developers. Critically, we describe the first known cryptographic issue within the system, and discuss how a workaround prevents it from being exploitable at scale. Further, we categorize and rate various security and privacy limitations and the corresponding threat actors, examine the legitimacy of alleged security breaches, and discuss improvements and mitigation strategies.
AB - India’s Aadhaar is the largest biometric identity system in history, designed to help deliver subsidies, benefits, and services to India’s 1.4 billion residents. The Unique Identification Authority of India (UIDAI) is responsible for providing each resident (not each citizen) with a distinct identity—a 12-digit Aadhaar number—using their biometric and demographic details. We provide the first comprehensive description of the Aadhaar infrastructure, collating information across thousands of pages of public documents and releases, as well as direct discussions with Aadhaar developers. Critically, we describe the first known cryptographic issue within the system, and discuss how a workaround prevents it from being exploitable at scale. Further, we categorize and rate various security and privacy limitations and the corresponding threat actors, examine the legitimacy of alleged security breaches, and discuss improvements and mitigation strategies.
KW - Biometric
KW - Resident identification
KW - Security & privacy
UR - http://www.scopus.com/inward/record.url?scp=85142713864&partnerID=8YFLogxK
U2 - 10.1007/978-3-031-18283-9_34
DO - 10.1007/978-3-031-18283-9_34
M3 - Conference article in proceedings
AN - SCOPUS:85142713864
SN - 978-3-031-18282-2
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 672
EP - 693
BT - Financial Cryptography and Data Security - 26th International Conference, FC 2022, Revised Selected Papers
A2 - Eyal, Ittay
A2 - Garay, Juan
PB - Springer
Y2 - 2 May 2022 through 6 May 2022
ER -