Log-on password replacement is one of the Holy Grails of the IT security world. Now a German start-up has come up with a personal biometric crypto-key which it says is practical and adds little cost.
Called Jar, it is a true biometric device which uses the user’s finger tip as their password for every login and registration.
The Aachen-based company, which is project of venture firm MBP-Investments, is developing the Arduino-based system to run an asymmetrical encryption method which adds a high level of security to the system.
“This is the first biometric crypto-key for end customers. Instead of using passwords to access websites, the user can login or register with the touch of his or her finger,” said developer, Jannis Mertens.
The first device will connect to the PC or mobile through the audio input and is protected using encryption.
“We have no access to the data which is encrypted on JAR, so we have no way of decrypting your passwords,” said Jannis Mertens.
Because each message is encrypted separately, there’s no way to derive one message from the previous message; each encrypted message broadcasted is non-deterministic and pseudorandom.
“Devices will only unlock for the most recent message, so a hacker is unable to unlock your devices by re-broadcasting an old message,” said the developer, said Jannis Mertens.
Only devices that have been set up with the device will have the ability to interact with it. A device still has to verify its legitimacy through an automatic encrypted handshake in order to interact with the device.
The developers have started a campaign on Kickstarter to raise €100,000 needed to fund the next stage of development and they hope to be ready for revenue generation as of early 2016, after starting the mass production of the hardware.
The customer target price is €99.
A future plan is to replace the audio-connector interface with a Bluetooth 4.0 LE interface to connect to the host device.