Research Intern

Overview

Research Intern at IIT Delhi under the National Quantum Mission, architecting QBioAuth, a post-quantum, template-less biometric authentication framework combining ML-DSA signatures, iris-based fuzzy key reconstruction, and T12 biased-basis QKD. Evaluated across 6,800 experimental trials. Manuscript co-authored with Dr. Neel Kanth Kundu and Dr. Neha Sharma, submitted to IEEE ANTS 2026.

Key Contributions

• Architected and built QBioAuth end-to-end: ML-DSA (Dilithium) mutual authentication, template-less iris-based credential reconstruction, T12 biased-basis QKD, Cascade reconciliation, HKDF key derivation, and AES-GCM channel security across a terminal-server architecture.
• Designed a template-less biometric mechanism using fuzzy reconstruction and Reed-Solomon error correction. The user's signing credential is rebuilt locally from a fresh iris scan. The raw biometric data and private keys are never stored or transmitted.
• Built the full simulated QKD pipeline modelling fibre attenuation, detector inefficiency, dark counts, QBER estimation, recursive Cascade reconciliation, and privacy amplification.
• Designed and ran a One-Factor-at-a-Time (OFAT) evaluation across 6,800 trials spanning 7 protocol and physical-layer parameters, characterising distance, basis bias, adversarial interception, QBER thresholds, and reconciliation reliability.
• Took the project from problem definition to submitted manuscript in 8 weeks — architecture, implementation, experimentation, and writing.
• Built a Gradio-based graphical interface exposing the full authentication pipeline for interactive demonstration.

Tech Stack

The Work

Biometric authentication has a structural problem: template databases. Fingerprints, iris scans, and facial encodings are typically stored somewhere, and unlike a password, a compromised biometric can't be reset. QBioAuth was built to remove the template from the equation entirely — no biometric data, and no private signing key, is ever stored or transmitted, even by the authenticating server.

The Threat Being Solved

The framework assumes a fairly hostile environment: a Dolev-Yao adversary with full control over the classical channel (intercept, modify, replay, forge) and quantum computational capability. The one thing the adversary can't do is compromise the trusted execution environment of the terminal itself, or violate the physics of quantum measurement.

How It Works — Four Phases

Phase 1 — Mutual device authentication. Terminal and server authenticate each other using NIST-standardised ML-DSA (Dilithium) signatures before any user-specific data moves, closing off malicious-terminal and impersonation attacks up front.

Phase 2 — Template-less biometric verification. A fresh iris scan is run through fuzzy extraction and Reed-Solomon error correction to reconstruct the user's ML-DSA signing key locally, tolerating natural scan-to-scan noise without ever storing a reusable template. Only a public verification key and non-secret helper data live on the server — helper data alone is insufficient to reconstruct the biometric.

Phase 3 — Quantum key establishment. A verified terminal generates a signed QAuth token authorising a T12 biased-basis QKD session. T12 deliberately biases basis selection toward the computational basis (baseline P(Z) = 0.8), trading some of BB84's symmetry for higher secret-key generation efficiency. Recursive Cascade reconciliation and privacy amplification then strip out any information an eavesdropper could have picked up during transmission.

Phase 4 — Session security. The reconciled quantum secret is expanded via HKDF into independent terminal-to-server and server-to-terminal encryption keys and nonce bases, which drive an AES-GCM authenticated channel for the rest of the session.

Evaluation: 6,800 Trials

Rather than testing the happy path and calling it done, the framework was evaluated with a One-Factor-at-a-Time (OFAT) study — 7 protocol and physical-layer parameters, 27 experimental configurations, 100 trials each with and without an intercepting adversary, totalling 6,800 individual runs.

The headline number: legitimate sessions stayed reliable through 150 km under the baseline configuration, while every interception attempt above modest levels was correctly detected and rejected via QBER-threshold enforcement — the system fails safe rather than failing open.

What It Doesn't Claim

In the interest of not overselling a research prototype: the iris data used in evaluation is synthetic (2048-bit representations with modelled noise), not captured from real sensor hardware, and the quantum channel is a distance-aware physical simulation, not an experimental optical link. The framework also doesn't yet defend against a compromised trusted terminal or denial-of-service. Both are explicitly considered out of scope for this iteration. Those are the stated next steps: real biometric sensors, hardware-backed trusted execution, and extending point-to-point QKD toward repeater-based networking.

From Problem to Manuscript in 8 Weeks

The project ran end-to-end, the architecture, implementation, the full 6,800-trial evaluation, and a written manuscript in 8 long weeks, under the guidance of Dr. Neel Kanth Kundu and Dr. Neha Sharma and submitted to IEEE ANTS 2026.