QBioAuth

Overview

Biometric databases are breaches waiting to happen. QBioAuth removes the database. It is a four-layer mutual authentication protocol that fuses iris biometrics, post-quantum signatures (ML-DSA-65), quantum key distribution and AES-256-GCM into one executable pipeline. The user's signing key is rebuilt on the fly from a fresh iris scan, so no biometric template exists to steal, and a signed QKD exchange derives a fresh session key at every login. A FastAPI WebSocket bridge streams every step of the real protocol into a live React diagram, including a one-click intercept-resend attack that the system catches in real time. Evaluated across 6,800 simulated trials.

The Problem

Biometrics can't be reset. Once a template database leaks, the fingerprint or iris inside it is compromised for life, and a quantum-capable attacker turns today's signature schemes into a second liability. Most systems either store a template or trust a classical key exchange. QBioAuth asks whether a login can work with no template, no stored private key and a session key derived from quantum key distribution, and then makes the answer something you can watch: every step of the real protocol streams live into a diagram you can attack.

How It Was Built

The research claims behind QBioAuth live on the IIT Delhi experience page. This page is about the build. A four-layer cryptographic protocol that actually executes, and a frontend that lets you watch it think.

Four Layers, One Executable Pipeline

Watching the Protocol Think

A FastAPI layer streams every internal step of the real pipeline as a typed event over a WebSocket, and a React frontend renders it live. A Terminal, Server and User diagram animates the actual phase transitions as the cryptography runs, with QBER and key-size metric cards, a full event log and an encrypted chat with a per-message "show ciphertext" toggle that reveals the real nonce, ciphertext and associated data.

The centrepiece is an intercept-resend attack toggle. Flip it mid-demo and the QBER card jumps past the abort threshold, the edge pulses red and an attack banner appears, a different alarm from a generic noise failure. A replay mode re-drives a finished run at adjustable speed without touching the backend.

Nothing about the cryptography is faked. Only the round-by-round Cascade breakdown is synthesised for animation pacing, and its total always matches the real one.

Design Decisions

The Biometric Never Leaves the Terminal

Raw biometric data never reaches the frontend and never persists server-side. The single exception is explicit: a newly enrolled user's own iris code is issued back to them once, in a dedicated copy-to-clipboard callout.

One Source of Truth for the Live Run

The frontend is React 18 and TypeScript on Vite, with a discriminated-union type for every protocol event and command. A single Zustand store holds the live run, and the replay system simply re-drives events it has already received.

A Backend URL That Can Rotate

The protocol backend runs inside a Colab VM behind a cloudflared tunnel whose HTTPS address changes on every restart. So the frontend takes the backend URL at runtime, validates it against the health endpoint and stores it in the browser, with no rebuild required.

Stress-Testing It

The protocol was put through a 6,800-trial one-factor-at-a-time study, and the live attack toggle lets you see the headline result yourself: genuine sessions stay reliable through 150 km under the baseline configuration, while a full intercept-resend attack is rejected in every baseline trial. The full evaluation is on the research page.

What It Doesn't Claim

The iris data is synthetic, the quantum channel is simulated and the demo runs on a Colab runtime that forgets enrolled users on restart. A demo-only iris registry lets the frontend trigger realistic noisy re-scans without a physical scanner, deliberately isolated from the real protocol's storage guarantees. Backend CORS is open for demo convenience. This is a research prototype and a live-demo tool, not a production identity system.