Biometric Key Impossibility Theorem: Information-Theoretic Limits of Behavioral Cryptographic Secrecy

Abstract

This work proves a formal impossibility theorem stating that no observable behavioral or biometric signal can serve as a cryptographic secret under standard semantic security notions (IND-CPA / IND-CCA), in any computational model admitting machine learning approximation and side-channel observability. The result holds in classical, post-quantum, and hybrid adversarial models. We further derive strict architectural consequences for biometric authentication, fuzzy extractors, and behavioral identification systems, showing that such signals may only function as zero-knowledge liveness proofs, not as entropy sources for cryptographic key material.